last executing test programs: 11m13.943497275s ago: executing program 32 (id=5148): r0 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000000)={0x1ed, 0x1b, &(0x7f0000000080)="9a284ccfa5926c44c14cb32e42ef7fdc786246faaea05dbf3edf838f5aebfc4269ba9cd3217ab0a691fca8fb3aa753f9d110893a94dd874b7bbae4de81606cd91280b478ae96d55ce300e397aa3f21448eb3a2b919ddbede07a7fc909be6fc164af530f0c10dfb64620b0ed2a2cfc8446181423644ae1029e243656303b41514115edc5a9d12184f9779dca730b78c3609dd9d617e564f252d3ba83639ebfa3a840f81126c82cf60f2bbc7213c3ab491639b4f3929fd692674a2311ec7f72911734796884097e673be3acded163b1a70bce7f6b728fb89990f189450a27387c5fc8bb4adef07f9a9603f88755333542349cf140b5995f19594d9dd43d559121fc3c53b814c9ef21423290f97166a74f1161143cdd8c93f8856687a18d3018efcb8ab4c8517fd03b2be1db67c9525e24d8dd0134f42e6484dbf797648c366999603f2132caa3075203885f19190a1043f05832f1f1de016fbe335adad6d60dec92ec3a40a6cc8a2569edee408aead03109d30359c8d0c43f69a42c04e619626c55d206a1065e881d28ec70b7fe4d1233a0bc14701973e1d0db78410d1de7bfbc0b4cc9db315db12c9cf1d085f442d2b9e2feac2980d88f3ba223518e8d787847a0eef4b0ab2bda55f61ad28277f34ba58da868b6724bf8e5a953b80db55c50a2c52e657c67ce2ec3c3d7b6d49ce722d9689c676b5d94caae076034f761565ce4c401a0ba87da8a4cc081c16d0bf066c45ddf6cae3bbeb71f45061fbf7d6940790da16a6ef41f4fa2823589ca2e36f3f90d73802519c50f76604dd93348aca82a772973486fae1c05e54b87972ab7bf2155280d809e9538c4bfb0556233808e59f685152d5b18a24d8489764ef9dec3c572b75be53abca87e135226d3ff4abf06dcb390457163eb2d4f3423dfbf5b48ff8d5e65bfeeeec34fc8c72a58de051aa36bbc039f6976d9b010e9a1cba11ffc089735686b791d4b91971cbaea446414475945fdb83a508ed55c63108bbb89fcce6fc50268fb8c2e787a3c6112bdb9448cbb7b7e1297a3c0f26d371e2b093e1fb130aef48d51ccc071a77e5b2a634c8adb1a60ad8e237a8ad9d9c3e258cb0c9f731e78f5334a5e7cf186f3a3addc7e818e08c747f0a7ba25f2f2e1e4e1133f105c377d0ceceebca8e0a40b7a83f156a343b1c8be6f25995fa57a68d53e767dfeecc7787a28d1beb77553832fb4eccbd9ab5da8e0124a8dc68b0740b9d6d8dadfafbb1ab1e2a9ef1127b41c3b037f12be9f40278fad551af7d46feeb9f0265d6f87d3dde89463d5f8b724e698a00628e4a93eae912052e630c6c827d03362ee490b0b9eae057d6ae697e37bb488a1aefc8ef4d1861f27f332a57f756d45d514951e1a5c9fb698fe9ff8797877f6951de64290666618b783995754faf46f5fcffcf548dffb97967974ac6abe443c12c8fa2b0"}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket(0x15, 0x80000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1070bd26, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x20048884) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@getchain={0x64, 0x66, 0x200, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0x0, 0x2}, {0xffff, 0x4}, {0xfff2, 0xa}}, [{0x8, 0xb, 0x1}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0xfffffff8}, {0x8, 0xb, 0x3}, {0x8, 0xb, 0x34000000}, {0x8, 0xb, 0x1}, {0x8, 0xb, 0x8}, {0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xc, 0x4}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r13) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r13, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) sendmmsg$inet(r3, &(0x7f0000004580)=[{{&(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r12, @empty, @dev={0xac, 0x14, 0x14, 0x35}}}}], 0x20}}], 0x1, 0x20000000) r14 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r14, 0x0, 0x0) syz_usb_control_io$hid(r14, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00222200000096231306e53f070c0000032a9000070800f3ff83", @ANYRES16=0x0, @ANYRESOCT], 0x0}, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e21, 0x1, @ipv4={'\x00', '\xff\xff', @empty=0xffffffff}, 0x8}, 0x1c) 9m14.464669349s ago: executing program 33 (id=5784): ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000000)=0xffffffffffffffff) ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000040)={0x566, 0x2, 0x4, 0x100, 0x7, {0x77359400}, {0x5, 0xc, 0x0, 0x0, 0x5, 0xfa, "692bfd4d"}, 0x8, 0x4, {}, 0x0, 0x0, r0}) r2 = accept4$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000100)=0x1c, 0x800) sendmsg$inet6(r2, &(0x7f0000000440)={&(0x7f0000000140)={0xa, 0x4e21, 0x2, @remote, 0x5}, 0x1c, &(0x7f0000000340)=[{&(0x7f0000000180)="2896076731ccd9f1a03dcdd5cfc8f83e24b63fcaf8af6abcd7ebefb9554c89c569eb596f24146e595f0c575f6dd15ba4ef06a4c948c484d232e0a977d83dd7f48ac0f2847ea93ecdfe9a47ea", 0x4c}, {&(0x7f0000000200)="c8b8b727288920c2132d1d2287c21c51727a8045309d91bd919c39bb25998d7f22198611ce351c34acd06af74ab080e620b28e86acb5e8aafed1a1f4c39279e4f4fc33e06b8841de9666a938601e760972100e172db745d14845dee2b33c05d6a1a2545606ef58b5a6ff88be22", 0x6d}, {&(0x7f0000000280)="d29e8c7603a17a68c17d7e45859f9b00246fe1ee7cdd28e2a4fb00ca7c362077bdbc1271d24be0b7a81577227ea654af40f120d26cd957809bda3ecfec0e52ac6b961d766ca765871db7d09e172c364c6e1be4ecc495563d389802715ff034c2883d8dc14bb9faf8ca7bbe64eeafb4d5bdfbb484801d23095976d33fb3372c06c6d1b768ffaf4272ea4415fe022bde08c074193ae535fc644d7b9622d9789c3f1e14d18835e01c19901dab221bdb4f11c740566e546907e03a0cef16582f", 0xbe}], 0x3, &(0x7f0000000380)=[@rthdr={{0x18, 0x29, 0x39, {0x33, 0x0, 0x2, 0x8}}}, @rthdr={{0x98, 0x29, 0x39, {0x4, 0x10, 0x1, 0x5, 0x0, [@local, @dev={0xfe, 0x80, '\x00', 0x24}, @empty, @private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @mcast1]}}}], 0xb0}, 0x40000c6) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000480)={0xb}, 0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000004c0)={0x1, [0x0]}, &(0x7f0000000500)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000540)={r3, @in6={{0xa, 0x4e20, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1}}, 0x4, 0x3}, 0x90) fstat(r1, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x3, r4, 0x6003) socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000680)=@int=0xffffffa7, 0x4) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000700)={&(0x7f00000006c0)='finish_task_reaping\x00', 0xffffffffffffffff, 0x0, 0x3be}, 0x18) accept4$inet6(r2, &(0x7f0000000740)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000780)=0x1c, 0x0) r6 = signalfd(r5, &(0x7f00000007c0)={[0x6]}, 0x8) r7 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000800)="a37a9e03f114e5a99d915b6f5b9c99e136f9fa88add14281ebbd65f03e23e54359ffa25f434d8223cde7b6b032ed309da3dfe4bc5abd43802826a2e1d272fbe50c7725b36b9bd4c824120f4c6bb0835a0198380a84f1c35e6f6bff96ca45f5a7d0fef86fb3b47843e610d473032d75a2fcba6c281cd2b610fa0e9bc842fdbcad9da29508590aa1dea1ea1cbc025e4a4b3e6ada5030c50b1507b6d373fbf4b8eafea05204228148cef25c7e9bc8444da6064126f2f076923c0bdd", 0xba) socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet6_buf(r2, 0x29, 0xcd, &(0x7f00000008c0)=""/176, &(0x7f0000000980)=0xb0) r8 = openat$nvram(0xffffffffffffff9c, &(0x7f00000009c0), 0x40000, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a40), r8) sendmsg$NL80211_CMD_NEW_KEY(r6, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x30, r9, 0x8, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x9, 0x79}}}}, [@NL80211_ATTR_KEY_SEQ={0xe, 0xa, "3b4768751f450342d55e"}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040004}, 0x20000080) write$yama_ptrace_scope(r6, &(0x7f0000000b40)='3\x00', 0x2) r10 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000b80), 0x2, 0x0) ioctl$BTRFS_IOC_DEV_REPLACE(r10, 0xca289435, &(0x7f0000000bc0)={0x1, 0xffffffffffffffff, @status={[0x0, 0x6, 0x6, 0x7fffffff, 0x5, 0x3]}, [0x1, 0xff, 0x81, 0x7, 0x2, 0x0, 0x5, 0x2c19, 0x3, 0xa532, 0xffffffffffffff89, 0x9, 0x9, 0x0, 0x1, 0x3, 0x10000, 0x9, 0x6, 0x7fffffffffffffff, 0x7f, 0xc, 0x80000001, 0x8, 0xe255, 0xfffffffffffffffa, 0x2, 0x9, 0xfffffffffffffffa, 0x6, 0x63059f95, 0x6, 0xac4, 0x2, 0x7fff, 0x382f, 0x200, 0xf14e, 0x8c0000000000, 0x7f, 0xa, 0xffffffffffffff9b, 0x2, 0x6, 0x3, 0x401, 0xffffffff7fffffff, 0x7, 0x6, 0x3, 0xfffffffffffffffd, 0x21836f7d, 0x10000, 0x3a6, 0x7, 0x5, 0x4c, 0xfffffffffffffc01, 0x2, 0x10000, 0x0, 0x8]}) r11 = syz_genetlink_get_family_id$gtp(&(0x7f0000001640), r8) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000001680)={0x9b, r0, 0x2}) sendmsg$GTP_CMD_DELPDP(r8, &(0x7f0000001780)={&(0x7f0000001600)={0x10, 0x0, 0x0, 0x20002}, 0xc, &(0x7f0000001740)={&(0x7f00000016c0)={0x64, r11, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_VERSION={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_FAMILY={0x5, 0xd, 0x28}, @GTPA_NET_NS_FD={0x8, 0x7, r12}, @GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_MS_ADDRESS={0x8, 0x5, @remote}]}, 0x64}, 0x1, 0x0, 0x0, 0xdaea6a1f22661278}, 0x8000) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001800), r8) sendmsg$IPVS_CMD_SET_CONFIG(r12, &(0x7f0000001900)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000018c0)={&(0x7f0000001840)={0x78, r13, 0x0, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2d}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfffa}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1000000}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5b}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x3a, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x32}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}]}]}, 0x78}}, 0x20000000) 5m48.722702208s ago: executing program 0 (id=7047): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2e0, 0x0, 0x111, 0x4b4, 0x148, 0xd4feffff, 0x210, 0x20a, 0x278, 0x210, 0x278, 0x3, 0x0, {[{{@ipv6={@private1, @empty, [], [0x0, 0x0, 0x8000000], 'batadv_slave_0\x00', 'wg2\x00'}, 0x0, 0x108, 0x148, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x700}}, @inet=@rpfilter={{0x28}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "d84876682c92a4d47629fcd3ef7b37abac55cee6d46a27676749efe14680"}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x340) 5m48.30144825s ago: executing program 0 (id=7050): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000080)=0x1d0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000001800090000000000000000001c140000fe00000100000000fcffffff1a00cfeacfbd6c9555bb04b2f81c4d070109ce8707cb3a6b9c347a8351869eb7428fced20f700036300f91f6b7824f80637ecf6b2cf3b9ed50f612d7ad79f6bab4a149bbfc98838cb0267d5cd591357311860c73d0e326be602f3393865f7f413e938418fc42ba5625d37794e39e172b4325189522bf57696e4d26f0d8391b0fdcbb43626c2ad6e7a3bd9eaad910e1f207"], 0x30}}, 0x4) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$bt_hci(r2, 0x6, 0x17, 0x0, &(0x7f0000000180)) lseek(r1, 0xf, 0x3) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000340)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xff}}, './file0\x00'}) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000005e0001002abd7000fedbdb2500000000", @ANYRESDEC=r3], 0x1c}, 0x1, 0x0, 0x0, 0x2005001}, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) socket(0x1000000010, 0x80002, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r7, 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 5m47.927551998s ago: executing program 0 (id=7055): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x20, 0x2e, 0x9, 0x70bd27, 0x0, {0x4, 0x0, 0x600}, [@typed={0x8, 0x18, 0x0, 0x0, @binary="0aac0f00"}, @typed={0x4, 0x1e}]}, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 5m47.113740353s ago: executing program 0 (id=7058): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000018010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480f0000005e140602000000000e000a001000000002800000121f", 0x2e}], 0x1}, 0x0) 5m46.821112792s ago: executing program 0 (id=7061): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x635c, 0x1f480, 0x0, 0x399}) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x4a4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f00001c4000/0x3000)=nil, &(0x7f0000000000/0xc00000)=nil, 0x3000, 0x0, 0x2}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_usb_connect(0x0, 0x6e, &(0x7f0000000140)={{0x12, 0x1, 0x201, 0x83, 0xb0, 0x70, 0x40, 0x40b, 0x6521, 0x9e71, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x1, 0x1a, 0x2, 0x0, 0x1, [{{0x9, 0x4, 0x50, 0x2, 0x8, 0x3, 0x96, 0x8f, 0xff, [@generic={0x2, 0x1c}], [{{0x9, 0x5, 0xa, 0x0, 0x10, 0x7, 0x4, 0x2}}, {{0x9, 0x5, 0x5, 0x0, 0x200, 0x1, 0xff, 0x2}}, {{0x9, 0x5, 0x4, 0xc, 0x200, 0xed, 0x2, 0xd}}, {{0x9, 0x5, 0x2, 0x4, 0x8, 0x4, 0x0, 0x4}}, {{0x9, 0x5, 0xc, 0xc, 0x20, 0x0, 0x9, 0xd0}}, {{0x9, 0x5, 0x9, 0x0, 0x200, 0x3, 0x82, 0x50}}, {{0x9, 0x5, 0xd, 0x10, 0x400, 0xff, 0x0, 0x1}}, {{0x9, 0x5, 0x1, 0x13, 0x400, 0x4, 0x4, 0x6}}]}}]}}]}}, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0}) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x3f3e, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYRESDEC=r1], 0x7c}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x74}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, &(0x7f0000000100)={0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="2005cd0000cd0029f95741d1bd1771086075a8b91b4efa4c1482190b27fbf78124ec47676e98fc682395c2ac3f1f2a718cf750d3409950ec7af9c18f5b9f0b1688d23cf22d339467df4e7ef5002285177a1c2a912c06b34c0430bb195693e35eb6762b43dc3e5e4ef3af7ce969324915bc1c7f66b93f06189aed5cd603723b938c5e6df65f6baa52fb2d5fe3bb4238ca02b4fa96acf27364aadb1c4eda1ab9397bf9971a9cc0ef8b7091fb4e09427f048bdb4fbef9be853c95cb0ddec9419495ea1e780e2a2208a53cb574a6be7161fd889bf2358c6f0630f191f102970c313963c900"], &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3009}}}, &(0x7f0000000540)={0x34, &(0x7f00000001c0)={0x20, 0x17, 0x1a, "89a0a956355ee4b2bcc1d5f1a8f479f2257fbc5fb4fb534a8ed1"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000400)={0xc0, 0xa1, 0x4, 0x5}, &(0x7f00000004c0)={0x40, 0xa0, 0x4, 0x3}, &(0x7f0000000500)={0xc0, 0xa2, 0x2f, "ec97b2be1cd75d803f2f08a5be89c6250b045655d21d8a0b5ee008e362e1e4dc0db5309603a3720082d77f133f3dd2"}}) 5m42.552346194s ago: executing program 0 (id=7072): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="440000001000050400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000500240012800b00010065727370616e000014000280050016000000000006000e000395"], 0x44}}, 0x0) 5m27.264883028s ago: executing program 34 (id=7070): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109"], 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0002, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x101001a, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmod\a=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',allow_other,\x00'], 0xfb, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r4, &(0x7f0000004100)={0x2020}, 0x2020) write$vga_arbiter(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="746172676574205043493a5b89d9f46ac070df4e31642e3100"], 0x14) syz_usb_disconnect(0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000300)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r5, 0x29, 0xb, &(0x7f0000000140)=0x7fc, 0x4) setsockopt$inet6_tcp_int(r5, 0x6, 0x22, &(0x7f0000000080)=0x1, 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000030101010000000000000000020000000c00198031ee9f5757dc3a465b2da4c54f08000200050000001800028014"], 0x38}, 0x1, 0x0, 0x0, 0x4000004}, 0x44080) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r7, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r7, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r8, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, &(0x7f00000007c0)={0x28, 0x2, r8, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xfffffffffffffff8}) ioctl$IOMMU_OPTION$IOMMU_OPTION_HUGE_PAGES(r7, 0x3b87, &(0x7f0000000180)={0x18, 0x1, 0x0, 0x0, r8}) bind$inet6(r5, &(0x7f0000000240)={0xa, 0x4e20, 0xf, @empty, 0x5}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000000ac0)=[{{&(0x7f0000000440)={0xa, 0x4e20, 0x2, @empty, 0x6}, 0x1c, &(0x7f0000000c40)=[{&(0x7f0000000300)="d5", 0x1}], 0x1}}], 0x1, 0x20080058) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r9, 0xffffffffffffffff, 0x0) 5m27.159791834s ago: executing program 35 (id=7071): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000002cc0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/212, 0xd4}, {&(0x7f0000003cc0)=""/4096, 0x1000}, {&(0x7f0000000300)=""/236, 0xec}, {&(0x7f0000000640)=""/246, 0xf6}, {&(0x7f0000000000)=""/37, 0x25}, {0x0}], 0x7) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) creat(0x0, 0x122) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x7) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001000030425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r7], 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r8 = socket(0x1, 0x803, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r10, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r11], 0x5c}}, 0x40) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r12}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x4c}}, 0x884) 5m27.103087239s ago: executing program 36 (id=7072): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="440000001000050400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000500240012800b00010065727370616e000014000280050016000000000006000e000395"], 0x44}}, 0x0) 4m39.273306584s ago: executing program 4 (id=7138): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010029bd7000fddbdf2505000000080002"], 0x1c}, 0x1, 0x0, 0x0, 0x20004804}, 0x800) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x220, 0x220, 0x110, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0xffffff00, 0x1, 0x0, {@empty, {[0x0, 0x0, 0xff]}}, {@mac=@local}, 0x2002, 0x7, 0x2, 0x0, 0x800, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00', {}, {}, 0x0, 0x180}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @loopback, @broadcast, 0x6, 0xfffffffe}}}, {{@arp={@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, 0x0, 0x0, 0x0, 0xfd, {}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00', {}, {}, 0x0, 0xc}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}, @broadcast, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x9}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x138, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x108, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "52087def75c736f85cc7d27338300e8cb966059166908611a2da3e15d07ea4bbea3d646bddcbf88d74a8f9b16f89ac1296a3ebe1eb696bc28149a6f97bca767dd5a2e4a0ce4e1f337f52af8d065ab3903bf929f30662e91d6466b050411964902e6bfd3d89271fd28b48677d5cf2caefd8a40abbe659aabf39f028156294855a66954d2349461e5b3fdf380433db7182203d89bd1637c99109d611ac6ddd1f8bd70df15be1196d73cf93360c81be9c56781a57bf6ac5bd26db48b73bd89d4e22511b72fa9373f5ff75156b83de4ba43f4325cb81ad4e1ebabd12279a1c2cb16d9b64ac46472168b729780d5697663cde109a2ea16079fdfb016066bd7f663500"}]}}]}, 0x138}}, 0x0) 4m38.982168328s ago: executing program 4 (id=7139): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x100, @dev={0xac, 0x14, 0x14, 0x41}}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2=0xe000002d}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) 4m38.658641709s ago: executing program 4 (id=7140): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x35}}, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0xd}, 0x1c) fcntl$dupfd(r1, 0x0, r1) (async) r2 = fcntl$dupfd(r1, 0x0, r1) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e40)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x20004880}, 0x1) setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f0000000040)=0x7, 0x4) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000008340)=ANY=[@ANYBLOB="df200000007800010700de980000000000002554692cdb"], 0x20}], 0x1}, 0x0) (async) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000008340)=ANY=[@ANYBLOB="df200000007800010700de980000000000002554692cdb"], 0x20}], 0x1}, 0x0) socket(0x10, 0x803, 0x0) (async) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000001000370429bd7000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8b0e0200000000003c0012800b00010069703667726500002c00028014000700ff020000000000000000000000000001147e7847347b91000600fe80000000000000000000004d00d400"], 0x5c}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) socket$nl_generic(0x10, 0x3, 0x10) 4m38.170493952s ago: executing program 4 (id=7141): madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) r1 = io_uring_setup(0x7a5c, &(0x7f0000000080)={0x0, 0xc95e, 0x0, 0x3}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x1ef6e3}], 0x100000000000011a) 4m37.763558112s ago: executing program 4 (id=7142): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000200)=0x5d4d, 0x4) bind$inet(r2, &(0x7f0000000240)={0x2, 0x0, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x800, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x300) 4m34.170265591s ago: executing program 4 (id=7145): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000ffff16bf3900000008000300", @ANYRES32=0x0, @ANYBLOB="04000d80"], 0x20}, 0x1, 0x0, 0x0, 0x4000065}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48884) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f00000000c0)=0x9, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x1000000010, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r5, 0x2) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x8}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xa7}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xfffffffffffffff8}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_MRU={0x6}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0xc051) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='team_slave_1\x00', 0x10) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x338, 0x1a0, 0x2b8, 0x25c, 0x1a0, 0x7, 0x268, 0x3a8, 0x3a8, 0x268, 0x3a8, 0x7fffffe, 0x0, {[{{@uncond, 0x16c, 0x138, 0x1a0, 0xa010000, {}, [@common=@unspec=@physdev={{0x68}, {'vxcan1\x00', {0xff}, 'bridge_slave_1\x00', {0xff}, 0x13, 0x2}}, @common=@inet=@socket3={{0x28, 'socket\x00', 0x2}, 0xe}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x9, 0x0, 0x0, 0x14, 'syz1\x00', 'syz0\x00'}}}, {{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [], [], 'sit0\x00', 'ipvlan0\x00'}, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x398) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x42000000) 4m18.737728058s ago: executing program 37 (id=7145): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000ffff16bf3900000008000300", @ANYRES32=0x0, @ANYBLOB="04000d80"], 0x20}, 0x1, 0x0, 0x0, 0x4000065}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48884) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f00000000c0)=0x9, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x1000000010, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r5, 0x2) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x70, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x8}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xa7}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xfffffffffffffff8}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_MRU={0x6}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0xc051) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='team_slave_1\x00', 0x10) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x338, 0x1a0, 0x2b8, 0x25c, 0x1a0, 0x7, 0x268, 0x3a8, 0x3a8, 0x268, 0x3a8, 0x7fffffe, 0x0, {[{{@uncond, 0x16c, 0x138, 0x1a0, 0xa010000, {}, [@common=@unspec=@physdev={{0x68}, {'vxcan1\x00', {0xff}, 'bridge_slave_1\x00', {0xff}, 0x13, 0x2}}, @common=@inet=@socket3={{0x28, 'socket\x00', 0x2}, 0xe}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x9, 0x0, 0x0, 0x14, 'syz1\x00', 'syz0\x00'}}}, {{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [], [], 'sit0\x00', 'ipvlan0\x00'}, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x398) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x42000000) 4m16.60459723s ago: executing program 5 (id=7152): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {}, {0xe, 0xc}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_IP_TTL={0x5, 0x4b, 0x4}, @TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "e42400d0bb7d47acb2a2357bfbfc016f"}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x800) 4m13.422040652s ago: executing program 5 (id=7153): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'hsr0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x2000000, 0x2004d808}, 0x0) 4m13.377928007s ago: executing program 5 (id=7154): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f00000001c0)='.\n#)|.\x02\xd8\b\xb2f\xcd\x04\xb9\xc7\x9d\xb2a\r\xd7\xef\xc5\x112s\x88\x06\x13o\xd6w\xbf\xfa\xd5?\xa3\'\xca%\xd0\x8fKAq\x89f\xbb\x9dC\xd6\xea\xa8\xc2z\xbfe\xadSb3L)Hy\xfao\b\xa4\xb6\xff\xff\xff\xff\xff\xff\xff\xf7\xc7\xa4\xdcY\x9aM\x90\xa4\x05\xa8\xec\xf3\xa4h\x11\x19\x87E$\n://\xf3\x96\xaf\x1c8\b\x84x\'+\xd5\xd4?[e\x19\xa3\\J\xe9\x8a\xb9\xe495/\x00d\xd2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xb7\x1e\xf7Ys#m\xd40\xceP\xdc\x15FI>\x01\xfa\x15\x93\x9a&\xb4):\xc7?\x8d\x8e\x02\xc6\xf61\xbd\xbcBq\xba\xc6\x8e\x89\x15UTaf\xfc\x89\xab\x19\xd7\x82\x16\x94m\x0e\xb7$\x8c\xd76K\xdc\xd1;\\QPh@$\x06F\x81\xc9\xf8\xf8H\xb2\x85\xa8Cl\xa6\xcd\xb5\xf0\xd0\x1f\'\xc30]\xad7\x1eZA7\x89\xf5\x81b\r\xc1\x7f[\x84y\xac\x12\xaa\xa2-t\x16>V\xfc\xbf\xdb\xe4\x9a\x9eE^\x90oe\xc0\xd9\xc68\x0f\xd4\xcdKC\xadp\xba\xaa\xab\'\x1cRO\x89\x17i\x88\"\x8dQI\xed\x1d\xe1v\xe6&\xd3\x14\xe92\xca\x9dBe\\\x8f\xff\x9b\xc7Sd!\xf8(Z\xd42\xa2\xcdjjBP\xae3\xbd\xec\x8a\x8f:\xeb1\x1cK\xf2\x04s\b\xcb\xa9\x17\x8529\xd7`\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf1\xa4C\x81\xc8iy\xc4\xf7\x7f\x90\xf80\x18jT\xd45\xde\b\x88\xc9Xw\xe9\xf4\xa4\x94Q\x03s/\xac\xd4\xb7o\x99\xf5\xdb\xf9\x99,+\b\x17\xe4\xf4r}\xda\xf5\x12\x16\xb6g\x00\'(\x02[\xef\x03\x90W% \xe6b\xa2\\\x86\xac\xdax\x997AOJ=\x1f\x00\xe1/\n\xael\x15\xcfR\v\x0e\xbc!\xe8\x1cV-`\xf0$\xa6a \x93PV\x8dm@\x9c', 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x800101fe, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900000000000000000000000000001800", [0x0, 0x2000000000001]}}) 4m13.271392171s ago: executing program 5 (id=7155): r0 = syz_open_dev$sndpcmp(&(0x7f0000000300), 0x1, 0x203) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r0, 0xc1004110, &(0x7f0000000000)={0x0, [0x2, 0xffff133a, 0x7], [{0x0, 0xffffffff}, {0x2, 0xffffffff}, {0xf, 0xffff}, {}, {0x4}, {}, {}, {0x2}, {0x0, 0x4}, {0x0, 0x1}, {0x8, 0xffffffff}], 0x12, 0x0, 0x0, 0x8000000}) (async) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0) (async) r2 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000240)={0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000002c0)={0x14, &(0x7f0000000640)={0x0, 0x7, 0x5d, {0x5d, 0x2, "74319e70efac52b0837891a0c27917ac68a112e4dd8103be7cdaf230e73b00f54e4032afa3b1789a25518f75ff128f752f5b93a57a25f0c9687ff74468b82abfef86470cdf076988fb831a0b2ae4fa4984e076387eba3cfcc565bd"}}, &(0x7f0000000140)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000800)={0x1c, &(0x7f00000006c0)={0x0, 0xad16d40cceedd226, 0xff, "456ab31936d31fedbf771a0bbdfa94c25197e9f3d9e423e25eb24e9cab1e3b05d53a1ab009616638fc57f9f2e5690f49e3e699dc9f68ee90e8df12330f81ecb7caf183db92c753189e1f682b791d80ad34c32611b56425e661534c8e98fd85683b2d0253137adfa53e45c29c797e32a7d8e9b0777704586d48d8f4401e463ad7eba3169c293672ed9829c00b9e5527956777a3826a757ae25d7b5dfb3fb88633d9087b8a231edbdceec81d8f995df849f22a61ba7050ccd86f8ac7a868b8ad09d69b9d163fb36c8ce35bb86dfc519dfa94ef9fc7f124e4ee68f3a76e3a93a5c9beebc47be40bbaf3ee59f469bc07093d7b6511502116c1c53cd8502b9b716e"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000540)={0x0, 0x8, 0x1}}) (async) r3 = open(&(0x7f0000000300)='.\x00', 0x0, 0x2) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) (async) sendmsg$tipc(r4, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x80000009}}}, 0x10, 0x0}, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000940)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r2, &(0x7f00000004c0)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x21, 0x9, {0x9, 0x21, 0x8, 0xda, 0x1, {0x22, 0xac2}}}}, &(0x7f00000003c0)={0xffffffbc, &(0x7f00000000c0)=ANY=[@ANYBLOB="200e1100b3c80000000000003d6a944aa7928531e98383cda212c39900000000ec35e38aed207cd9663ce2c1e7dcc337d55626"], &(0x7f0000000580)={0x0, 0xa, 0x1, 0x3}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0xf}, 0x0, &(0x7f0000000380)={0x20, 0x3, 0x1, 0x3}}) syz_usb_control_io(r2, 0x0, 0x0) (async) syz_usb_control_io$hid(r2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x48) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x60000000000000, 0x28011, r6, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000001c0)={0x84, &(0x7f0000000a00)=ANY=[@ANYBLOB="0000d500000012571c60221acf4dae9d587e0d9613f07015ecebc5c53815d50741b7ef3352ba18c09c2bca8f867b35d397d29b4e95f5f6b76947832711ebf31e37a89c8a91b9240eece2f9af900000000025b82be9975633f2d805c2418756840df7c0d8751b1a1288c73dc0838017a476b842a345f88e27b3ba55c0d000000000000000004769acc750eed8cf2c590b34d76b1696c7a8e28e9065ed033e667c0f80dc2d76f6b1a435d88b95350a3630b7ed28bf1a90d2b0568ab846aafccb25510502e461695356770ac6f5f51edb7f37264841cbc42464455c7c932572566a6fce5c5c69ecec18a7fed30c615971ed9c6035fa9a1127e039f1deb3caddccb9e2393fa0d57e9ae851ed927ba2ba9ef2a684fe44b92f77123fadbbd5c51293149ad6f79a360b0dbdd6b5c6669970b3a63831634b1891495b3332cc8becb37313f3115cfff6deefef95a4e8123322287d4174fe03fc8c3e2d0e86c4c78b7b24ff4db3efd4b88050140137767f350523dcbb7a3316"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) 4m12.787610378s ago: executing program 5 (id=7156): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x4001, 0x3, 0x2b0, 0x138, 0x0, 0x148, 0x0, 0x148, 0x218, 0x240, 0x240, 0x218, 0x240, 0x7fffffe, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'ip6gretap0\x00', 'netdevsim0\x00'}, 0x0, 0xf0, 0x138, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x0, 0x0, 0x1ff, 0x0, 0x0, 0xed, 0x7}}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private1, 'ip6erspan0\x00'}}}, {{@ip={@local, @loopback, 0x0, 0x0, 'veth0_vlan\x00', 'macvtap0\x00'}, 0x0, 0xc0, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28, 'rpfilter\x00', 0x2}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x310) listen(r0, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x4004840}, 0x48080) r2 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) write$binfmt_script(r2, &(0x7f00000003c0)={'#! ', './file0', [{0x20, '[\v\xdb\x06\x00\x00\x00\x00\x00\x00\x00\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x00\x00\x80\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xcc\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8cI\xdcn\x9b\xa5\xd4\x13\xc0\x82^\x10,\xfa\x88\x93\xc6K2\xf2\xce\x95\x1bG\xb2m\xad\xe7\xd1P.XT\xc1\xc5\xd9\xaf\v\x8d\xcf\x8f`{F\xc7\x95!\xcc\vq0\xd0\x80\x06{\x97\xb0\xdb+Z\xc5\x9d\xf4\x0eS\xd2\xd4\xb5\\\x96\x1dN\xe6\xfd\\\xe32_p\xee\x15JU\x11\x1f\xc6\xeb\xafm\x1e\xb3\xb5\xfe\x02\xe24\x90Uo\xaf\xce/\x9c\xd4\vE \x81\x14\xdf\x9b\x12b\x1a\x173\x8d\t\xab\xec\xf0n\xa5\x95\x9c\xc3\xf2\xb6CS\xf3\xa8p\t!\xb3\x912`\n\xd2\xe2S\x9cU\xcc\"\xf2d(Ec\xb2\x7f\x02'}]}, 0x130) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) unshare(0x20000400) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x1, 0x4, &(0x7f00000010c0)=ANY=[@ANYBLOB="8500000008000000350000008400000085000000070000009500000000000000fed023d1d405000000c7d4012507000000c71adb05d72768b8242dd90d17e4c52505750482b009546a5f3f00573f31b53fd3e52bd87184446d165ae2939bbca322a415a98c885faad395f3e4e0635559362ed862ce7c69ad133037af3a000000000000000000000058c122dff93c54caec3751652d11fd4f66711918d3604b92666d60c88b658fe57bb5d365c5b89625385f230ba21f570635837c7bc74be573bfd68aaaf06d842085f84b96c4709e2c9449f0818f6fc5657572fb3e5bb8ff6f643e52f4964c62a70a011ede8b504c8a30381b8eff01d7615e1789bb4b3b7ef3668a98a785a80aa2d1ab149b9316091fb3025f0716799d8280acb3880a882f28dd3111e02c3b0b2818bf5bb902cc9c1666f5fdd2e43901ca4796f04db25c3df35cdfc17c54936202b45b7a09816aa76e8b9bbe24022007aae367025040e8b2255ced48a4b2db3f280dc6fd2f5374548c499ae74631f3be04e28d601369f9488fb074eb35540df5e053376ea29125d6bb916496b04b8e359c1edef91677414729967cffa736d7789c14e918b77518ee8e5d5aff9148be69267fff35"], &(0x7f0000000140)='GPL\x00', 0x0, 0x99, &(0x7f0000000180)=""/148, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x8b63bfea1a14a3c7}, 0x16) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000280)=@raw={'raw\x00', 0x3c1, 0x3, 0x570, 0x0, 0x8, 0x7f02ae, 0x0, 0x200, 0x4a0, 0x2e8, 0x2e8, 0x4a0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x340, 0x368, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r5}}, @common=@inet=@iprange={{0x68}, {@ipv4, @ipv4=@remote, @ipv6=@mcast2, @ipv4=@remote}}]}, @common=@unspec=@CLASSIFY={0x28}}, {{@ipv6={@private2, @private2, [], [], 'veth0_to_team\x00', 'netdevsim0\x00', {}, {0xff}, 0x0, 0x0, 0x1}, 0x0, 0xd0, 0x138, 0x0, {}, [@common=@mh={{0x28}, {"a27d"}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x13, 0xec, 0x5, 0x400, 'snmp\x00', 'syz0\x00', {0xffffffff8cdbbefd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0xe, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r8, &(0x7f00000009c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="2400000007060500000000000000008000006c33050001000700000008000640000000052fc0bf935e7638cc0947e35eaf750da6d615b3db40de15f94214ec3268385d5aa15b129c889b9d3dc45e74057f599d325a608ce90fbba8f13a891aa2620a4557f5441fae240faab49539528eddb6ad28537e59aabc9ed485e341d09c278575a41025062af814e2d10ccaac5a2b493976ec165464e683aa1d8c19cf40392699477fa8729cc840723e0692dceba3be9a6a000fd166858121612b13e1a1b0fc583c2ecc5534736cb876530e9841df043f65dddf7812595519e0e96f422a0ba72b58ae2face63a1ca80947f00dae7f089ca3ba3c330a550d60f5bc69737b0000000000", @ANYRES16=r8, @ANYRES8=r4, @ANYRES8=r7, @ANYRES64], 0x24}, 0x1, 0x0, 0x0, 0x20008850}, 0x20000000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) r9 = memfd_create(&(0x7f0000000000)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x06\x00\x00\x00\x97A\xc2\xd8\xf0Uq!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xeb\xe4\x9aR\xe5,\x82\x03\x00\x19\x8d\xe8\xc6\xb9\xe4\xb4\x99\x8a\x19\xe5\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\x16\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xef!\x8f\xf6]-\xf1k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7cdv[\t\x00\x8d\xf3\xcc1\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9k\x83\xfc\xa4\xad4\x03\xa2X\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfcN\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11Z\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xdfY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0\xe1\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xad\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96?\x00\x00\x00\x00\x00\x00\x00\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKl\xcc\xa4:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcb\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\xa2\xa9u\x93>m\xd7q\'\xdf\xfajo\xd8n\xa7\xecJi\xde\xdf\x7f\xe3\xc4*Z 4\xe8S$\xa1H=\xdf\x05\xf3\xc3T\xd1\xdd\xc6f\xa4\xb4\x96\\\xa0\xf9\x0f\x17\x11{\xb6\x9d\xd21\xc1\x90Vj\x13r\x00\x00\xde\x03\xab\xff\x8as0\xc6E\xca\"\xd9*\x9a\x15\xb95r\x8f\xaaj\x82\xd6\xd2%\xed\xa2WQ\xec2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xccX\xfdRB\xffU\xe9\xfa\x1f\xf6\xce\b\xde@\x061\xc6z\xe4\xe0\xc9?\xa7\x94>\x9c\xd1\xa5o\x04\xaaim\xae\xfe\xc7f\xa3\x96\xd7\xb4c)r{\r#\xddI&\n\xf2\xec\xd4\xff\x9f\x136zZ-2\x80\xfbH+\x9b8\xf3\xed\xdf\xa2my\xb28c[\xc3\xfe\xb5M\x84\x97\xa5\'s\xe9\xdc=)I\xabLt2\x9c\v\xd9S', 0x6) fallocate(r9, 0x0, 0x9, 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r9, 0x0) mbind(&(0x7f0000195000/0x2000)=nil, 0x2000, 0x4000, &(0x7f0000000400)=0xfb, 0x8, 0x3) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x11, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x41, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 4m11.894187124s ago: executing program 5 (id=7157): socket$kcm(0xa, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0xfffe, 0x4, @mcast2={0xff, 0x3}}, 0x1c) openat$rtc(0xffffffffffffff9c, &(0x7f0000000280), 0x40000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = socket$inet6(0xa, 0x3, 0x3c) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000010000197ffffff00000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000854}, 0x40) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) 3m56.159587264s ago: executing program 38 (id=7157): socket$kcm(0xa, 0x5, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0xfffe, 0x4, @mcast2={0xff, 0x3}}, 0x1c) openat$rtc(0xffffffffffffff9c, &(0x7f0000000280), 0x40000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0xa, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = socket$inet6(0xa, 0x3, 0x3c) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="1400000010000197ffffff00000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000854}, 0x40) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) 3m16.173721799s ago: executing program 1 (id=7181): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)="d800000019007b29e00212ba0d8105040a601100fe02040b067c55a1bc001400090006990600000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4093f00001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5000000000000", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x0) socket(0x10, 0x803, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400"], 0x48) bind$tipc(0xffffffffffffffff, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x200, 0xfffffffd}}, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0x0) 3m15.937097754s ago: executing program 1 (id=7184): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x20, 0x2e, 0x9, 0x70bd27, 0x0, {0x4, 0x0, 0x4100}, [@typed={0x8, 0x18, 0x0, 0x0, @binary="0aac0f00"}, @typed={0x4, 0x1e}]}, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 3m13.728513556s ago: executing program 1 (id=7189): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r2, @ANYBLOB="08002600940900000800b700"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 3m13.61241111s ago: executing program 1 (id=7191): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="05000000040000000900000008"], 0x50) bpf$PROG_LOAD(0x2, &(0x7f00000004c0)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='\x00', 0x89901) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001e008d2a28bd7000ffdbdf250a000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b'], 0x24}, 0x1, 0x0, 0x0, 0x4001}, 0x40000c0) 3m13.545794119s ago: executing program 1 (id=7192): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_MSRS_sys(r1, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x48c, 0x0, 0x7fffffffffffffff}]}) (async) syz_usb_control_io(r0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (rerun: 64) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$printer(r0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x40, 0x12}, 0x0, 0x0, 0x0, 0x0}) 3m13.227485393s ago: executing program 1 (id=7193): r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000413f5f201d0670c16fce0102030109021b0001000018000904"], 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0d000000000002fdbf43eb00"], 0x50) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = openat$cgroup_ro(r1, &(0x7f0000000180)='memory.swap.events\x00', 0x275a, 0x0) fchown(r4, 0x0, 0x0) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), r1) sendmsg$SEG6_CMD_SET_TUNSRC(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f0000000900)=ANY=[@ANYBLOB="28d03b93", @ANYRES16=r5, @ANYBLOB="000028bd7000fbdbdf25030000000500860020000000050006000300000004000400"], 0x28}, 0x1, 0x0, 0x0, 0x20008000}, 0x24065044) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f00000008c0)={0x1, r1}) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, @in={0x2, 0x4e21, @local}], 0x20) listen(r7, 0x7) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000880)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, @in={0x2, 0x8, @multicast1}], 0x20) listen(r3, 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x8000000000000000]}}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) setreuid(0xee00, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r2, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000400)=r1}, 0x20) getsockname$packet(r4, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000005c0)=0x14) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r1, @ANYBLOB="0200d753b357fa650a00"/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="05000000020000000500"/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x0, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="850000680000e6220000", @ANYRES32=r8, @ANYBLOB="b05a7ab9b57355459f3b7d85cce7d4f7a881c1c0e3a73c08"], &(0x7f00000004c0)='GPL\x00', 0x1, 0x54, &(0x7f0000000500)=""/84, 0x41100, 0x42, '\x00', r9, 0x0, r4, 0x8, &(0x7f0000000640)={0x3, 0x2005}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000700)=[r1, r2, r1, r8, r1, r10, r1, r2], &(0x7f0000000740)=[{0x2, 0x5, 0x7, 0xa}, {0x2, 0x2, 0x8, 0xa}, {0x4, 0x2, 0xf, 0xb}, {0x2, 0x2, 0xc, 0xa}, {0x2, 0x2, 0xb, 0x2}, {0x4, 0x3, 0xf, 0x2}, {0xfffffffe, 0x3, 0xe, 0xa}, {0x1, 0x2, 0x8, 0xb}], 0x10, 0x3}, 0x94) 3m12.794985483s ago: executing program 39 (id=7193): r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000413f5f201d0670c16fce0102030109021b0001000018000904"], 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0d000000000002fdbf43eb00"], 0x50) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = openat$cgroup_ro(r1, &(0x7f0000000180)='memory.swap.events\x00', 0x275a, 0x0) fchown(r4, 0x0, 0x0) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0), r1) sendmsg$SEG6_CMD_SET_TUNSRC(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f0000000900)=ANY=[@ANYBLOB="28d03b93", @ANYRES16=r5, @ANYBLOB="000028bd7000fbdbdf25030000000500860020000000050006000300000004000400"], 0x28}, 0x1, 0x0, 0x0, 0x20008000}, 0x24065044) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f00000008c0)={0x1, r1}) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, @in={0x2, 0x4e21, @local}], 0x20) listen(r7, 0x7) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000880)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, @in={0x2, 0x8, @multicast1}], 0x20) listen(r3, 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x8000000000000000]}}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) setreuid(0xee00, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r2, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000400)=r1}, 0x20) getsockname$packet(r4, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000005c0)=0x14) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r1, @ANYBLOB="0200d753b357fa650a00"/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="05000000020000000500"/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x0, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="850000680000e6220000", @ANYRES32=r8, @ANYBLOB="b05a7ab9b57355459f3b7d85cce7d4f7a881c1c0e3a73c08"], &(0x7f00000004c0)='GPL\x00', 0x1, 0x54, &(0x7f0000000500)=""/84, 0x41100, 0x42, '\x00', r9, 0x0, r4, 0x8, &(0x7f0000000640)={0x3, 0x2005}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000700)=[r1, r2, r1, r8, r1, r10, r1, r2], &(0x7f0000000740)=[{0x2, 0x5, 0x7, 0xa}, {0x2, 0x2, 0x8, 0xa}, {0x4, 0x2, 0xf, 0xb}, {0x2, 0x2, 0xc, 0xa}, {0x2, 0x2, 0xb, 0x2}, {0x4, 0x3, 0xf, 0x2}, {0xfffffffe, 0x3, 0xe, 0xa}, {0x1, 0x2, 0x8, 0xb}], 0x10, 0x3}, 0x94) 2m14.697011418s ago: executing program 2 (id=7520): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRESDEC], 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) recvmmsg$unix(r1, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000003c0)=""/207, 0xcf}, {&(0x7f0000004840)=""/215, 0xd7}, {&(0x7f0000004940)=""/255, 0xff}, {&(0x7f00000008c0)=""/161, 0xa1}, {&(0x7f00000005c0)=""/194, 0xc2}, {&(0x7f0000004c00)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/241, 0xf1}], 0x7}}], 0x1, 0x0, 0x0) (async, rerun: 64) write(r1, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, 0xffffffffffffffff, &(0x7f0000000500)) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl0\x00', &(0x7f00000000c0)={'erspan0\x00', 0x0, 0x80, 0x7, 0x9, 0x5, {{0x1f, 0x4, 0x0, 0xb, 0x7c, 0x64, 0x0, 0xb, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp_prespec={0x44, 0xc, 0x7d, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0x34}, 0x10000}]}, @timestamp={0x44, 0x18, 0x77, 0x0, 0xd, [0x7, 0x5, 0xfe3, 0x8, 0xfffffffb]}, @end, @rr={0x7, 0x2b, 0x97, [@private=0xa010101, @loopback, @local, @rand_addr=0x64010101, @remote, @private=0xa010100, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x24}, @dev={0xac, 0x14, 0x14, 0x2e}, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp_prespec={0x44, 0xc, 0x9, 0x3, 0x3, [{@multicast2}]}, @timestamp={0x44, 0x8, 0xa9, 0x0, 0x5, [0xffffffff]}, @noop]}}}}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=@gettfilter={0x54, 0x2e, 0x300, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0xfff3, 0x3}, {0xffff, 0xf}, {0x0, 0xffe5}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x1}, {0x8, 0xb, 0x3a}, {0x8, 0xb, 0x6}, {0x8, 0xb, 0x4}, {0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) syz_usb_connect(0x3, 0x2f, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x69, 0x9a, 0x41, 0x40, 0x421, 0x48e, 0xd48c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1d, 0x1, 0xff, 0xff, 0x40, 0xd4, [{{0x9, 0x4, 0x77, 0x9, 0x1, 0x2, 0x2, 0xff, 0x7, [], [{{0x9, 0x5, 0xc, 0x0, 0x20, 0x9, 0x3, 0x2, [@generic={0x2, 0xf}]}}]}}]}}]}}, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0}) 2m10.477640458s ago: executing program 2 (id=7543): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) socket$inet_udplite(0x2, 0x2, 0x88) sendmmsg$inet(r0, &(0x7f0000006180)=[{{&(0x7f0000000080)={0x2, 0x4e1e, @multicast2}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000900)="b3bd296539fff3fb9bb64f722bbd5dd7f840dc1d194d5026fec2c15904a12bd66b750e44460230d41547fd623cb270eb7e3c56df888021bbe6fd81d83323babf985d67039100ab0439becd237d23d8f494a3d3e4201c35a616f64471bbd2c9e2d7e7bb62941fcb5454143359a3c740e313724a2c5f9884a23a544261f62961b547ec9ff7ea0a4da080123f4e6e98598e9cd620d5c3808fe39ce98ac6055b3aec24bb5bbdfed24e521cd347fcc0d376d622e3b561b1650e9135de383ca92da47ec7f43d66ac5efc60536df8345ecc3128039af59d00e4a44b1908bbfdcdbda5e344588d1ae0574663a1ba1694515cabce7f65b34f32ee6f4b73fe8a46140d41ec33add3f4f74bbcc82305777edd3fdecf24057e245d233bdd6bbacf368a46b709204773b2f860dbeb4fc78c116b8c187a3741811ffc75530cc67d3cdf83c378805aece5c6ea4dc87e260259e500276f53b6e95ece102907a9dcfed9e6d15d5c0ab5a6365cb6560951dc098ce1b8c4ae617343000afa98e14d4a35fb3a11990d1161a2ea56ea7e01a2f23c8f3d3e5e600a4e6c995a46ef717cb347fc9a5d830ab5f2520d098995605ba4e05b790a89392b9894a0c03ba5d92b910c1bd6641666a59d5126c4bdc7e149b5f77bf95d5efb5029a32671fffd7e638b3e4174121ed6f1b709b31d0bf7995a3b56338ecbc1b4008730ec53baa9e1048ea13e75e00c48c19a5cd4a0186a0dc9379cfda2565b2a5ef9ddd25669184ef5f0c4ece9bc010250e1437c78ce0ee713a5bafe9db7d19f870de835b6e397ffedd3506ecc8b6b09567195477d7ce09e3080be1f690d5f9d471b90130917f974a5ae026a89e4c5252311df4e97cd0324a25f2c7105a42e35554a92c44faa077c07149e629183e49b1ad78188460d2a6cf694489837ed81848c4eb88173d60b39e89f7314c261f91ef967b6702b5af2f4aa3a816b79be35789f59c6372e26be3c7652e851174cd36b101254f635e007f92d40c466be9da5f97918e87e855d416a1b9df8597222be13433d", 0x2e1}], 0x1, 0x0, 0x0, 0x1100}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000001640)="1ec3403c088e5bfe03ad56969f5b33557937dc553066613a6301264710cd1fdceab6e6611cad1e64d45189fe97060dba2f7627c1e8f9485dac5f2e4b8fd45b4b908e620a1229261fe5c9bf20717772a3b6ceb6546e3210a639753f087f00577d80628f395d4ded6554f3f5740aad383fb3dbffddca1019d32b9acd957832a43052fbd35f9e2ec4b7fd79ab37bff8def1cce800ed43f030f2b3feee9ddf181c30d18f0c82af950a667213792629327deddd51740c285e55b9f2bf915301fe51b7692437ffc52efe0a3cbd2f092f248a4226fe0cb5033cf948ee552a4ea87eccc83cdff8f13648e1f65fdfcfd72a26d0f4b5e18ac093f80ae111f47d2648035cde6667f75ce5fee93485a45f5394481c638b0f9ad12c8e3ccc492f8b3ba90c66348f757116cc3c7bc2493a6c24ee402f331d472fba8d4375b1a1681be60d3d75776faf6c64ed3b35c6abd482d1e10c57e229a3a329db9c102fbb4182960e62758238fdda907dc99043a0b73642c6541e1ec26fbafc037854b614569fcd594b2451469be962f83a50d678783ef024077c92e341bae996275eaf1058e028a017a148036b35e256f953afbbb13c23e02db8ec2d08d474514e47572e2196ec944776c71225eebcca68afc3c43f2162d6ab6d147db286f8fe40d5a3f507ede694e3996de883e971baf70bd3f8093970465b0ff8de96c0e946731e1cd8051b0371636176d2e010c366c7245cd07333a065706cd0638a0f4fde58364a5c9944ab3670126fea9a35164840a8101bcc1deff4becc83f432a2d81dc1437ec833f3af078965cc4923fbe933450819acf8e6eb336f403280e750e3b4cb2a0920854acf00194076a66ae0abb8379b14dd12d722f241b7efba15520bf7df04f444c6fe460fe63108d5a8d0d7a922dc28079d5436d4660553c86d5cd15c4098fd35a6c3cec480530c20464ccd12bd464478d07952a013bb5817babfa415679f8d24fbbabc2438aa384fbc4231c23fb39b4a2396a099cc8629a21203b9cce43cdb5d92d49a947bdcbf0f50122427c3f8d31da13eacdf72d56555e8702c61ebe9bfd1e6a61888628ce188eb196f7f51d9912f522c4435ef513ec746ed3922bc80161b61c7349eb727d5f59b8ad57ddd6372078ba274d0c0b2386ef650395241899765461bc56dc1860863ed24d820ffb7a35e980a1dd5d77e1aadd3e38ee23d27190d2a1f2fef8f4ea699774435e29dffb0ad80d8df171c7ccc85403b0c39f403e444694d812e587547642b2c1f4772a24e2eb1ebed863f194e4f04635e1a1fd47d912284627449de740334d14a0c910744d1b877a5da1c637db0c36f286a23ec0285fa6687b41596f455f24a3d6ea5aa3f445b3d811142566da809b945a916f5c8f2eaf1efecbd1eccc58b74fbf41dbbb4539c82f9a1100dbf01ca39a94b8672082cfdc9dec481bbd9d18bcbc726b59ba5710e0a8746404eb9ea5c5f6bbdc6a807b3c53fc08babb66463b602b7a1d27f45563dc39ee00ccba4887b9488165380587af5723657692d9abb58670b305e1481a09fb761217dba659f23d66a4c3f1b90a9799b7c81374d50fbbe974a560699f78d41ca859f5b60b231a9c7238e18e85c49f22b0e4f298c6667bb56834de2041fb16158423ffbdc6a7907034ae18bf16b812260f276ec0c63724bed97a423398176770db7d1b47b5f5c54188515379b28c91b8778be1b9209e7906e27600538ca145d1c59c86b045009a8fd411d739aee0542a14d67424b2b1578e16368863efd664721c555f111e73a215dd03b8c1bf15b176b4779f51d2d054d984b6692caead8a54f69f17fd9d3939130e12ec542c0a12bcb2ebff1799e762c8d21ab7162f22b4966d98d12d55876676fcf9bdeadddd72ad75819bccbdbf49ba0bb4b0e279df9b8a252a82dcf83832c84c9f71a1ee66747b83fc3ae5f4250b99355bb25d14ae3d5bed16bd2761596e8f7b906d71db5595475693cc730554dbb7e4400f18bf0e8eb66fbce0162fa5db7f4a9c5d6796a66cc27c504c6043f579de02449982e4f038c3f36c9f406ba3756dacfd5cb3c46ab95a7fd46205b14d7a189fa2315", 0x5c6}, {0x0}], 0x2, &(0x7f0000006340)=ANY=[@ANYBLOB="1400000000000000000000000100000000002800000000001400000000000000000000000100000009000000000000004401000000000000000000000700000083238aac1414357f00000164010100ac1e0001ac1414aaac1414bbe00000017f000001864600000000071259d35a4ac63817394b7912fafcca154e000f1e26dfd8217ade546da378b91a020b86603fc5100088c310020dda2c60d29d1963e96e236c0007c3f62360148927b40a010102ac1414aa7f0000016401010264010101ac1e0101ffffffffe0000001e00000010727c4ffffffffac1414aaffffffffac1414bb0a0101000a010100ac14141c7f000001e0000001070fdaac1414bb0a010102e0000001862effffffff06020603c900054d59860207b3e58c91a5000bfc0afe58c645001db0070c8482d067989a74d8a1aa863d00000001010d56469772c118f19959febf07020212889153e224b7bfc1ed759c52169c96f8020c24a691b1795ff755f643010a286e8f715264f5bd00000000000000bc0000000000000000000000070000000717ec7f000001e00000017f000001e00000017f000001443c4d43ac1e010100000009ffffffff00000003ac1e010100000008ac1e00010000007eac1e000100000003e0000002000000097f00000100000008830e3d5a38dee422453b380a192b44444a736401010100000000e0000001fffffc01ac1e010180000001000000000000000964010100000000f0ac141426800000010000001000000005ac1414aa00000007009404010000000000000011000000000000000000000001000000d2000000000000001100000000000000000000000100000002000000000000001c000000000000000000000008000000", @ANYRES32, @ANYBLOB="ac1414bb0a01010000000000940000000000000000000000070000000723a9e00000017f000001e0000001ffffffffe0000001e0000001ac1e0101ac14140c890b9cffffffffac1414aa831396ffe8ffffac1e0001ac1e00010000000044341ba3e000000100000001ac1e01010000b414ac1e003ffffffbffac14142200000200e00000010000004c0000000000000007830fd6e0000001ac1e0101e000000200000000110000000000000000000000010000000000000000000000110000000000000000000000010000"], 0x350}}], 0x3, 0xc044) 2m9.575190326s ago: executing program 2 (id=7547): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[], 0x38}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000600003b00000008000300", @ANYRES32=r6, @ANYBLOB="08002600ad1600004000330010000000080211000000080211000000080211000001000000000000010001002d1a40000b0000000000000000040003000b0000000600500000000304006c"], 0x68}}, 0x0) 2m7.877972852s ago: executing program 2 (id=7559): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x44, 0xe2, 0x20, 0x8, 0x13d3, 0x3224, 0xcb0d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x0, 0x20, 0x0, [{{0x9, 0x4, 0xe7, 0x0, 0x0, 0x20, 0x1, 0xd6}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b07, &(0x7f0000000440)={'wlan1\x00', @random="8dffffffebff"}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="00073f000000928209a62dc943648171fae475a1f391f91c376614080ee5ac210cbb9def4657bbf1804040336df6a39e7fdb9ce954"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m4.718498733s ago: executing program 2 (id=7574): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000340)="650f6f34343566b842000f00d88705006900b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217ac4e181592f", 0x32}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r3 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io(r3, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00031e0000000403"], &(0x7f00000002c0)={0x0, 0xf, 0x82, {0x5, 0xf, 0x82, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x1a, 0x6, 0x7, 0x2}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xb, 0x1, 0xd8, 0xfff4}, @generic={0x6c, 0x10, 0x3, "288baa2af1283279f2102f96fe5bd2a102e210686284d3ec03d07c5a6c0c715a36e93f82bb1c3533d684a7426a14b40824a084b31760a1a700334fc1a4043dcb04a0cb83ba6e0f5a194d6e88e6f0b9fb1030d1cbd8cf1d920077e88ae2e172ccf1ee1947201fecff11"}]}}, 0x0, 0x0}, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) syz_usb_ep_read(r3, 0x0, 0x42, &(0x7f0000000700)=""/66) syz_usb_connect(0x5, 0x63, &(0x7f0000000100)=ANY=[@ANYBLOB="12015002877e712063072110b774010203010902510001280e00001904a02f07ff2d"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$alg(r5, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x1fd}], 0x18}, 0x28000054) sendmsg$nl_route_sched_retired(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r5, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000008c0)=""/223, 0xdf}, {&(0x7f0000000840)=""/127, 0x7f}, {&(0x7f0000000600)=""/134, 0x86}, {&(0x7f0000000480)=""/18, 0x12}, {&(0x7f00000006c0)=""/21, 0x15}], 0x5}, 0x4}], 0x2, 0x61, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000600)=0x600, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) memfd_create(&(0x7f0000000100)='\vem\xda\x99R@m\xfc\xfe\x9b#*\xff', 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) 1m59.705427224s ago: executing program 2 (id=7600): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000002cc0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/212, 0xd4}, {&(0x7f0000003cc0)=""/4096, 0x1000}, {&(0x7f0000000300)=""/236, 0xec}, {&(0x7f0000000640)=""/246, 0xf6}, {&(0x7f0000000000)=""/37, 0x25}, {0x0}], 0x7) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) creat(0x0, 0x122) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x7) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001000030425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0005000082180000140012800b00010062726964676500000400028008000a00", @ANYRES32=r7], 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r8 = socket(0x1, 0x803, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r10, 0x0, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r11], 0x5c}}, 0x40) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r12}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x4c}}, 0x884) 1m44.542928233s ago: executing program 40 (id=7600): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000002cc0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/212, 0xd4}, {&(0x7f0000003cc0)=""/4096, 0x1000}, {&(0x7f0000000300)=""/236, 0xec}, {&(0x7f0000000640)=""/246, 0xf6}, {&(0x7f0000000000)=""/37, 0x25}, {0x0}], 0x7) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) creat(0x0, 0x122) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x7) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001000030425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0005000082180000140012800b00010062726964676500000400028008000a00", @ANYRES32=r7], 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r8 = socket(0x1, 0x803, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r10, 0x0, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r11], 0x5c}}, 0x40) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r12}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x4c}}, 0x884) 5.917270756s ago: executing program 8 (id=8403): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800322060004000000000200000200095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0xff5, &(0x7f0000001840)=""/4085, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x11d}, 0x94) 5.831772267s ago: executing program 8 (id=8404): socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_audit(0x10, 0x3, 0x9) socket(0x1e, 0x1, 0x0) pipe(&(0x7f00000045c0)) socket$inet(0x2, 0x3, 0x7f) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[], 0x28}}, 0x802) 5.830407543s ago: executing program 8 (id=8405): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x98) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x59}, 0x2008040) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r3 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) r4 = shmat(r3, &(0x7f0000ff1000/0x3000)=nil, 0x400c) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r5 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) openat$cgroup_subtree(r6, &(0x7f0000000100), 0x2, 0x0) mremap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="815004093c00fd316b8bba0b74a83b1bfb5e7a187261316bcf653c5e11c7fd4d1415ecdee8758abbf9ba93e47f9a6ac5c085f78fcc67c3ec70f91207", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) shmdt(r4) capget(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24000040) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000006c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f00000017c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)="161cc7dda8db1354435e6886b5603f55ab0333cfe78b430a2a5312157e04252c08f5f8ea7c505f893c2ee695034946debda722e2d8a27ccecd465e121749cea4e136544228d3c7a4aaad", 0x4a}], 0x1, 0x0, 0x0, 0x44870}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)=""/5, 0x5}, {&(0x7f0000000180)=""/68, 0x44}], 0x2}, 0x40002140) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x14}}, 0x8811) ioctl$UI_SET_SWBIT(0xffffffffffffffff, 0x4004556d, 0x6) syz_open_procfs(0x0, &(0x7f00000005c0)='net/softnet_stat\x00') 4.49512468s ago: executing program 7 (id=8415): socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_audit(0x10, 0x3, 0x9) socket(0x1e, 0x1, 0x0) pipe(&(0x7f00000045c0)) socket$inet(0x2, 0x3, 0x7f) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[], 0x28}}, 0x802) 4.190919414s ago: executing program 7 (id=8418): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x14, 0x100, 0x0, 0x0, {0x10}}, 0x14}, 0x1, 0x2c}, 0x0) (async) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) gettid() r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000280), 0x22802, 0x0) (async) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00'}) (async) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000fc0), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r3, &(0x7f0000001080)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001040)={&(0x7f0000001000)={0x1c, r4, 0x2, 0x70bd27, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0xc080}, 0x8004) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0xe) (async) writev(r2, &(0x7f00000003c0)=[{&(0x7f00000002c0)="6be6", 0x2}, {0x0}], 0x2) (async) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f00000006c0)={0x18, &(0x7f0000000700)=ANY=[@ANYBLOB="0018000000007794a9f30553562ea2ba805178e63668081e9f61bbd6b788349af04adb9da819a70e0e060aa0a4622bc49258cd1fb5910c2e89a322e246190117901bbd73ab358549d60f1eeb162df0d5bf5409892e41ff93d4c47f208cf20cf2af3ca98b4e240596b1c6482f87e3e2aae9f109cac2240685aec4ed1909f26cb868ae92070ce76d6165bee46f55fcd2f4ea2ba0b236c8c5f9dbf78d1bf0dfa596b9bb5c1fc0ea4478db201efdcba043e520"], 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000280)={0x20, 0x15, 0x1, 'P'}, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) syz_usb_control_io(r1, 0x0, 0x0) (async) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x592008}, 0xc, &(0x7f0000000340)={&(0x7f00000010c0)={0x27c, r5, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0xffffff60, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x10001, @ipv4={'\x00', '\xff\xff', @empty}, 0x8}}}}]}, @TIPC_NLA_BEARER={0x24, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xbd6}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_NET={0x4}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffe01}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}]}, @TIPC_NLA_SOCK={0x60, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000001}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x62}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7f}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7ff}, @TIPC_NLA_CON_FLAG={0x8}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}]}, @TIPC_NLA_LINK={0xb0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf6b}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_MEDIA={0xc0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x0, 0x1, 0x11}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81d6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x4c}]}]}, 0x27c}, 0x1, 0x0, 0x0, 0x40004}, 0x4048801) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) r6 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902240001000000000904000001030000000921050000012205000905810300"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) r7 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f0000000040)={0x201, 0xa, 0x2}) (async) r8 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) (async) syz_usb_control_io$uac1(r1, &(0x7f0000000cc0)={0x14, &(0x7f0000000bc0)={0x40, 0x22, 0x99, {0x99, 0xb, "c76366fd8475015c7f31f44eecee220f24895bbea303521bfed98ce3aae62f187b6e53c086d4e6051089f3e8ca4bec386082b26f09b3a3a43857e75a52d07d6c02d89a0a397245af96bad9eae0007cf2d531ee33e08828df2ede329e2b40dce5b8b1e5e76fb94507fc0a9a84dc83f857a2f9cd57c6a52d940b07cc361c329fc219a4a7e010e822c3c326937b49dbf8ceec13cee60a0645"}}, &(0x7f0000000c80)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40b}}}, &(0x7f0000000f00)={0x44, &(0x7f0000000d00)={0x40, 0xb, 0x2b, "b199399c0ca326b0a814f220f1e977c93e4f5a6a97eda7ac82513393c1139388a11b594779e40bdf7d29d1"}, &(0x7f0000000d40)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000d80)={0x0, 0x8, 0x1, 0x69}, &(0x7f0000000dc0)={0x20, 0x81, 0x3, "9582e6"}, &(0x7f0000000e00)={0x20, 0x82, 0x2, 'C\a'}, &(0x7f0000000e40)={0x20, 0x83, 0x1, "04"}, &(0x7f0000000e80)={0x20, 0x84, 0x2, "4b06"}, &(0x7f0000000ec0)={0x20, 0x85, 0x3, "a40983"}}) ioctl$VIDIOC_CREATE_BUFS(r8, 0xc100565c, &(0x7f0000000140)={0x0, 0x5, 0x1, {0xa, @pix_mp={0x9, 0x81, 0x0, 0x8, 0xa, [{0xd, 0x2}, {0x3, 0x8000}, {0xa64a80ed, 0x7fffffff}, {0x200, 0x3ff}, {0x5, 0x1}, {0x4ce, 0x8}, {0x7ff, 0x9}, {0x6, 0x1}], 0x7, 0xff, 0x6, 0x1, 0x5}}}) syz_usb_control_io$rtl8150(r1, &(0x7f00000003c0)={0x14, &(0x7f0000000540)={0x20, 0xb, 0xb2, {0xb2, 0xe, "415ca8a2eae99a2b70bd4fb9c4ce45369053b13b38b840d97ddfd2c7e01a1381bffa1bf65424d02d252bd1fa3976fc4b2b5c2c88a051c6954f3203e0855c8db62496ba8d8cd7d6a782b7d26b40a3de06d89f1267cb0cc21c1149f9a6f187181d7b1c076f6d925fe60a7ace18f5ece9b4d8497e9652fc24c4bb175cb32e835ba5a13bcb3ed723e6b45d9fea7c6ec9d24c231f6e8e0c4484c28ef446ddd6a1acbe962745d6d2666093b61af87b0c72ffad"}}, &(0x7f0000000a80)={0x0, 0x3, 0xcf, @string={0xcf, 0x3, "7e8a4c39d23271a389c85829954af150ed83eeed3959e8e709fb1bdbd9a42e92c3aa93742ff4b4809ceed07f0dda7f0768bf03d013ec0948afcc30e9aa80b31718c6428420f3a12c4d4751d2b7addc103a4dce1821515ad92f0cd39ccf18136639fdc97d80cfb8b5bccb63552b36170e6ac655be9a7223e5e26fcaa68b377c762862c9cde630cd1474e0f43f74eb8003fd8da0c0a08b3dae6462dcae456f693652fc4589e0456b2c0e1f43089db128bfa274f55f2752c674a71f34c33b49066faebf8cdfeaadf9bdfadb9fdd11"}}}, &(0x7f0000000b80)={0x2c, &(0x7f0000000440)={0x40, 0xd, 0x5f, "754d3ea9445bf83f62d23ba06d091beb24132cb03d18dbbda21a27f482ee2839dc33000b33a0687ec6a180ac1406d117c5121a473d7847e80e54f4e66ec54c483cfdff783783e28f07c205e269c174f0741a120f15c3b6551798a053308f1a"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000680)={0xc0, 0x5, 0x1, 'M'}, &(0x7f0000000a00)={0x40, 0x5, 0x1, '\n'}}) (async) syz_usb_control_io$cdc_ecm(r6, &(0x7f0000000a40)={0x14, &(0x7f0000000980)={0x0, 0x6, 0x5c, {0x5c, 0x4, "615ef4ec2f2cd20d6028737a32afe826e1e9e8baf71092b47ee19ed1bad732fa2e30e64e43927c5958ee8dfa59315fcf8870ebe3dd28a41fd4f51960de2cd12dca6ff71db3cddd95a22c084d132a7b69c80096806687e8007879"}}, 0x0}, 0x0) 4.060548983s ago: executing program 8 (id=8420): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000018000001294", 0x2e}], 0x1}, 0x0) 3.79692435s ago: executing program 8 (id=8423): syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x6, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x8000) madvise(&(0x7f000072a000/0x4000)=nil, 0x4000, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast2, @multicast1}}}], 0x20}}], 0x1, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001000)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xffff, 0xfff1}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001800)=@newtfilter={0x40, 0x2c, 0x605, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffe0}, {}, {0xffff, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xe}}]}}]}, 0x40}}, 0x48c0) syz_open_dev$tty20(0xc, 0x4, 0x1) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000740)={@broadcast, @loopback, r5}, 0xc) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) fadvise64(r6, 0x6, 0x6, 0x3) writev(r6, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x0, 0x0, 0x0, 0x5, 0xbc, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) setsockopt$inet_msfilter(r7, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027f"], 0x57) setsockopt$inet_mreqsrc(r3, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) 3.049715211s ago: executing program 3 (id=8434): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket(0x23, 0x5, 0x5) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xffffffff, 0x0, 0xb49, 0x9, 0x8000000000000001, 0x0, 0x3}, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) (async) r4 = socket$key(0xf, 0x3, 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000000}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000000}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x20000091) sendmsg$key(r4, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x50}}, 0x0) (async) sendmsg$key(r4, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) (async) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r7, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r8}) (async) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r7, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r8}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r7, 0xc01064ab, &(0x7f0000000380)={0x1, r9, r8}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) syz_open_dev$loop(&(0x7f0000000080), 0x4, 0x80000) (async) r10 = syz_open_dev$loop(&(0x7f0000000080), 0x4, 0x80000) ioctl$BLKTRACESETUP(r10, 0xc0481273, &(0x7f0000000000)={'\x00', 0x4, 0x3, 0x1, 0x4de2, 0x1}) ioctl$BLKTRACETEARDOWN(r10, 0x1276, 0x0) ioctl$DRM_IOCTL_MODE_SETPROPERTY(0xffffffffffffffff, 0xc01064ab, &(0x7f0000000440)={0x5, r9}) connect$inet6(r3, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x82, 0x0) 2.32064634s ago: executing program 3 (id=8442): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0xfffffffd) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0xfffffffd) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0x8) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r4, 0x1) r5 = socket$netlink(0x10, 0x3, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r5) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000040200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) 2.136752988s ago: executing program 3 (id=8443): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x45ffffa, 0x281) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) r4 = openat$sysfs(0xffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0x0, 0x44) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0xffffd000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) r5 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) ioctl$PAGEMAP_SCAN(r5, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0xfffffffffffffffd, 0x0, 0x0, 0x1f, 0x0, 0x34, 0x0, 0xe4}) syz_emit_ethernet(0x4e, &(0x7f0000000780)=ANY=[@ANYBLOB="bbbbbbbbab55f8000000000086dd6000200000183afffe8000000000000000000000000000aa8700907800000000fc020000000000000000000000000001"], 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000180)=0x200, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r4, 0x4868, 0x2000, 0xc, 0x0, 0x0) ioctl$EXT4_IOC_CHECKPOINT(r2, 0x4004662b, &(0x7f00000000c0)=0x6) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = dup(r6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000400)={0x40, @tick=0x5, 0x4, {0xc, 0x4}, 0x4, 0x0, 0x4}) sendmsg$inet6(r6, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x2, @loopback, 0x4}, 0x1c, &(0x7f0000000340)=[{&(0x7f0000000440)="b480063928ead83ab915720b8935be72df84545ec18829bf7dce93b637c0163ffd8307e5eca5da7ed0ca36e7b84331", 0x2f}], 0x1}, 0x4048043) shutdown(r6, 0x1) r8 = fanotify_init(0x8, 0x1) r9 = syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x20, &(0x7f0000000a80)=ANY=[@ANYBLOB="665eadc6bc0efefc467f0254059b356b6071be401d88f9d977fdecafc03ddc8a4301b35299ab09b8cd5db629ba85e9499b0f961bfbadb8faf3bb9fec4ed3998543b474e3128dee2e95f76354c5ee5b195e7be3e0cca8f4fff5190b77cfbdfc03682adb3517f05ecba1ddbaa302ea36492faf30f9926a027a5b3e385c997beaae7330bcc53ba4131b5da87d4e0d80ad610061ad57cb1b0f58b73000969cbcc65bee7149379e521b01a39f0fe553f0de40c4fa5dcbaa3abb019064060f69511bbc054a9038f82a32412e0a1fe7265faa51c3e3f971335cc8ab74c8bbe15a08490c3314c44e95f1dc325f012a5ace1773b2", @ANYRESHEX=r0, @ANYRESOCT=r5, @ANYRESDEC, @ANYRES16=r2, @ANYRESDEC, @ANYBLOB="2c626c6b73697a653d3078303030303030301000000030303430302c616c6c6f775f6f746865722c62006d73697a653d3078303030303030303030303030303230302c616c6c6f775f6f746865722c626c6b73697a653d307830303630302c626c6b73697a653d3078303030303030303030303030306530302c6d61785f726561643d3078303030303030303038303030303030302c657569643e00"/165, @ANYRESOCT=r2, @ANYBLOB, @ANYRES16=r3, @ANYBLOB=',smackfshat=,^{,obj_role=\x00,smackfshat=[T\\-%/--,smackfsroot=\x00,'], 0x1, 0x0, &(0x7f0000000380)="cc3d846df69906d4889a02d441561045a96bb603a262686de13c3d5846360b742aba97bfd663fb821d6a4413a63508ff1ecf597c957a8ffcf4c973ad7990a5ef8b804d828c72fcfa73a40f7be8c94219aad72f24d8116e0d516b6c20d136a942f0ddb53d713a5858") fanotify_mark(r8, 0x8, 0x1000, r9, &(0x7f0000000300)='./file0\x00') ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001100)={r0, 0x0, {0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "244333000000000000042000000100a9cc5c9016cae83300", [0xfffffffff6ff7ffc]}}) socket$nl_route(0x10, 0x3, 0x0) 1.154649718s ago: executing program 3 (id=8450): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000002140)={'wg2\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@ipv6_newnexthop={0x3c, 0x68, 0x1, 0x0, 0x0, {}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x2}, @NHA_OIF={0x8, 0x5, r1}, @NHA_ENCAP={0x14, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, @LWTUNNEL_IP_OPT_VXLAN_GBP={0x8}}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 1.065356942s ago: executing program 3 (id=8453): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x62040) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000001c0)={0x0, 0x0, 0xaa}) (async) r1 = getpgid(0x0) ioprio_get$pid(0x2, r1) (async) socket$nl_route(0x10, 0x3, 0x0) 1.044825936s ago: executing program 9 (id=8454): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000033c0)={0x53, 0xfffffffffffffffe, 0x6, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000000)="12b03f000008", 0x0, 0x0, 0xffffffff, 0x0, 0x0}) 1.005129689s ago: executing program 7 (id=8455): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/reserved_size', 0x141a82, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x3, 0x6361, 0x5, 0xfffffffd, 0x40000006}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000804) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {}, {0xd, 0xb}, {0xffe0, 0xd}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x9, 0xb, 0x4}}}}]}, 0x40}}, 0x4010004) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 953.481596ms ago: executing program 9 (id=8457): r0 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b2c25fe80000000080000dc8b71d5decf66cc00"/40, 0x28}], 0x1}, 0x0) 953.134586ms ago: executing program 3 (id=8458): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_DEBUGREGS(r2, 0x8080aea1, &(0x7f0000001340)) socket(0x15, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xffffffff}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys/\x00et/\x00\x00v4\x00\x00s/\x92ync_\x00le\xf44\x8cm\xa0\x8dN\xd4\xa2\x88\x00\xd1l,'}, 0x30) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r6) r7 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x81}) r10 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r10, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r10, 0x0, 0x0) r11 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r11, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x3, 0x10003, 0x20493859, 0x2, 0x6, [{0xeb30, 0x10}, {0x180000, 0x745}, {0x9, 0x8}, {0x7ffffffe, 0x7d}, {0x4, 0x2}, {0x4fff, 0x5414}, {0x3ff, 0x800}, {0x40000003, 0x4}], 0x9, 0x7, 0x4, 0x1, 0x3}}) syz_usb_control_io$hid(r10, &(0x7f0000000080)={0x24, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ncm(r10, 0x0, 0x0) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r12, 0x84, 0xc, &(0x7f0000000000), 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r12, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x4e23, 0x5, @remote, 0x3}], 0x1c) getsockopt$sock_buf(r12, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) io_uring_enter(r7, 0x5cae, 0x0, 0x24, 0x0, 0x0) 871.713777ms ago: executing program 9 (id=8459): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in=@rand_addr=0x64010101, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1, 0x1}}, 0xb8}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd60ab000100141600fe8000000000fdff00000000000000bbfe8000000000000000000000000000aa"], 0x0) 681.177698ms ago: executing program 9 (id=8461): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000000)=0x200, 0x4) sendmmsg$inet6(r0, &(0x7f00000027c0)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x60, @mcast2, 0x1b}, 0x1c, &(0x7f0000001180)=[{&(0x7f00000000c0)="e85eb3ad7a85f8ffbfeca731d6c8b8efffe715ca63a772ab76e7cffafb9d389706d2e359133ee025548a9a6dacd710c38203386303f61999708e2e086f02a597d35cb89496800f640fdc0d640b093b6048a305e8b1fe97a29fd305a32a525559ddd5ee389d8bc85b5c014a923f2633e07c9b1306f90aca263b0cbb80cd28e0d43c5e853eafd3471233aa29ffcbf71f5d41e6ac5cd9dd73d7d5a33ff36301367732b1d6d5c7bd74aa59bcbbeace3a5d25c319b37e9b5a1a2f49f5332b818ac6d3c9458fdbe1ac55b4c0560f22e891801c3c7ea9af178d90346e6bf66b6826d57dc05dcf8972c73b85085ebabef39bd87aed18f4de2d0caba6eb22132ee4e6c99097f54ca9742a3ae9bb80ab191d594d82418fadfa0cb593c22a452949e76978b77f7cd812009d64eaeeeb27224b6df92fbfeae6c94fb1c633246609466ac4d8fb1d890081d260b4c7acaf1b8a6f938205c462f4562e73d73546a47e3384abbd05de604e7d50d8053fb15a4ad2cc2d5a96c62fe5f4398362e4b098b6fd3b7fb03144c7a258b344de3fdb78ecb4237e53ae95ca31598a8102bd5990575fa6aff26ad340d7bbf1644ba6f1168d1d9a50aee8a9494c733f2c55dda98db0f23eff7df41a3354c3310c421703c0dad93182e4d10cf579215232e07cca2fa220d4a0751d2ededfd4924845baa5539fd6e666f3df3426afed1cd1c7c12bcf39eed1b848beee", 0x201}], 0x1}}], 0x1, 0x97) 621.734606ms ago: executing program 8 (id=8462): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040bd28420000000000000109022400010000000009040100020300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) (async) syz_usb_control_io$hid(r0, &(0x7f0000000400)={0x24, &(0x7f0000000040)={0x20, 0xc, 0x7, {0x7, 0x10, "3640054a34"}}, 0x0, 0x0, 0x0}, 0x0) 574.796232ms ago: executing program 7 (id=8463): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0x511e36599023629, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x4}) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f0000000000)={{0x80}, 'port0\x00', 0x0, 0x40000, 0x1, 0x0, 0x592c, 0x1, 0xfffffffc, 0x0, 0x4}) 574.586411ms ago: executing program 9 (id=8464): socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_audit(0x10, 0x3, 0x9) socket(0x1e, 0x1, 0x0) pipe(&(0x7f00000045c0)) socket$inet(0x2, 0x3, 0x7f) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'], 0x28}}, 0x802) 484.301393ms ago: executing program 6 (id=8465): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[], 0x38}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000002003b00000008000300", @ANYRES32=r6, @ANYBLOB="08002600ad1600004000330010000000080211000000080211000000080211000001000000000000010001002d1a40000b0000000000000000040003000b0000000600500000000304006c"], 0x68}}, 0x0) 484.015733ms ago: executing program 7 (id=8466): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80100000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff020d40f799000000000000000000011400040020010000000000000000000000000001080007400000000010000d800c000380060002004e210000080007400000000da800068004000380080002006401010124000380060001004e230000060001004e230000060001004e210000060002004e24000008000200e000000234000380060002004e230000060002004e240000060001004e200000060002004e200000060002004e230000060001004e200000140004000000000000000000000000000000000008000200ac1414aa140005000000000000000000000000000000000008000100e000000284000e801400018008000100ac141409080002000a0101010600034000000000060003400001000006000340000300000c000280050001009f0000000c00028005000100000000002c00018014000300", @ANYRES32=r0], 0x1e8}, 0x1, 0x0, 0x0, 0x40040814}, 0x0) 482.73354ms ago: executing program 9 (id=8467): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, &(0x7f0000000040)={0x0, 0xe472, 0x2, 0x0, 0x25a}, 0x0, &(0x7f00000002c0)=0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x20000000) r3 = socket(0x28, 0x1, 0x37) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000003c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0f0000000a000000", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="61a3bf2f30c39fb4d5f1ccfda678917c70e21422d56170e2e2c588144bbf85b8c5f51ab7442b6eeac2173692f0688a0480aff2f22427cfc5a70376de7a7e9a95f8a6bd9888db66ac58075f74566878418460aa9306c665465b84eda587044c289e8b6973a7e48e2120e56df2c8f0b0ea50e9525a79a30e8b572b7c937827a6ff5d527d3db47f542e15b653effe1eb7484540d732b10917695f05d41901654f9d0a2039d445957c432b71d5a28a5e813bf3efaca5000032c6171f4692a2799beb1974d8586fcc52", @ANYRES64=0x0], 0x20) fsopen(&(0x7f00000002c0)='exfat\x00', 0x0) getsockname$inet(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) waitid(0x1, 0xffffffffffffffff, 0x0, 0x2, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) ioctl$int_in(r4, 0x5421, &(0x7f0000000080)=0x7) setsockopt$sock_int(r4, 0x1, 0x10, &(0x7f0000000000)=0x2, 0x4) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000001c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, &(0x7f0000000240)={0x18, r5}) connect$unix(r4, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r4, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) syz_io_uring_submit(0x0, r0, &(0x7f0000000280)=@IORING_OP_SEND={0x1a, 0xe, 0x0, r1, 0x0, &(0x7f0000000540)="e432ffdf8c22492c236d67f4636b800fa634414a8779a4093e822a3b5d9a2e099db5c7c8b05ec65422d8223cf73b921d57ed256c67796846bda663ec1b71667bb870f77bbe7d1835cee9309db1261845250d2b49423e20213dc1f3fa7e07b03a066a617c671fa7187366ebab590f5635d03be3035aee73759057272df72fc78d0aaf7777373ab0528069a1e49708f6", 0x8f, 0x20058081}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000200)={0xfffffffe, 0x3, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[], 0x50) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, 0x9, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_ADT={0x14, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x4}}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x20040000}, 0x840) 372.753785ms ago: executing program 6 (id=8468): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000010c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000210000000000010000004c00088048000080200009801c000080060001000200007f0f000200ac1414aa0500030002000000240001"], 0x7c}, 0x1, 0x0, 0x0, 0x4084}, 0x20008040) 366.87942ms ago: executing program 7 (id=8469): syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) timerfd_create(0x7, 0x80800) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500}, &(0x7f0000000000)={0x1f}, 0x0, 0x0, 0x0) 331.904848ms ago: executing program 6 (id=8470): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@updsa={0xfc, 0x10, 0x1, 0x0, 0x0, {{@in=@dev, @in6=@rand_addr=' \x01\x00'}, {@in=@dev, 0x0, 0x2b}, @in=@multicast2, {}, {0x0, 0x0, 0x0, 0xffffffffffffff80}, {}, 0x0, 0x0, 0xa}, [@sec_ctx={0xc, 0x8, {0x8}}]}, 0xfc}}, 0x0) 197.710908ms ago: executing program 6 (id=8471): r0 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=@newlink={0x70, 0x10, 0x437, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, 0x20c89}, [@IFLA_LINKINFO={0x50, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x40, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_FLOWINFO={0x8, 0xc, 0xfffffffe}, @IFLA_GRE_LINK={0x8, 0x1, r1}, @IFLA_GRE_REMOTE={0x14, 0x7, @mcast2}, @IFLA_GRE_LOCAL={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}}}]}, 0x70}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24004880}, 0x300000000000000) 133.242618ms ago: executing program 6 (id=8472): r0 = syz_open_dev$vim2m(&(0x7f0000000380), 0x7f, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000240)={0x1, @pix_mp={0x0, 0x0, 0x32314742, 0x0, 0x4, [{0x2000000}, {}, {}, {0x4}, {0x80000000}, {0x0, 0x300}]}}) 0s ago: executing program 6 (id=8473): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x3, 0x6361, 0x5, 0xfffffffd, 0x40000006}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000804) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {}, {0xd, 0xb}, {0xffe0, 0xd}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x9, 0xb, 0x4}}}}]}, 0x40}}, 0x4010004) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) kernel console output (not intermixed with test programs): 26993][T30732] pyra 0003:1E7D:2CF6.0067: unknown main item tag 0x0 [ 1675.133895][T30732] pyra 0003:1E7D:2CF6.0067: unknown main item tag 0x0 [ 1675.140671][T30732] pyra 0003:1E7D:2CF6.0067: unknown main item tag 0x0 [ 1675.149090][T30732] pyra 0003:1E7D:2CF6.0067: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.9-1/input0 [ 1675.161087][T30732] pyra 0003:1E7D:2CF6.0067: couldn't init struct pyra_device [ 1675.208256][T30732] pyra 0003:1E7D:2CF6.0067: couldn't install mouse [ 1675.285015][T30732] pyra 0003:1E7D:2CF6.0067: probe with driver pyra failed with error -71 [ 1675.375853][T30732] usb 10-1: USB disconnect, device number 7 [ 1675.650463][ T400] fido_id[400]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.9/usb10/report_descriptor': No such file or directory [ 1675.910261][ T5827] Bluetooth: hci0: command 0x0406 tx timeout [ 1676.287878][ T413] gretap0: entered promiscuous mode [ 1676.326521][ T413] vlan0: entered promiscuous mode [ 1677.166540][T29763] hid-generic 0000:0000:0000.0068: unknown main item tag 0x0 [ 1677.233649][T29763] hid-generic 0000:0000:0000.0068: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1678.103179][T29763] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1678.293600][T29763] usb 9-1: Using ep0 maxpacket: 32 [ 1678.303510][T29763] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 1678.330134][T29763] usb 9-1: config 0 has no interface number 0 [ 1678.388174][T29763] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1678.434400][T29763] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1678.442423][T29763] usb 9-1: Product: syz [ 1678.458236][ T477] netlink: 388 bytes leftover after parsing attributes in process `syz.9.7487'. [ 1678.467397][T29763] usb 9-1: Manufacturer: syz [ 1678.467418][T29763] usb 9-1: SerialNumber: syz [ 1678.500565][T29763] usb 9-1: config 0 descriptor?? [ 1678.524129][T29763] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1678.555173][ T475] bond1: option ad_user_port_key: invalid value (27030) [ 1678.574273][ T475] bond1: option ad_user_port_key: allowed values 0 - 1023 [ 1678.643497][ T475] bond1 (unregistering): Released all slaves [ 1678.747448][T29763] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1678.790664][T29763] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1679.364787][ T491] netlink: 56 bytes leftover after parsing attributes in process `syz.7.7489'. [ 1679.952766][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 1679.952784][ T30] audit: type=1800 audit(1767199822.407:4417): pid=497 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.7485" name="file1" dev="tmpfs" ino=160 res=0 errno=0 [ 1679.995576][ T498] misc userio: No port type given on /dev/userio [ 1680.883646][ C0] usb 9-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1680.896290][T29763] usb 9-1: USB disconnect, device number 6 [ 1680.958688][T29763] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1681.013208][ T5834] Bluetooth: hci1: command 0x0406 tx timeout [ 1681.027544][T29763] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1681.101224][T29763] quatech2 9-1:0.51: device disconnected [ 1681.897563][ T548] netlink: 24 bytes leftover after parsing attributes in process `syz.7.7498'. [ 1684.664474][ T645] xt_connbytes: Forcing CT accounting to be enabled [ 1684.683630][ T645] xt_NFQUEUE: number of total queues is 0 [ 1685.047154][ T655] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1685.085282][ T655] bond0: (slave sit1): The slave device specified does not support setting the MAC address [ 1685.110999][ T655] bond0: (slave sit1): Error -95 calling set_mac_address [ 1685.247415][T18162] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1685.256633][ T670] binder: 663:670 ioctl 40046205 0 returned -22 [ 1685.685733][T18162] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1685.729368][T18162] usb 3-1: config 255 has an invalid interface number: 119 but max is 0 [ 1685.763496][T18162] usb 3-1: config 255 has no interface number 0 [ 1685.801293][T18162] usb 3-1: config 255 interface 119 has no altsetting 0 [ 1685.903212][T18162] usb 3-1: New USB device found, idVendor=0421, idProduct=048e, bcdDevice=d4.8c [ 1685.913851][T18162] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1685.925478][T18162] usb 3-1: Product: syz [ 1685.929651][T18162] usb 3-1: Manufacturer: syz [ 1685.964527][T18162] usb 3-1: SerialNumber: syz [ 1686.135151][ T5834] Bluetooth: hci2: command 0x0406 tx timeout [ 1686.178105][ T705] netlink: 24 bytes leftover after parsing attributes in process `syz.9.7531'. [ 1686.319156][T18162] rndis_host 3-1:255.119: invalid descriptor buffer length [ 1686.374296][T18162] usb 3-1: bad CDC descriptors [ 1686.390164][T18162] cdc_acm 3-1:255.119: invalid descriptor buffer length [ 1686.471050][T18162] usb 3-1: USB disconnect, device number 85 [ 1686.502383][ T711] netlink: 'syz.7.7530': attribute type 1 has an invalid length. [ 1686.576943][ T716] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 1686.677052][ T720] netlink: 28 bytes leftover after parsing attributes in process `syz.7.7530'. [ 1687.198871][ T717] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1687.211252][ T717] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 1687.305226][ T724] bond1: (slave gretap1): making interface the new active one [ 1687.314500][ T724] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 1687.324217][ T736] wireguard: wg0: Could not create IPv4 socket [ 1687.655004][T30732] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1687.824056][T30732] usb 9-1: Using ep0 maxpacket: 32 [ 1687.847823][T30732] usb 9-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1687.893857][T30732] usb 9-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1687.940197][T30732] usb 9-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1687.983167][T30732] usb 9-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1688.041654][T30732] usb 9-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1688.088693][T30732] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1688.164155][T30732] usb 9-1: Product: syz [ 1688.194080][T30732] usb 9-1: Manufacturer: syz [ 1688.207554][T30732] usb 9-1: SerialNumber: syz [ 1688.241626][ C1] imon 9-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1688.250226][T30732] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:155.0/input/input74 [ 1688.403636][ T765] kAFS: unable to lookup cell '(,cL' [ 1688.413627][ T764] kAFS: unable to lookup cell '.,' [ 1688.463344][T30732] imon 9-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1688.496742][T30732] (id 0x00) [ 1688.540687][ T769] kAFS: unable to lookup cell '.,' [ 1688.773113][T30732] rc_core: IR keymap rc-imon-pad not found [ 1688.786191][T30732] Registered IR keymap rc-empty [ 1688.799879][T30732] imon 9-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1688.851321][T30732] imon 9-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1688.903140][T30732] imon:send_packet: packet tx failed (-71) [ 1688.953550][T30732] imon 9-1:155.0: remote input dev register failed [ 1688.983505][T30732] imon 9-1:155.0: imon_init_intf0: rc device setup failed [ 1689.584329][T30732] imon 9-1:155.0: unable to initialize intf0, err 0 [ 1689.590994][T30732] imon:imon_probe: failed to initialize context! [ 1689.633791][T30732] imon 9-1:155.0: unable to register, err -19 [ 1689.663324][T30732] usb 9-1: USB disconnect, device number 7 [ 1689.920504][ T822] netlink: 484 bytes leftover after parsing attributes in process `syz.9.7545'. [ 1689.949753][ T823] netlink: 20 bytes leftover after parsing attributes in process `syz.7.7546'. [ 1689.969020][ T822] bridge_slave_1: left allmulticast mode [ 1689.989084][ T822] bridge_slave_1: left promiscuous mode [ 1690.004543][ T822] bridge0: port 2(bridge_slave_1) entered disabled state [ 1690.051113][ T822] bond0: (slave bond_slave_0): Releasing backup interface [ 1690.087308][ T822] bond0: (slave bond_slave_1): Releasing backup interface [ 1690.144569][ T822] team0: Port device team_slave_0 removed [ 1690.171170][ T822] team0: Port device team_slave_1 removed [ 1690.189747][ T822] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1690.220408][ T822] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1690.242175][ T822] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1690.259475][ T822] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1690.279660][ T822] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1690.701792][ T842] netlink: 8 bytes leftover after parsing attributes in process `syz.7.7550'. [ 1691.835986][ T873] tipc: Started in network mode [ 1691.842826][ T873] tipc: Node identity f0, cluster identity 4711 [ 1691.851465][ T873] tipc: Node number set to 240 [ 1692.261711][ T898] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1692.753152][T29763] usb 3-1: new full-speed USB device number 86 using dummy_hcd [ 1692.885170][ T923] netlink: 12 bytes leftover after parsing attributes in process `syz.6.7566'. [ 1692.958147][T29763] usb 3-1: config 4 has an invalid interface number: 231 but max is 0 [ 1692.981530][ T923] netlink: 388 bytes leftover after parsing attributes in process `syz.6.7566'. [ 1693.003157][T29763] usb 3-1: config 4 has no interface number 0 [ 1693.019614][T29763] usb 3-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 1693.054833][T29763] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1693.080670][T29763] usb 3-1: Product: syz [ 1693.090065][T29763] usb 3-1: Manufacturer: syz [ 1693.099945][T29763] usb 3-1: SerialNumber: syz [ 1693.290105][T29763] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 1693.543095][ T944] xt_CT: No such helper "syz0" [ 1694.054676][T29763] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1694.070517][T29763] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 1694.141192][ T954] netlink: 'syz.9.7570': attribute type 4 has an invalid length. [ 1694.269801][T29763] usb 3-1: USB disconnect, device number 86 [ 1695.400804][ T1014] netlink: 4 bytes leftover after parsing attributes in process `syz.9.7575'. [ 1695.419202][ T1014] netlink: 348 bytes leftover after parsing attributes in process `syz.9.7575'. [ 1695.428947][ T1014] netlink: 4 bytes leftover after parsing attributes in process `syz.9.7575'. [ 1695.445906][ T1014] netlink: 348 bytes leftover after parsing attributes in process `syz.9.7575'. [ 1695.455670][ T1014] netlink: 4 bytes leftover after parsing attributes in process `syz.9.7575'. [ 1695.476505][ T1014] netlink: 'syz.9.7575': attribute type 9 has an invalid length. [ 1695.515275][ T1014] netlink: 'syz.9.7575': attribute type 11 has an invalid length. [ 1695.548673][ T1014] netlink: 'syz.9.7575': attribute type 12 has an invalid length. [ 1695.573923][ T1014] netlink: 210020 bytes leftover after parsing attributes in process `syz.9.7575'. [ 1695.602380][ T1014] netlink: 4 bytes leftover after parsing attributes in process `syz.9.7575'. [ 1695.743099][ T1037] netlink: 'syz.6.7577': attribute type 1 has an invalid length. [ 1695.879273][ T1051] fuse: Bad value for 'fd' [ 1695.938573][ T1056] netlink: 28 bytes leftover after parsing attributes in process `syz.6.7577'. [ 1696.215070][ T1045] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1696.236669][ T1045] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 1696.564728][ T1060] bond1: (slave gretap1): making interface the new active one [ 1696.575477][ T1060] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 1697.529762][ T1089] xt_CT: No such helper "snmp_trap" [ 1698.122336][ T1107] No such timeout policy "syz0" [ 1698.292942][ T1111] batadv0: entered promiscuous mode [ 1698.369562][ T1111] batadv0: left promiscuous mode [ 1698.433301][T18162] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 1698.726347][ T1118] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1698.743129][ T1118] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 1698.770420][ T1118] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1698.811857][T18162] usb 3-1: device not accepting address 87, error -71 [ 1698.970636][ T1127] batman_adv: batadv0: adding TT local entry ba:e1:05:00:07:00 to non-existent VLAN 1280 [ 1699.184142][T24267] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 1699.188953][ T1142] netlink: 8 bytes leftover after parsing attributes in process `syz.7.7598'. [ 1699.242584][ T30] audit: type=1326 audit(1767199841.697:4418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.279307][ T30] audit: type=1326 audit(1767199841.737:4419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.328902][ T30] audit: type=1326 audit(1767199841.737:4420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.385142][T24267] usb 9-1: config index 0 descriptor too short (expected 45, got 36) [ 1699.400841][T24267] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1699.421138][ T30] audit: type=1326 audit(1767199841.737:4421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.443978][T24267] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1699.454890][T24267] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1699.475555][ T30] audit: type=1326 audit(1767199841.737:4422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.497951][T24267] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1699.513158][T24267] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1699.526642][ T30] audit: type=1326 audit(1767199841.737:4423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.551171][T24267] usb 9-1: config 0 descriptor?? [ 1699.571137][ T30] audit: type=1326 audit(1767199841.737:4424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.606260][ T30] audit: type=1326 audit(1767199841.737:4425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.663533][ T30] audit: type=1326 audit(1767199841.737:4426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1699.690923][ T30] audit: type=1326 audit(1767199841.737:4427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1143 comm="syz.6.7599" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feda558f749 code=0x7ffc0000 [ 1700.103577][T24267] plantronics 0003:047F:FFFF.0069: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 1700.249903][ T1160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1700.271985][ T1160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1700.350101][T24267] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 1700.507734][T24267] usb 10-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 1700.519204][T24267] usb 10-1: config 0 has an invalid interface number: 2 but max is -1 [ 1700.530456][T24267] usb 10-1: config 0 has an invalid interface number: 2 but max is -1 [ 1700.539509][T24267] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1700.551525][T24267] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1700.563824][T24267] usb 10-1: config 0 has no interface number 0 [ 1700.570108][T24267] usb 10-1: config 0 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1700.597550][T24267] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1700.607283][T24267] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1700.615781][T24267] usb 10-1: Product: syz [ 1700.620262][T24267] usb 10-1: Manufacturer: syz [ 1700.629862][T24267] usb 10-1: SerialNumber: syz [ 1700.642586][T24267] usb 10-1: config 0 descriptor?? [ 1700.725810][ T1185] netlink: 'syz.2.7600': attribute type 1 has an invalid length. [ 1700.875453][T24267] usb 10-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 1700.885989][T24267] usb 10-1: MIDIStreaming interface descriptor not found [ 1700.965171][T24267] usb 10-1: USB disconnect, device number 8 [ 1701.315835][ C0] plantronics 0003:047F:FFFF.0069: usb_submit_urb(ctrl) failed: -1 [ 1701.457983][ T1213] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1701.463163][ T57] usb 9-1: reset high-speed USB device number 8 using dummy_hcd [ 1701.582805][ T1217] netlink: 88 bytes leftover after parsing attributes in process `syz.9.7604'. [ 1701.602645][ T1198] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1701.633003][ T1198] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 1701.635385][ T57] usb 9-1: device descriptor read/64, error -32 [ 1701.651923][ T1220] netlink: 76 bytes leftover after parsing attributes in process `syz.9.7604'. [ 1701.732151][ T1220] bridge0: entered allmulticast mode [ 1701.738545][ T1220] netlink: 88 bytes leftover after parsing attributes in process `syz.9.7604'. [ 1701.893632][ T57] usb 9-1: reset high-speed USB device number 8 using dummy_hcd [ 1702.023265][ T57] usb 9-1: device descriptor read/64, error -32 [ 1702.263118][ T57] usb 9-1: reset high-speed USB device number 8 using dummy_hcd [ 1702.327956][ T57] usb 9-1: device descriptor read/8, error -32 [ 1703.225826][T15149] usb 9-1: USB disconnect, device number 8 [ 1703.567345][ T1288] tipc: Enabling of bearer rejected, already enabled [ 1703.696509][ T1294] program syz.8.7620 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1703.712921][ T1294] xt_hashlimit: size too large, truncated to 1048576 [ 1703.720177][ T1297] netlink: 'syz.9.7621': attribute type 1 has an invalid length. [ 1703.844322][ T1297] bond1: entered promiscuous mode [ 1703.869260][ T1298] bond1: (slave bridge1): making interface the new active one [ 1703.903213][ T1298] bridge1: entered promiscuous mode [ 1703.919529][ T1298] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 1703.953187][ T1305] : renamed from vxcan1 (while UP) [ 1704.044979][ T1306] bond1: (slave bridge2): Enslaving as a backup interface with an up link [ 1704.408641][ T1332] netlink: 76 bytes leftover after parsing attributes in process `syz.9.7624'. [ 1704.438866][ T1334] netlink: 8 bytes leftover after parsing attributes in process `syz.8.7627'. [ 1704.582639][ T1338] vlan0: entered promiscuous mode [ 1704.853605][ T1341] netlink: 'syz.8.7629': attribute type 3 has an invalid length. [ 1705.784311][ T1365] tipc: Started in network mode [ 1705.790960][ T1365] tipc: Node identity 00000000000000000000000000002e01, cluster identity 4711 [ 1705.815059][ T1365] tipc: Enabling of bearer rejected, failed to enable media [ 1706.077740][ T1372] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 1706.200899][ T1378] tipc: Enabling of bearer rejected, failed to enable media [ 1706.337035][ T1382] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1706.546325][ T1394] binder: 1393:1394 unknown command 0 [ 1706.555767][ T1394] binder: 1393:1394 ioctl c0306201 200000000080 returned -22 [ 1706.972974][ T1409] bridge0: entered promiscuous mode [ 1706.979166][ T1409] vlan2: entered promiscuous mode [ 1707.082974][ T1415] syz_tun: entered allmulticast mode [ 1707.100513][ T1414] syz_tun: left allmulticast mode [ 1707.674189][ T1439] IPv6: NLM_F_CREATE should be specified when creating new route [ 1708.721927][ T1469] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7660'. [ 1708.783254][ T1469] netlink: 348 bytes leftover after parsing attributes in process `syz.8.7660'. [ 1708.794342][ T1472] netlink: 'syz.8.7660': attribute type 9 has an invalid length. [ 1708.817181][ T1469] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7660'. [ 1708.841073][ T1472] netlink: 'syz.8.7660': attribute type 11 has an invalid length. [ 1708.868931][ T1472] netlink: 'syz.8.7660': attribute type 12 has an invalid length. [ 1708.897189][ T1469] netlink: 348 bytes leftover after parsing attributes in process `syz.8.7660'. [ 1708.906556][ T1472] netlink: 210020 bytes leftover after parsing attributes in process `syz.8.7660'. [ 1708.906668][ T1472] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7660'. [ 1708.986106][ T1471] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1709.009639][ T1471] team0: Port device batadv1 added [ 1709.030160][ T1469] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7660'. [ 1709.297713][ T1482] netlink: 60 bytes leftover after parsing attributes in process `syz.9.7662'. [ 1709.759762][ T1496] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7665'. [ 1710.603997][ T1502] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7666'. [ 1710.634536][ T1502] netlink: 348 bytes leftover after parsing attributes in process `syz.8.7666'. [ 1710.644000][ T1502] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7666'. [ 1710.652859][ T1502] netlink: 348 bytes leftover after parsing attributes in process `syz.8.7666'. [ 1710.682612][ T1502] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7666'. [ 1710.695333][ T1504] netlink: 'syz.8.7666': attribute type 9 has an invalid length. [ 1710.713692][ T1504] netlink: 'syz.8.7666': attribute type 11 has an invalid length. [ 1710.721540][ T1504] netlink: 'syz.8.7666': attribute type 12 has an invalid length. [ 1710.749203][ T1504] netlink: 210020 bytes leftover after parsing attributes in process `syz.8.7666'. [ 1710.787795][ T1504] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7666'. [ 1711.256738][ T1527] netlink: 32 bytes leftover after parsing attributes in process `syz.7.7671'. [ 1711.671666][ T1534] netlink: 24 bytes leftover after parsing attributes in process `syz.8.7674'. [ 1712.137020][ T1550] syzkaller1: entered promiscuous mode [ 1712.142503][ T1550] syzkaller1: entered allmulticast mode [ 1712.463529][T18541] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 1712.617768][ T1563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1712.659566][T18541] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1712.673545][ T1563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1712.699560][T18541] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1712.757776][T18541] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1712.839691][T18541] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1712.877272][T18541] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1712.956950][T18541] usb 9-1: config 0 descriptor?? [ 1713.245096][ T1576] netlink: 'syz.7.7683': attribute type 13 has an invalid length. [ 1713.563780][T18541] plantronics 0003:047F:FFFF.006A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 1713.909269][ T1576] bridge0: port 2(bridge_slave_1) entered disabled state [ 1713.918873][ T1576] bridge0: port 1() entered disabled state [ 1714.040753][ T1553] usb 9-1: string descriptor 0 read error: -71 [ 1714.064154][T16783] usb 9-1: USB disconnect, device number 9 [ 1714.652200][ T1576] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1714.691038][ T1576] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1715.389065][ T5834] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1715.400210][ T5834] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1715.408488][ T5834] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1715.424167][ T5834] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1715.445973][ T5834] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1715.614055][ T1576] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1715.701951][ T2209] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1715.724002][ T2209] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1715.745261][ T2209] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1715.798107][ T2209] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1715.996783][ T1610] batman_adv: batadv0: adding TT local entry ba:e1:05:00:07:00 to non-existent VLAN 1280 [ 1716.045879][ T1586] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 1716.163631][ T1614] __nla_validate_parse: 2 callbacks suppressed [ 1716.163644][ T1614] netlink: 12 bytes leftover after parsing attributes in process `syz.7.7692'. [ 1716.233733][ T1586] usb 10-1: Using ep0 maxpacket: 32 [ 1716.297080][ T1586] usb 10-1: config 0 has an invalid interface number: 42 but max is 0 [ 1716.313535][ T1586] usb 10-1: config 0 has no interface number 0 [ 1716.341122][ T1586] usb 10-1: New USB device found, idVendor=1bcf, idProduct=0b40, bcdDevice=42.27 [ 1716.353754][ T1586] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1716.361920][ T1586] usb 10-1: Product: syz [ 1716.366251][ T1586] usb 10-1: Manufacturer: syz [ 1716.372253][ T1586] usb 10-1: SerialNumber: syz [ 1716.382497][ T1586] usb 10-1: config 0 descriptor?? [ 1716.677977][ T1605] netlink: 'syz.9.7690': attribute type 27 has an invalid length. [ 1716.829284][ T1630] xt_connbytes: Forcing CT accounting to be enabled [ 1716.860728][ T1630] xt_NFQUEUE: number of total queues is 0 [ 1716.873650][ T1634] netlink: 'syz.9.7690': attribute type 27 has an invalid length. [ 1716.907351][ T1628] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1716.916915][ T1628] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1716.917089][ T1605] bridge0: left allmulticast mode [ 1717.491825][ T1605] macsec1: left promiscuous mode [ 1717.500498][ T5834] Bluetooth: hci5: command tx timeout [ 1717.522633][ T1605] bond1: left promiscuous mode [ 1717.529361][ T1605] bridge1: left promiscuous mode [ 1717.647226][ T3732] netdevsim netdevsim9 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.677161][ T3732] netdevsim netdevsim9 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.773558][ T3732] netdevsim netdevsim9 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1717.844448][ T1596] chnl_net:caif_netlink_parms(): no params data found [ 1717.901163][ T3732] netdevsim netdevsim9 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1718.071470][ T1648] netlink: 14 bytes leftover after parsing attributes in process `syz.8.7703'. [ 1718.342134][ T1596] bridge0: port 1(bridge_slave_0) entered blocking state [ 1718.361037][ T1596] bridge0: port 1(bridge_slave_0) entered disabled state [ 1718.377846][ T1596] bridge_slave_0: entered allmulticast mode [ 1718.406641][ T1596] bridge_slave_0: entered promiscuous mode [ 1718.436369][ T1596] bridge0: port 2(bridge_slave_1) entered blocking state [ 1718.449512][ T1596] bridge0: port 2(bridge_slave_1) entered disabled state [ 1718.459879][ T1596] bridge_slave_1: entered allmulticast mode [ 1718.476897][ T1596] bridge_slave_1: entered promiscuous mode [ 1718.519473][ T1596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1718.533602][ T1596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1718.670855][ T1596] team0: Port device team_slave_0 added [ 1718.703190][ T1596] team0: Port device team_slave_1 added [ 1718.735784][ T1596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1718.742856][ T1596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1718.770048][ T1596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1718.785683][ T1596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1718.792847][ T1596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1718.819166][ T1596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1718.885582][ T1596] hsr_slave_0: entered promiscuous mode [ 1718.892567][ T1596] hsr_slave_1: entered promiscuous mode [ 1718.899834][ T1596] debugfs: 'hsr0' already exists in 'hsr' [ 1718.906281][ T1596] Cannot create hsr debugfs directory [ 1719.574500][ T5834] Bluetooth: hci5: command tx timeout [ 1719.607299][ T1586] uvcvideo 10-1:0.42: Found UVC 0.00 device syz (1bcf:0b40) [ 1719.633409][ T1586] uvcvideo 10-1:0.42: Forcing UVC version to 1.0a [ 1719.643095][ T1586] uvcvideo 10-1:0.42: No valid video chain found. [ 1719.663379][ T1586] usb 10-1: USB disconnect, device number 9 [ 1720.185289][ T1713] netlink: 12 bytes leftover after parsing attributes in process `syz.8.7721'. [ 1720.604933][ T1720] netlink: 12 bytes leftover after parsing attributes in process `syz.8.7721'. [ 1720.633853][ T1706] usb usb8: usbfs: process 1706 (syz.9.7718) did not claim interface 0 before use [ 1720.740066][ T1719] veth1: entered promiscuous mode [ 1720.774630][ T1719] bridge2: entered promiscuous mode [ 1720.787807][ T1719] hsr1: entered promiscuous mode [ 1721.377632][ T1756] netlink: 'syz.6.7729': attribute type 27 has an invalid length. [ 1721.414864][ T1757] netlink: 'syz.7.7727': attribute type 1 has an invalid length. [ 1721.553413][ T1763] netlink: 28 bytes leftover after parsing attributes in process `syz.7.7727'. [ 1721.654084][ T5834] Bluetooth: hci5: command tx timeout [ 1723.217563][ T1812] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '#! [ 1723.217563][ T1812] cct.usage_percpu_sys' [ 1723.579760][ T1818] x_tables: duplicate underflow at hook 4 [ 1723.735898][ T5827] Bluetooth: hci5: command tx timeout [ 1723.773337][ T1825] FAULT_INJECTION: forcing a failure. [ 1723.773337][ T1825] name failslab, interval 1, probability 0, space 0, times 0 [ 1723.811935][ T1825] CPU: 1 UID: 0 PID: 1825 Comm: syz.9.7742 Tainted: G L syzkaller #0 PREEMPT(full) [ 1723.811966][ T1825] Tainted: [L]=SOFTLOCKUP [ 1723.811973][ T1825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1723.811985][ T1825] Call Trace: [ 1723.811994][ T1825] [ 1723.812003][ T1825] dump_stack_lvl+0xe8/0x150 [ 1723.812034][ T1825] should_fail_ex+0x414/0x560 [ 1723.812064][ T1825] should_failslab+0xa8/0x100 [ 1723.812088][ T1825] kmem_cache_alloc_noprof+0x88/0x710 [ 1723.812113][ T1825] ? apparmor_capable+0x137/0x1a0 [ 1723.812140][ T1825] ? skb_clone+0x212/0x3a0 [ 1723.812165][ T1825] skb_clone+0x212/0x3a0 [ 1723.812186][ T1825] ? nfnetlink_rcv+0x4ba/0x2590 [ 1723.812209][ T1825] nfnetlink_rcv+0x4ec/0x2590 [ 1723.812233][ T1825] ? is_bpf_text_address+0x26/0x2b0 [ 1723.812258][ T1825] ? unwind_get_return_address+0x4d/0x90 [ 1723.812270][ T1825] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1723.812287][ T1825] ? arch_stack_walk+0xfc/0x150 [ 1723.812311][ T1825] ? __lock_acquire+0x6b6/0x2cf0 [ 1723.812323][ T1825] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1723.812343][ T1825] ? __lock_acquire+0x6b6/0x2cf0 [ 1723.812358][ T1825] ? __netlink_lookup+0xbd/0x8a0 [ 1723.812378][ T1825] ? netlink_deliver_tap+0x2e/0x1b0 [ 1723.812391][ T1825] ? netlink_deliver_tap+0x2e/0x1b0 [ 1723.812412][ T1825] netlink_unicast+0x82f/0x9e0 [ 1723.812428][ T1825] ? __pfx_netlink_unicast+0x10/0x10 [ 1723.812438][ T1825] ? __alloc_skb+0x198/0x3a0 [ 1723.812449][ T1825] ? netlink_sendmsg+0x642/0xb30 [ 1723.812461][ T1825] ? skb_put+0x11b/0x210 [ 1723.812473][ T1825] netlink_sendmsg+0x805/0xb30 [ 1723.812491][ T1825] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1723.812505][ T1825] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1723.812519][ T1825] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1723.812529][ T1825] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1723.812542][ T1825] __sock_sendmsg+0x21c/0x270 [ 1723.812559][ T1825] ____sys_sendmsg+0x505/0x820 [ 1723.812574][ T1825] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1723.812590][ T1825] ? import_iovec+0x74/0xa0 [ 1723.812604][ T1825] ___sys_sendmsg+0x21f/0x2a0 [ 1723.812617][ T1825] ? __pfx____sys_sendmsg+0x10/0x10 [ 1723.812632][ T1825] ? irqentry_exit+0x5dd/0x660 [ 1723.812656][ T1825] ? __fget_files+0x2a/0x420 [ 1723.812669][ T1825] ? __fget_files+0x3a0/0x420 [ 1723.812686][ T1825] __x64_sys_sendmsg+0x19b/0x260 [ 1723.812700][ T1825] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1723.812716][ T1825] ? rcu_is_watching+0x15/0xb0 [ 1723.812735][ T1825] do_syscall_64+0xec/0xf80 [ 1723.812746][ T1825] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1723.812755][ T1825] ? trace_irq_disable+0x37/0x100 [ 1723.812769][ T1825] ? clear_bhb_loop+0x60/0xb0 [ 1723.812781][ T1825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1723.812791][ T1825] RIP: 0033:0x7f3c56d8f749 [ 1723.812801][ T1825] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1723.812811][ T1825] RSP: 002b:00007f3c57c05038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1723.812823][ T1825] RAX: ffffffffffffffda RBX: 00007f3c56fe5fa0 RCX: 00007f3c56d8f749 [ 1723.812831][ T1825] RDX: 0000000000001000 RSI: 0000200000000140 RDI: 0000000000000003 [ 1723.812838][ T1825] RBP: 00007f3c57c05090 R08: 0000000000000000 R09: 0000000000000000 [ 1723.812845][ T1825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1723.812851][ T1825] R13: 00007f3c56fe6038 R14: 00007f3c56fe5fa0 R15: 00007f3c5710fa28 [ 1723.812867][ T1825] [ 1724.424867][ T2209] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1725.053580][ T2209] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1725.062546][ T2209] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1725.072352][ T2209] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1725.087597][ T1830] macsec3: entered allmulticast mode [ 1725.092991][ T1830] veth1_macvtap: entered allmulticast mode [ 1725.110980][ T1830] veth1_macvtap: left allmulticast mode [ 1725.153563][T29765] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 1725.313160][T29765] usb 9-1: Using ep0 maxpacket: 16 [ 1725.321175][T29765] usb 9-1: config 0 has an invalid interface number: 161 but max is 0 [ 1725.383199][T29765] usb 9-1: config 0 has no interface number 0 [ 1725.389323][T29765] usb 9-1: config 0 interface 161 has no altsetting 0 [ 1725.408816][T29765] usb 9-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 1725.458200][T29765] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1725.490674][T29765] usb 9-1: Product: syz [ 1725.498171][T29765] usb 9-1: Manufacturer: syz [ 1725.503266][T29765] usb 9-1: SerialNumber: syz [ 1725.524023][T29765] usb 9-1: config 0 descriptor?? [ 1725.817560][ T1860] loop8: detected capacity change from 0 to 1 [ 1725.870200][ T1860] Dev loop8: unable to read RDB block 1 [ 1725.893935][ T1860] loop8: unable to read partition table [ 1725.900591][ T1861] netlink: 12 bytes leftover after parsing attributes in process `syz.9.7749'. [ 1725.923925][ T1860] loop8: partition table beyond EOD, truncated [ 1725.960652][ T1860] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1725.974830][T29765] ums-jumpshot 9-1:0.161: USB Mass Storage device detected [ 1726.002003][ T1596] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1726.042058][T29765] ums-jumpshot 9-1:0.161: Quirks match for vid 05dc pid 0001: 2 [ 1726.063711][ T5200] Dev loop8: unable to read RDB block 1 [ 1726.082784][ T5200] loop8: unable to read partition table [ 1726.128801][ T5200] loop8: partition table beyond EOD, truncated [ 1726.166663][T29765] usb 9-1: USB disconnect, device number 10 [ 1726.246628][ T1596] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1726.351379][ T1596] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1726.410563][ T1596] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1727.005509][ T3732] bridge_slave_1: left allmulticast mode [ 1727.035566][ T3732] bridge_slave_1: left promiscuous mode [ 1727.061996][ T3732] bridge0: port 2(bridge_slave_1) entered disabled state [ 1727.135939][ T3732] : left allmulticast mode [ 1727.155533][ T3732] : left promiscuous mode [ 1727.165833][ T3732] bridge0: port 1() entered disabled state [ 1728.376718][ T3732] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1728.404857][ T3732] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1728.426150][ T3732] bond0 (unregistering): Released all slaves [ 1728.433163][ T1586] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 1728.472179][ T3732] bond1 (unregistering): Released all slaves [ 1728.596976][ T1586] usb 9-1: Using ep0 maxpacket: 16 [ 1728.652730][ T1586] usb 9-1: config 0 has an invalid interface number: 161 but max is 0 [ 1728.692195][ T1586] usb 9-1: config 0 has no interface number 0 [ 1728.732267][ T1586] usb 9-1: config 0 interface 161 has no altsetting 0 [ 1728.764250][ T1596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1728.772227][ T1586] usb 9-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 1728.803295][ T1586] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1728.811322][ T1586] usb 9-1: Product: syz [ 1728.848790][ T1586] usb 9-1: Manufacturer: syz [ 1728.874613][ T1586] usb 9-1: SerialNumber: syz [ 1728.903991][ T1586] usb 9-1: config 0 descriptor?? [ 1728.931083][ T1596] 8021q: adding VLAN 0 to HW filter on device team0 [ 1728.967793][T11779] bridge0: port 1(bridge_slave_0) entered blocking state [ 1728.975003][T11779] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1729.047636][ T2209] bridge0: port 2(bridge_slave_1) entered blocking state [ 1729.054814][ T2209] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1729.244396][ T3732] hsr_slave_0: left promiscuous mode [ 1729.256126][ T3732] hsr_slave_1: left promiscuous mode [ 1729.277887][ T3732] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1729.294098][ T3732] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1730.137449][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.143978][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.302354][ T5827] Bluetooth: hci0: unknown advertising packet type: 0xff [ 1730.388228][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 1730.388245][ T30] audit: type=1326 audit(1767199872.847:4430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1946 comm="syz.9.7763" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3c56d8f749 code=0x0 [ 1730.432010][ T3732] team0 (unregistering): Port device team_slave_1 removed [ 1730.516112][ T3732] team0 (unregistering): Port device team_slave_0 removed [ 1731.050152][ T1952] netlink: 8 bytes leftover after parsing attributes in process `syz.9.7764'. [ 1731.199090][ T1596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1731.218715][ T1586] ums-jumpshot 9-1:0.161: USB Mass Storage device detected [ 1731.251434][ T1586] ums-jumpshot 9-1:0.161: Quirks match for vid 05dc pid 0001: 2 [ 1731.310454][ T1596] veth0_vlan: entered promiscuous mode [ 1731.325548][ T1596] veth1_vlan: entered promiscuous mode [ 1731.394491][ T1586] usb 9-1: USB disconnect, device number 11 [ 1731.416252][ T1596] veth0_macvtap: entered promiscuous mode [ 1731.469242][ T1596] veth1_macvtap: entered promiscuous mode [ 1731.574955][ T1596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1731.587421][ T1596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1731.682473][T11786] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1731.754572][T11786] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1731.903938][T11786] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1731.954132][ T1975] lo: entered promiscuous mode [ 1731.971976][ T1975] tunl0: entered promiscuous mode [ 1731.979671][ T1975] gre0: entered promiscuous mode [ 1732.038601][ T1975] gretap0: entered promiscuous mode [ 1732.052574][ T1975] erspan0: entered promiscuous mode [ 1732.091683][ T1975] ip_vti0: entered promiscuous mode [ 1732.099339][ T1975] ip6_vti0: entered promiscuous mode [ 1732.155389][ T1975] sit0: entered promiscuous mode [ 1732.195289][ T1975] ip6tnl0: entered promiscuous mode [ 1732.221630][ T1975] ip6gre0: entered promiscuous mode [ 1732.253912][ T1975] syz_tun: entered promiscuous mode [ 1732.288503][ T1975] ip6gretap0: entered promiscuous mode [ 1732.332779][ T1975] vcan0: entered promiscuous mode [ 1732.345967][ T1975] bond0: entered promiscuous mode [ 1732.354328][ T1975] bond_slave_0: entered promiscuous mode [ 1732.381981][ T1975] bond_slave_1: entered promiscuous mode [ 1732.424875][ T1975] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1732.460351][ T1975] team0: entered promiscuous mode [ 1732.466674][ T1975] team_slave_0: entered promiscuous mode [ 1732.495483][ T1975] team_slave_1: entered promiscuous mode [ 1732.521180][ T1975] batadv1: entered promiscuous mode [ 1732.544210][ T1975] batadv2: entered promiscuous mode [ 1732.577641][ T1975] 8021q: adding VLAN 0 to HW filter on device team0 [ 1732.617481][ T1975] dummy0: entered promiscuous mode [ 1732.651528][ T1975] nlmon0: entered promiscuous mode [ 1732.686050][ T1975] caif0: entered promiscuous mode [ 1732.703634][ T1975] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1732.772913][T11786] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1733.154326][T11786] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1733.189294][T11786] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1733.267306][T11774] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1733.288916][T11774] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1733.427143][ T2006] netlink: 'syz.3.7687': attribute type 20 has an invalid length. [ 1734.199173][ T2027] netlink: 'syz.9.7777': attribute type 1 has an invalid length. [ 1734.258015][ T2030] netlink: 28 bytes leftover after parsing attributes in process `syz.9.7777'. [ 1734.343138][ T1586] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 1734.382265][ T2032] bond2: (slave gretap1): making interface the new active one [ 1734.399131][ T2027] netlink: 28 bytes leftover after parsing attributes in process `syz.9.7777'. [ 1734.427875][ T2032] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 1734.472870][ T2027] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1734.534127][ T1586] usb 9-1: Using ep0 maxpacket: 16 [ 1734.566492][ T1586] usb 9-1: config 0 has an invalid interface number: 161 but max is 0 [ 1734.606474][ T1586] usb 9-1: config 0 has no interface number 0 [ 1734.612573][ T1586] usb 9-1: config 0 interface 161 has no altsetting 0 [ 1734.672234][ T1586] usb 9-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 1734.721013][ T1586] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1734.757374][ T1586] usb 9-1: Product: syz [ 1734.772592][ T1586] usb 9-1: Manufacturer: syz [ 1734.795769][ T1586] usb 9-1: SerialNumber: syz [ 1734.835040][ T1586] usb 9-1: config 0 descriptor?? [ 1735.830478][ T2064] netlink: 16 bytes leftover after parsing attributes in process `syz.7.7785'. [ 1737.014192][T31128] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 1737.075911][ T1586] ums-jumpshot 9-1:0.161: USB Mass Storage device detected [ 1737.102940][ T1586] ums-jumpshot 9-1:0.161: Quirks match for vid 05dc pid 0001: 2 [ 1737.177842][T31128] usb 10-1: Using ep0 maxpacket: 8 [ 1737.187966][ T1586] usb 9-1: USB disconnect, device number 12 [ 1737.203718][T31128] usb 10-1: config 2 has an invalid descriptor of length 82, skipping remainder of the config [ 1737.234229][T31128] usb 10-1: config 2 has 0 interfaces, different from the descriptor's value: 1 [ 1737.259243][T31128] usb 10-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 1737.294679][T31128] usb 10-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 1737.317784][T31128] usb 10-1: Product: syz [ 1737.322058][T31128] usb 10-1: Manufacturer: syz [ 1737.343128][T31128] usb 10-1: SerialNumber: syz [ 1737.507407][ T2110] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1737.993347][T18602] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1738.123426][T18602] usb 9-1: device descriptor read/64, error -71 [ 1738.130050][ T2141] fuse: Unknown parameter '0x0000000000000009' [ 1738.383169][T18602] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 1738.523142][T18602] usb 9-1: device descriptor read/64, error -71 [ 1738.557128][ T2161] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7797'. [ 1738.627146][ T2165] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7797'. [ 1738.648442][T18602] usb usb9-port1: attempt power cycle [ 1739.023472][T18602] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 1739.083906][T18602] usb 9-1: device descriptor read/8, error -71 [ 1739.183176][T18162] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1739.335027][T18602] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1739.364600][T18602] usb 9-1: device descriptor read/8, error -71 [ 1739.387758][T18162] usb 4-1: Using ep0 maxpacket: 16 [ 1739.396521][T18162] usb 4-1: config 0 has an invalid interface number: 161 but max is 0 [ 1739.405200][T18162] usb 4-1: config 0 has no interface number 0 [ 1739.411391][T18162] usb 4-1: config 0 interface 161 has no altsetting 0 [ 1739.430105][T18162] usb 4-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 1739.440104][T18162] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1739.448524][T18162] usb 4-1: Product: syz [ 1739.453374][T18162] usb 4-1: Manufacturer: syz [ 1739.458245][T18162] usb 4-1: SerialNumber: syz [ 1739.471015][T18162] usb 4-1: config 0 descriptor?? [ 1739.503752][T18602] usb usb9-port1: unable to enumerate USB device [ 1740.045564][T18602] usb 10-1: USB disconnect, device number 10 [ 1740.684237][ T57] usb 10-1: new full-speed USB device number 11 using dummy_hcd [ 1740.865565][ T57] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1740.877227][ T57] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 1740.890131][ T57] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 1740.903567][ T57] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1740.923130][ T57] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1740.955570][ T57] usb 10-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 1740.996521][ T57] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 1741.021017][ T57] usb 10-1: Product: syz [ 1741.035650][ T57] usb 10-1: Manufacturer: syz [ 1741.044907][ T57] usb 10-1: SerialNumber: syz [ 1741.067909][ T57] usb 10-1: config 0 descriptor?? [ 1741.289089][ T57] radio-si470x 10-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 1741.310935][ T57] radio-si470x 10-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 1741.488297][ T57] radio-si470x 10-1:0.0: software version 0, hardware version 0 [ 1741.513175][ T57] radio-si470x 10-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 1741.557166][ T57] radio-si470x 10-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 1741.690169][ T57] radio-si470x 10-1:0.0: submitting int urb failed (-90) [ 1741.722013][ T2277] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7816'. [ 1742.285724][T18162] ums-jumpshot 4-1:0.161: USB Mass Storage device detected [ 1742.367045][ T2286] netlink: 'syz.8.7819': attribute type 10 has an invalid length. [ 1742.375494][T18162] ums-jumpshot 4-1:0.161: Quirks match for vid 05dc pid 0001: 2 [ 1742.457994][ T5827] Bluetooth: hci3: command 0x0406 tx timeout [ 1742.463112][T18162] usb 4-1: USB disconnect, device number 67 [ 1742.813122][T18162] usb 4-1: new full-speed USB device number 68 using dummy_hcd [ 1742.983207][T15878] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 1743.006702][T18162] usb 4-1: config 1 has an invalid descriptor of length 217, skipping remainder of the config [ 1743.032936][T18162] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 1743.049221][T18162] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice=40.40 [ 1743.062598][T18162] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1743.071283][T18162] usb 4-1: Product: syz [ 1743.077553][T18162] usb 4-1: Manufacturer: syz [ 1743.082366][T18162] usb 4-1: SerialNumber: syz [ 1743.103910][ T57] radio-si470x 10-1:0.0: si470x_get_report: usb_control_msg returned -32 [ 1743.155452][T15878] usb 9-1: Using ep0 maxpacket: 8 [ 1743.179023][T15878] usb 9-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1743.203204][T15878] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1743.215441][T15878] usb 9-1: Product: syz [ 1743.219627][T15878] usb 9-1: Manufacturer: syz [ 1743.226702][T15878] usb 9-1: SerialNumber: syz [ 1743.246060][T15878] usb 9-1: config 0 descriptor?? [ 1743.266141][T15878] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1743.415570][ T2318] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7826'. [ 1743.656068][ T1638] usb 10-1: USB disconnect, device number 11 [ 1744.114049][ T1638] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 1744.273156][ T1638] usb 10-1: Using ep0 maxpacket: 16 [ 1744.282797][ T1638] usb 10-1: config 0 has an invalid interface number: 161 but max is 0 [ 1744.313100][ T1638] usb 10-1: config 0 has no interface number 0 [ 1744.319323][ T1638] usb 10-1: config 0 interface 161 has no altsetting 0 [ 1744.329598][ T1638] usb 10-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 1744.338852][ T1638] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1744.347104][ T1638] usb 10-1: Product: syz [ 1744.351434][ T1638] usb 10-1: Manufacturer: syz [ 1744.356463][ T1638] usb 10-1: SerialNumber: syz [ 1744.365987][ T1638] usb 10-1: config 0 descriptor?? [ 1745.088130][T15878] gspca_sonixj: reg_r err -71 [ 1745.143185][T15878] sonixj 9-1:0.0: probe with driver sonixj failed with error -71 [ 1745.172145][T15878] usb 9-1: USB disconnect, device number 17 [ 1745.500521][T15878] usb 4-1: USB disconnect, device number 68 [ 1745.603900][ T2404] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7833'. [ 1746.215986][T15878] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1746.404914][T15878] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1746.418476][T15878] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1746.431311][T15878] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1746.443547][T15878] usb 4-1: config 0 descriptor?? [ 1746.737803][T15878] usbhid 4-1:0.0: can't add hid device: -71 [ 1746.762781][T15878] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1746.779986][T15878] usb 4-1: USB disconnect, device number 69 [ 1746.961244][ T1638] ums-jumpshot 10-1:0.161: USB Mass Storage device detected [ 1747.011719][ T1638] ums-jumpshot 10-1:0.161: Quirks match for vid 05dc pid 0001: 2 [ 1747.145417][ T1638] usb 10-1: USB disconnect, device number 12 [ 1747.246501][T15878] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1747.272279][ T2455] vhci_hcd vhci_hcd.0: pdev(9) rhport(0) sockfd(6) [ 1747.278824][ T2455] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1747.316568][ T2455] vhci_hcd vhci_hcd.0: Device attached [ 1747.348863][ T2456] vhci_hcd: connection closed [ 1747.349175][T31775] vhci_hcd vhci_hcd.9: stop threads [ 1747.370585][T31775] vhci_hcd vhci_hcd.9: release socket [ 1747.386981][T31775] vhci_hcd vhci_hcd.9: disconnect device [ 1747.413604][T15878] usb 4-1: Using ep0 maxpacket: 16 [ 1747.424285][T15878] usb 4-1: config 0 has an invalid descriptor of length 224, skipping remainder of the config [ 1747.446162][T15878] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1747.468042][ T2468] netlink: 32 bytes leftover after parsing attributes in process `syz.7.7841'. [ 1747.481330][T15878] usb 4-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 1747.499461][T15878] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1747.540256][T15878] usb 4-1: config 0 descriptor?? [ 1747.556559][T15878] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1748.267064][ T2487] fuse: Unknown parameter '0x0000000000000003' [ 1748.984111][T15878] usb 4-1: USB disconnect, device number 70 [ 1749.091409][ T2500] bridge0: entered promiscuous mode [ 1749.108362][ T2500] vlan2: entered promiscuous mode [ 1749.466256][ T2512] tipc: Started in network mode [ 1749.471378][ T2512] tipc: Node identity f0, cluster identity 4711 [ 1749.480432][ T2512] tipc: Node number set to 240 [ 1749.593133][ T797] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 1749.753107][ T797] usb 10-1: Using ep0 maxpacket: 16 [ 1749.781911][ T797] usb 10-1: config 0 has an invalid interface number: 161 but max is 0 [ 1749.831712][ T797] usb 10-1: config 0 has no interface number 0 [ 1749.851694][ T797] usb 10-1: config 0 interface 161 has no altsetting 0 [ 1749.861375][ T797] usb 10-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.01 [ 1749.872214][ T797] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1749.882517][ T797] usb 10-1: Product: syz [ 1749.887042][ T797] usb 10-1: Manufacturer: syz [ 1749.901899][ T797] usb 10-1: SerialNumber: syz [ 1749.918147][ T797] usb 10-1: config 0 descriptor?? [ 1750.493128][ T1638] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1750.661548][ T2530] binder_alloc: 2529: binder_alloc_buf, no vma [ 1750.675092][ T1638] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1750.700364][ T1638] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 1750.717051][ T1638] usb 9-1: can't read configurations, error -71 [ 1751.181791][ T2566] netlink: 'syz.6.7864': attribute type 4 has an invalid length. [ 1751.202963][ T2566] netlink: 'syz.6.7864': attribute type 4 has an invalid length. [ 1751.773413][ T1638] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 1751.933148][ T1638] usb 9-1: Using ep0 maxpacket: 32 [ 1751.945872][ T1638] usb 9-1: config 0 has an invalid interface number: 42 but max is 0 [ 1751.968548][ T1638] usb 9-1: config 0 has no interface number 0 [ 1752.001813][ T1638] usb 9-1: New USB device found, idVendor=1bcf, idProduct=0b40, bcdDevice=42.27 [ 1752.016023][ T1638] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1752.027007][ T1638] usb 9-1: Product: syz [ 1752.032025][ T1638] usb 9-1: Manufacturer: syz [ 1752.041399][ T1638] usb 9-1: SerialNumber: syz [ 1752.049480][ T1638] usb 9-1: config 0 descriptor?? [ 1752.092003][ T2577] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7867'. [ 1752.102278][ T2577] netlink: 348 bytes leftover after parsing attributes in process `syz.6.7867'. [ 1752.111837][ T2577] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7867'. [ 1752.133230][ T2577] netlink: 348 bytes leftover after parsing attributes in process `syz.6.7867'. [ 1752.142753][ T2577] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7867'. [ 1752.167307][ T2580] netlink: 'syz.6.7867': attribute type 9 has an invalid length. [ 1752.177660][ T2580] netlink: 'syz.6.7867': attribute type 11 has an invalid length. [ 1752.188149][ T2580] netlink: 'syz.6.7867': attribute type 12 has an invalid length. [ 1752.203582][ T2580] netlink: 210020 bytes leftover after parsing attributes in process `syz.6.7867'. [ 1752.214845][ T2580] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7867'. [ 1752.387304][ T797] ums-jumpshot 10-1:0.161: USB Mass Storage device detected [ 1752.432029][ T797] ums-jumpshot 10-1:0.161: Quirks match for vid 05dc pid 0001: 2 [ 1752.509657][ T2575] netlink: 'syz.8.7866': attribute type 27 has an invalid length. [ 1752.549133][ T797] usb 10-1: USB disconnect, device number 13 [ 1752.697060][ T5834] Bluetooth: hci4: command 0x0406 tx timeout [ 1752.706549][ T2609] fuse: Unknown parameter 'group_i00000000000000000000' [ 1752.827688][ T2571] netlink: 'syz.8.7866': attribute type 27 has an invalid length. [ 1752.844147][ T2571] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1752.863572][ T2571] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1752.982089][ T2615] kvm: apic: phys broadcast and lowest prio [ 1753.013603][ T2575] hsr1: left promiscuous mode [ 1753.030683][ T2611] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1753.100454][T31775] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1753.117863][T31775] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1753.131452][T31775] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1753.170572][T31775] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1754.290985][ T2650] vlan2: entered promiscuous mode [ 1754.298914][ T39] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 1754.450819][ T1638] uvcvideo 9-1:0.42: Found UVC 0.00 device syz (1bcf:0b40) [ 1754.466424][ T1638] uvcvideo 9-1:0.42: Forcing UVC version to 1.0a [ 1754.476716][ T1638] uvcvideo 9-1:0.42: No valid video chain found. [ 1754.489233][ T39] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 1754.516850][ T1638] usb 9-1: USB disconnect, device number 19 [ 1754.522884][ T39] usb 10-1: config 0 has no interface number 0 [ 1754.537050][ T39] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1754.578028][ T39] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1754.589182][ T39] usb 10-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 1754.590204][ T2658] fuse: Unknown parameter 'group_id00000000000000000000' [ 1754.601148][ T39] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1754.643272][ T39] usb 10-1: config 0 descriptor?? [ 1754.861792][ T39] usbhid 10-1:0.1: can't add hid device: -71 [ 1754.890069][ T39] usbhid 10-1:0.1: probe with driver usbhid failed with error -71 [ 1754.919169][ T39] usb 10-1: USB disconnect, device number 14 [ 1755.078634][ T2674] netlink: 'syz.8.7891': attribute type 10 has an invalid length. [ 1755.199541][ T2679] xfrm0: entered promiscuous mode [ 1755.742248][ T2704] netlink: 'syz.9.7899': attribute type 1 has an invalid length. [ 1755.758995][ T2705] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 1755.782881][ T2705] team0: Port device batadv2 added [ 1755.927504][ T39] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1756.095754][ T39] usb 4-1: Using ep0 maxpacket: 32 [ 1756.118638][ T2710] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1756.131948][ T39] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1756.145476][ T2710] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 1756.158953][ T39] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1756.301326][ T39] usb 4-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 1756.356844][ T39] usb 4-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 1756.473749][ T39] usb 4-1: Product: syz [ 1756.507911][ T39] usb 4-1: Manufacturer: syz [ 1756.512553][ T39] usb 4-1: SerialNumber: syz [ 1756.829530][ T2719] netlink: 52 bytes leftover after parsing attributes in process `syz.6.7902'. [ 1757.020277][T18541] usb 4-1: USB disconnect, device number 71 [ 1757.253665][ T2725] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1757.268194][ T2723] set match dimension is over the limit! [ 1757.279411][ T2725] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 1757.331032][ T2725] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1757.738872][ T2731] netlink: 32 bytes leftover after parsing attributes in process `syz.8.7904'. [ 1760.278982][T15878] usb 10-1: new full-speed USB device number 15 using dummy_hcd [ 1760.486489][T15878] usb 10-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1760.513629][T15878] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1760.540452][T15878] usb 10-1: Product: syz [ 1760.556117][T15878] usb 10-1: Manufacturer: syz [ 1760.572077][T15878] usb 10-1: SerialNumber: syz [ 1760.661022][T15878] usb 10-1: config 0 descriptor?? [ 1760.911158][T15878] usb 10-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1761.509024][ T2844] FAULT_INJECTION: forcing a failure. [ 1761.509024][ T2844] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1761.526941][ T2844] CPU: 0 UID: 0 PID: 2844 Comm: syz.8.7925 Tainted: G L syzkaller #0 PREEMPT(full) [ 1761.526974][ T2844] Tainted: [L]=SOFTLOCKUP [ 1761.526982][ T2844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1761.526999][ T2844] Call Trace: [ 1761.527008][ T2844] [ 1761.527017][ T2844] dump_stack_lvl+0xe8/0x150 [ 1761.527048][ T2844] should_fail_ex+0x414/0x560 [ 1761.527083][ T2844] prepare_alloc_pages+0x22b/0x650 [ 1761.527115][ T2844] __alloc_frozen_pages_noprof+0x123/0x370 [ 1761.527143][ T2844] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1761.527172][ T2844] ? lruvec_stat_mod_folio+0x6f/0x2e0 [ 1761.527201][ T2844] ? policy_nodemask+0x27c/0x720 [ 1761.527230][ T2844] alloc_pages_mpol+0x232/0x4a0 [ 1761.527258][ T2844] vma_alloc_folio_noprof+0xe4/0x200 [ 1761.527283][ T2844] ? page_table_check_set+0x148/0x610 [ 1761.527305][ T2844] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1761.527327][ T2844] ? css_rstat_updated+0x239/0x520 [ 1761.527362][ T2844] ? ___pte_offset_map+0x29/0x240 [ 1761.527392][ T2844] folio_prealloc+0x30/0x180 [ 1761.527413][ T2844] do_pte_missing+0x14e8/0x3330 [ 1761.527454][ T2844] handle_mm_fault+0x1b26/0x32b0 [ 1761.527481][ T2844] ? __pte_offset_map_lock+0x13e/0x210 [ 1761.527522][ T2844] ? handle_mm_fault+0xdb/0x32b0 [ 1761.527559][ T2844] ? __pfx_handle_mm_fault+0x10/0x10 [ 1761.527593][ T2844] ? follow_page_pte+0x7ef/0x13e0 [ 1761.527627][ T2844] ? __pfx_follow_page_pte+0x10/0x10 [ 1761.527664][ T2844] __get_user_pages+0x1650/0x29f0 [ 1761.527716][ T2844] __gup_longterm_locked+0xde4/0x1660 [ 1761.527752][ T2844] ? gup_fast_fallback+0x171/0x2290 [ 1761.527777][ T2844] ? sanity_check_pinned_pages+0x1241/0x1300 [ 1761.527811][ T2844] gup_fast_fallback+0x1d26/0x2290 [ 1761.527862][ T2844] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1761.527885][ T2844] ? rcu_is_watching+0x15/0xb0 [ 1761.527909][ T2844] ? is_valid_gup_args+0x11f/0x200 [ 1761.527934][ T2844] ? pin_user_pages_fast+0x4d/0xb0 [ 1761.527961][ T2844] rds_info_getsockopt+0x1fb/0x470 [ 1761.527993][ T2844] ? __pfx_rds_info_getsockopt+0x10/0x10 [ 1761.528021][ T2844] ? __might_fault+0xb0/0x130 [ 1761.528053][ T2844] ? rds_getsockopt+0x2c6/0x500 [ 1761.528072][ T2844] ? __pfx_rds_getsockopt+0x10/0x10 [ 1761.528094][ T2844] do_sock_getsockopt+0x2b4/0x3d0 [ 1761.528120][ T2844] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1761.528145][ T2844] ? ksys_write+0x1e1/0x250 [ 1761.528169][ T2844] __x64_sys_getsockopt+0x1a5/0x250 [ 1761.528199][ T2844] do_syscall_64+0xec/0xf80 [ 1761.528219][ T2844] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1761.528238][ T2844] ? trace_irq_disable+0x37/0x100 [ 1761.528263][ T2844] ? clear_bhb_loop+0x60/0xb0 [ 1761.528286][ T2844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1761.528304][ T2844] RIP: 0033:0x7f4c8598f749 [ 1761.528322][ T2844] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1761.528338][ T2844] RSP: 002b:00007f4c867d0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1761.528360][ T2844] RAX: ffffffffffffffda RBX: 00007f4c85be5fa0 RCX: 00007f4c8598f749 [ 1761.528376][ T2844] RDX: 0000000000002716 RSI: 0000200000000114 RDI: 0000000000000003 [ 1761.528389][ T2844] RBP: 00007f4c867d0090 R08: 0000200000000000 R09: 0000000000000000 [ 1761.528404][ T2844] R10: 0000200000c35fff R11: 0000000000000246 R12: 0000000000000002 [ 1761.528416][ T2844] R13: 00007f4c85be6038 R14: 00007f4c85be5fa0 R15: 00007f4c85d0fa28 [ 1761.528449][ T2844] [ 1762.045006][ T2855] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1762.198834][ T2863] netlink: 32 bytes leftover after parsing attributes in process `syz.6.7928'. [ 1762.418884][ T2875] netlink: 44 bytes leftover after parsing attributes in process `syz.8.7931'. [ 1762.757749][ T2814] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1762.759757][ T2895] tipc: Started in network mode [ 1762.759811][ T2895] tipc: Node identity 2e208c06fa5f, cluster identity 4711 [ 1762.759998][ T2895] tipc: Enabled bearer , priority 0 [ 1762.763355][ T2814] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1762.764598][T15878] dvb_usb_rtl28xxu 10-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1762.766679][T15878] usb 10-1: USB disconnect, device number 15 [ 1762.795071][ T2895] syzkaller0: entered promiscuous mode [ 1762.795095][ T2895] syzkaller0: entered allmulticast mode [ 1762.849991][ T2895] tipc: Resetting bearer [ 1762.865987][ T2894] tipc: Resetting bearer [ 1762.898519][ T2894] tipc: Disabling bearer [ 1763.055482][ T2907] tipc: Enabling of bearer rejected, failed to enable media [ 1763.076442][ T2909] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7941'. [ 1763.616361][ T2938] netlink: 'syz.9.7948': attribute type 10 has an invalid length. [ 1763.657024][ T2934] netlink: 4 bytes leftover after parsing attributes in process `syz.9.7948'. [ 1763.698984][ T2940] vlan0: entered promiscuous mode [ 1763.713085][ T2940] gretap0: entered promiscuous mode [ 1764.233568][T15878] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 1764.407805][T15878] usb 10-1: config 17 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1764.442564][T15878] usb 10-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1764.464380][T15878] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1764.485016][T15878] aiptek 10-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 1764.555855][ T2979] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1764.685566][ T2957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1764.726268][ T2957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1764.849896][ T3001] netlink: 28 bytes leftover after parsing attributes in process `syz.8.7967'. [ 1765.334589][ T57] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1765.553989][ T57] usb 4-1: Using ep0 maxpacket: 32 [ 1765.571000][ T57] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1765.604913][ T57] usb 4-1: config 0 has no interface number 0 [ 1765.658643][ T57] usb 4-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 1765.736671][ T57] usb 4-1: config 0 interface 1 has no altsetting 0 [ 1765.820320][ T57] usb 4-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 1765.872577][ T57] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1765.928668][ T57] usb 4-1: Product: syz [ 1765.950593][ T57] usb 4-1: Manufacturer: syz [ 1765.989205][ T57] usb 4-1: SerialNumber: syz [ 1766.054570][ T57] usb 4-1: config 0 descriptor?? [ 1766.480623][ T3016] : left allmulticast mode [ 1766.505503][ T3016] : left promiscuous mode [ 1766.535480][ T3016] bridge0: port 1() entered disabled state [ 1766.554030][ T3017] netlink: 4 bytes leftover after parsing attributes in process `syz.7.7975'. [ 1766.578532][ T3016] bridge_slave_1: left allmulticast mode [ 1766.591335][ T3016] bridge_slave_1: left promiscuous mode [ 1766.609053][ T3016] bridge0: port 2(bridge_slave_1) entered disabled state [ 1766.651511][ T3016] bond0: (slave bond_slave_0): Releasing backup interface [ 1766.674714][ T3016] bond_slave_0: left promiscuous mode [ 1766.725571][ T3016] bond0: (slave bond_slave_1): Releasing backup interface [ 1766.751984][ T3016] bond_slave_1: left promiscuous mode [ 1766.772132][ T3016] team_slave_0: left promiscuous mode [ 1766.805339][ T3016] team0: Port device team_slave_0 removed [ 1766.818674][ T3016] team_slave_1: left promiscuous mode [ 1766.842081][ T3016] team0: Port device team_slave_1 removed [ 1766.855436][ T3016] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1766.877999][ T3016] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1766.909605][ T3016] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1767.059461][T29765] usb 10-1: USB disconnect, device number 16 [ 1768.121199][ T30] audit: type=1326 audit(1767199910.577:4431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3038 comm="syz.9.7983" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3c56d8f749 code=0x0 [ 1768.583917][ T57] cx231xx 4-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 1768.626596][ T57] cx231xx 4-1:0.1: Not found matching IAD interface [ 1768.667766][ T57] usb 4-1: USB disconnect, device number 72 [ 1768.724711][ T3051] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1768.751107][ T3051] netlink: 28 bytes leftover after parsing attributes in process `syz.6.7987'. [ 1768.898394][ T3057] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7990'. [ 1769.425110][ T1586] usb 10-1: new full-speed USB device number 17 using dummy_hcd [ 1769.430359][ T3081] vlan0: entered promiscuous mode [ 1769.438027][ T3081] syz_tun: entered promiscuous mode [ 1769.594786][ T1586] usb 10-1: config 0 interface 0 altsetting 66 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1769.607734][ T1586] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1769.620177][ T1586] usb 10-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 1769.632002][ T1586] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1769.664522][ T1586] usb 10-1: config 0 descriptor?? [ 1769.865666][ T3097] tipc: Enabled bearer , priority 10 [ 1770.128674][ T1586] cypress 0003:04B4:0001.006B: hidraw0: USB HID v0.01 Device [HID 04b4:0001] on usb-dummy_hcd.9-1/input0 [ 1770.179490][ T57] hid-generic 0000:0000:0000.006C: unknown main item tag 0x0 [ 1770.222852][ T57] hid-generic 0000:0000:0000.006C: hidraw1: HID v0.00 Device [syz1] on syz0 [ 1771.326458][ T3132] netlink: 'syz.8.8020': attribute type 10 has an invalid length. [ 1771.775744][ T3144] tipc: Enabled bearer , priority 0 [ 1771.792066][ T3144] syzkaller0: entered promiscuous mode [ 1771.793189][ T57] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1771.805165][ T3144] syzkaller0: entered allmulticast mode [ 1771.872813][ T3144] tipc: Resetting bearer [ 1771.889260][ T3143] tipc: Resetting bearer [ 1771.934668][ T3143] tipc: Disabling bearer [ 1771.963198][ T57] usb 9-1: device descriptor read/64, error -71 [ 1772.091727][ T30] audit: type=1800 audit(1767199914.547:4432): pid=3065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.7994" name="bus" dev="ramfs" ino=198156 res=0 errno=0 [ 1772.152985][ T1586] IPVS: starting estimator thread 0... [ 1772.214743][ T57] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1772.219180][T29765] usb 10-1: USB disconnect, device number 17 [ 1772.253167][ T3151] IPVS: using max 37 ests per chain, 88800 per kthread [ 1772.363679][ T57] usb 9-1: device descriptor read/64, error -71 [ 1772.493605][ T57] usb usb9-port1: attempt power cycle [ 1772.832981][ T3170] nvme_fabrics: missing parameter 'transport=%s' [ 1772.850147][ T3170] nvme_fabrics: missing parameter 'nqn=%s' [ 1772.863213][ T57] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 1772.904650][ T57] usb 9-1: device descriptor read/8, error -71 [ 1772.933103][T29765] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1773.103228][T29765] usb 4-1: Using ep0 maxpacket: 16 [ 1773.114861][T29765] usb 4-1: config 0 has no interfaces? [ 1773.138800][T29765] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1773.171909][T29765] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1773.191647][ T57] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 1773.203131][T29765] usb 4-1: Manufacturer: syz [ 1773.233689][ T57] usb 9-1: device descriptor read/8, error -71 [ 1773.279075][T29765] usb 4-1: config 0 descriptor?? [ 1773.363572][ T57] usb usb9-port1: unable to enumerate USB device [ 1773.628643][ T3180] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1773.753628][ T3186] tipc: Enabled bearer , priority 0 [ 1773.786450][ T3186] syzkaller0: entered promiscuous mode [ 1773.791926][ T3186] syzkaller0: entered allmulticast mode [ 1773.885683][ T3186] tipc: Resetting bearer [ 1773.914367][ T3185] tipc: Resetting bearer [ 1773.998960][ T3185] tipc: Disabling bearer [ 1774.401027][ T3206] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1774.531871][ T30] audit: type=1326 audit(1767199916.987:4433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1774.728642][ T30] audit: type=1326 audit(1767199917.027:4434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1774.793991][ T30] audit: type=1326 audit(1767199917.027:4435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=81 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1774.848113][ T30] audit: type=1326 audit(1767199917.027:4436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1774.926820][ T30] audit: type=1326 audit(1767199917.027:4437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1774.962415][ T30] audit: type=1326 audit(1767199917.027:4438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1775.059753][ T30] audit: type=1326 audit(1767199917.027:4439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1775.140997][ T30] audit: type=1326 audit(1767199917.027:4440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1775.199857][ T3229] tipc: Enabled bearer , priority 0 [ 1775.210572][ T3229] syzkaller0: entered promiscuous mode [ 1775.216338][ T30] audit: type=1326 audit(1767199917.037:4441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1775.222255][ T3229] syzkaller0: entered allmulticast mode [ 1775.298939][ T30] audit: type=1326 audit(1767199917.037:4442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3207 comm="syz.9.8046" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3c56d8f749 code=0x7ffc0000 [ 1775.372239][ T3229] tipc: Resetting bearer [ 1775.403229][ T3227] tipc: Resetting bearer [ 1775.436193][ T3227] tipc: Disabling bearer [ 1775.485735][ T3236] syzkaller0: entered promiscuous mode [ 1775.492410][ T3236] syzkaller0: entered allmulticast mode [ 1775.557368][ T3236] netlink: 2060 bytes leftover after parsing attributes in process `syz.6.8057'. [ 1775.651235][ T3236] netlink: 2060 bytes leftover after parsing attributes in process `syz.6.8057'. [ 1775.716935][ T3240] netlink: 24 bytes leftover after parsing attributes in process `syz.8.8058'. [ 1776.133258][T15878] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 1776.159448][ T57] usb 4-1: USB disconnect, device number 73 [ 1776.293327][T15878] usb 9-1: Using ep0 maxpacket: 8 [ 1776.315236][T15878] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1776.362093][T15878] usb 9-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid maxpacket 2560, setting to 1024 [ 1776.420106][T15878] usb 9-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1776.470806][T15878] usb 9-1: config 8 interface 0 has no altsetting 0 [ 1776.598055][T15878] usb 9-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 1776.598083][T15878] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1776.598095][T15878] usb 9-1: Product: syz [ 1776.598103][T15878] usb 9-1: Manufacturer: syz [ 1776.598112][T15878] usb 9-1: SerialNumber: syz [ 1777.303596][ T3279] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(10) [ 1777.310225][ T3279] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1777.337875][ T3279] vhci_hcd vhci_hcd.0: Device attached [ 1777.357846][ T3280] vhci_hcd: connection closed [ 1777.358332][T11786] vhci_hcd vhci_hcd.3: stop threads [ 1777.383449][T11786] vhci_hcd vhci_hcd.3: release socket [ 1777.395336][T11786] vhci_hcd vhci_hcd.3: disconnect device [ 1778.181403][ T3292] [U]  [ 1778.184715][ T3292] [U] K{ [ 1778.191062][ T3292] [U] t 1ŠFfˊ`GJgo/mC [ 1778.214134][ T3292] [U] tؖ/,~Ĝj}8'o1"7-JQKWq5c%"H12YX``+(!(z'tXlnIgjݭp~7!" (5Ob̓J [ 1778.233430][ T3292] [U] k\&}66XHX .`a$40|϶9ި U4Vbz}wMTQΦr 4 [ 1778.257742][ T3292] [U] ".h6"k[J4In[Z(C|T]z{3c=x4w)\TXJSH{q;칢t+gd.˂>ywUhfNhl]S2\g%O&z)'pul_< ذ`ұT;_"(u{7j2X /'cIHcճV=Ai%wEs RjgrhIa6-DV i"n Asc~48c*OO5/J~wvK+3Y)Mvyq潀DTrOtpem%fejA5T_-X~^aaۂq [ 1778.336496][ T3292] [U] +wG?]'a: )' B>tf/<'U'hi.+]e.-ɿ%>2`^U8F.63+A«g3p6:^0tv'EtYCnrϩnPj ;Z8!\Aʖ2$­wi.#/Bai`4jdy@zgW5˿B ٜNy"vI2 [ 1778.380160][ T3292] [U] T_K5tYJ9c$brLNul 9w|G"ʃ%C؝q 3qN^HP*$ .7yӱ2 [ 1778.393860][ T3292] [U] ? h*37鍾^#Q"0~ (oX Lb,'v=CSGS0ւ`ه=1(p#2DO*Ƀ [ 1778.428958][ T3292] [U] sgGud-{|&2Lc_!`oz֥B%>rwSsH"yA4O.Y䏄RTԶB[+/< [ 1785.486107][ T3450] dump_stack_lvl+0xe8/0x150 [ 1785.486138][ T3450] should_fail_ex+0x414/0x560 [ 1785.486170][ T3450] _copy_to_user+0x31/0xb0 [ 1785.486202][ T3450] simple_read_from_buffer+0xe1/0x170 [ 1785.486231][ T3450] proc_fail_nth_read+0x1b3/0x220 [ 1785.486256][ T3450] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1785.486276][ T3450] ? rw_verify_area+0x2a6/0x4d0 [ 1785.486293][ T3450] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1785.486314][ T3450] vfs_read+0x200/0xa30 [ 1785.486331][ T3450] ? fdget_pos+0x247/0x320 [ 1785.486360][ T3450] ? __pfx___mutex_lock+0x10/0x10 [ 1785.486381][ T3450] ? __pfx_vfs_read+0x10/0x10 [ 1785.486401][ T3450] ? __fget_files+0x2a/0x420 [ 1785.486430][ T3450] ? __fget_files+0x3a0/0x420 [ 1785.486453][ T3450] ? __fget_files+0x2a/0x420 [ 1785.486486][ T3450] ksys_read+0x145/0x250 [ 1785.486507][ T3450] ? __pfx_ksys_read+0x10/0x10 [ 1785.486537][ T3450] do_syscall_64+0xec/0xf80 [ 1785.486558][ T3450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1785.486577][ T3450] ? trace_irq_disable+0x37/0x100 [ 1785.486604][ T3450] ? clear_bhb_loop+0x60/0xb0 [ 1785.486628][ T3450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1785.486648][ T3450] RIP: 0033:0x7f4c8598e15c [ 1785.486666][ T3450] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1785.486684][ T3450] RSP: 002b:00007f4c867d0030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1785.486706][ T3450] RAX: ffffffffffffffda RBX: 00007f4c85be5fa0 RCX: 00007f4c8598e15c [ 1785.486722][ T3450] RDX: 000000000000000f RSI: 00007f4c867d00a0 RDI: 0000000000000004 [ 1785.486735][ T3450] RBP: 00007f4c867d0090 R08: 0000000000000000 R09: 0000000000000000 [ 1785.486748][ T3450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1785.486761][ T3450] R13: 00007f4c85be6038 R14: 00007f4c85be5fa0 R15: 00007f4c85d0fa28 [ 1785.486792][ T3450] [ 1785.830722][ T3455] netlink: 'syz.8.8134': attribute type 1 has an invalid length. [ 1785.953529][ T3458] bond1: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1785.966146][ T3458] bond1: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 1786.006072][ T3458] bond1: (slave ipvlan0): Setting fail_over_mac to active for active-backup mode [ 1786.019034][ T3465] Cannot find add_set index 0 as target [ 1786.079247][ T3463] hsr0: entered promiscuous mode [ 1786.084809][ T3463] A link change request failed with some changes committed already. Interface hsr0 may have been left with an inconsistent configuration, please check. [ 1786.300864][ T3479] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 1786.477832][ T3487] vlan0: entered promiscuous mode [ 1786.483507][ T3488] netlink: 'syz.8.8146': attribute type 1 has an invalid length. [ 1786.491402][ T3488] netlink: 8 bytes leftover after parsing attributes in process `syz.8.8146'. [ 1786.669750][ T3496] tipc: Cannot configure node identity twice [ 1786.802784][ T3499] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8152'. [ 1786.819042][ T3500] netlink: 40 bytes leftover after parsing attributes in process `syz.7.8153'. [ 1786.842129][ T3502] netlink: 408 bytes leftover after parsing attributes in process `syz.9.8151'. [ 1787.347218][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 1787.347236][ T30] audit: type=1326 audit(1767199929.807:4444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3525 comm="syz.9.8161" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3c56d8f749 code=0x0 [ 1787.601077][ T39] IPVS: starting estimator thread 0... [ 1787.693578][ T3541] IPVS: using max 33 ests per chain, 79200 per kthread [ 1787.893429][ T39] usb 9-1: new full-speed USB device number 27 using dummy_hcd [ 1787.960663][ T3549] fuse: Bad value for 'fd' [ 1788.069537][ T39] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1788.116579][ T39] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14660, setting to 64 [ 1788.224499][ T39] usb 9-1: New USB device found, idVendor=04b4, idProduct=de64, bcdDevice= 0.00 [ 1788.278433][ T39] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1788.333549][ T39] usb 9-1: config 0 descriptor?? [ 1788.358533][ T3540] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1788.573179][T29765] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 1788.753454][T29765] usb 10-1: Using ep0 maxpacket: 32 [ 1788.770322][T29765] usb 10-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1788.781975][T29765] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1788.795977][ T39] cypress 0003:04B4:DE64.006E: item fetching failed at offset 0/3 [ 1788.801498][T29765] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 28739, setting to 1024 [ 1788.814213][ T39] cypress 0003:04B4:DE64.006E: parse failed [ 1788.835458][ T39] cypress 0003:04B4:DE64.006E: probe with driver cypress failed with error -22 [ 1788.835904][T29765] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1788.904552][T29765] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 1788.917179][T29765] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 1788.927666][T29765] usb 10-1: config 0 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1788.946415][T29765] usb 10-1: New USB device found, idVendor=2040, idProduct=4901, bcdDevice=47.77 [ 1788.957395][T29765] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1788.965756][T29765] usb 10-1: Product: syz [ 1788.974264][T29765] usb 10-1: Manufacturer: syz [ 1788.982343][T29765] usb 10-1: SerialNumber: syz [ 1789.001019][T29765] usb 10-1: config 0 descriptor?? [ 1789.011124][ T3555] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 1789.073920][T15878] usb 9-1: USB disconnect, device number 27 [ 1789.240300][ T3555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1789.279923][ T3555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1789.887548][T29765] hdpvr 10-1:0.0: unexpected answer of status request, len -71 [ 1789.942891][T29765] hdpvr 10-1:0.0: device init failed [ 1789.977449][T29765] hdpvr 10-1:0.0: probe with driver hdpvr failed with error -12 [ 1790.085114][T29765] usb 10-1: USB disconnect, device number 23 [ 1790.207126][ T3594] netlink: 32 bytes leftover after parsing attributes in process `syz.8.8181'. [ 1790.390771][ T3600] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1791.458624][ T3622] netlink: 'syz.9.8188': attribute type 1 has an invalid length. [ 1791.556942][ T3626] netlink: 'syz.8.8190': attribute type 4 has an invalid length. [ 1791.577250][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1791.585784][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1791.618358][ T3627] netlink: 'syz.8.8190': attribute type 4 has an invalid length. [ 1792.706100][ T3651] netlink: 20 bytes leftover after parsing attributes in process `syz.8.8199'. [ 1792.720047][ T3651] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1792.814068][ T3654] vlan0: entered promiscuous mode [ 1792.820096][ T3654] syz_tun: entered promiscuous mode [ 1792.973238][T29765] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 1793.134927][T29765] usb 9-1: Using ep0 maxpacket: 8 [ 1793.181453][T29765] usb 9-1: New USB device found, idVendor=0471, idProduct=0313, bcdDevice=81.d5 [ 1793.197248][T29765] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1793.205705][T29765] usb 9-1: Product: syz [ 1793.210992][T29765] usb 9-1: Manufacturer: syz [ 1793.220004][T29765] usb 9-1: SerialNumber: syz [ 1793.236165][T29765] usb 9-1: config 0 descriptor?? [ 1793.280897][ T3663] tipc: Enabling of bearer rejected, already enabled [ 1793.288926][T29765] pwc: Philips PCVC720K/40 (ToUCam XS) USB webcam detected. [ 1793.554034][T29765] pwc: send_video_command error -71 [ 1793.564218][T29765] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1793.605801][T29765] Philips webcam 9-1:0.0: probe with driver Philips webcam failed with error -71 [ 1793.640019][T29765] usb 9-1: USB disconnect, device number 28 [ 1794.323709][ T3691] tipc: Enabled bearer , priority 0 [ 1794.346083][ T3691] syzkaller0: entered promiscuous mode [ 1794.365689][ T3691] syzkaller0: entered allmulticast mode [ 1794.394890][ T3691] tipc: Resetting bearer [ 1794.404239][ T3690] tipc: Resetting bearer [ 1794.444933][ T3690] tipc: Disabling bearer [ 1794.661695][T29765] hid-generic 0000:0003:0001.006F: unknown main item tag 0x0 [ 1794.669807][T29765] hid-generic 0000:0003:0001.006F: unknown main item tag 0x0 [ 1794.708566][T29765] hid-generic 0000:0003:0001.006F: hidraw0: HID v0.03 Device [syz0] on syz1 [ 1794.739590][ T3710] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8220'. [ 1794.828120][ T3709] fido_id[3709]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1794.865934][T31128] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1795.007319][ T3716] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8225'. [ 1795.036956][T31128] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 90, changing to 10 [ 1795.046425][ T3721] delete_channel: no stack [ 1795.063354][T31128] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1795.084337][T31128] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1795.107470][T31128] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1795.137994][T31128] usb 4-1: config 0 descriptor?? [ 1795.586933][T31128] cp2112 0003:10C4:EA90.0070: unknown main item tag 0x0 [ 1795.613331][T31128] cp2112 0003:10C4:EA90.0070: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 1795.784300][T31128] cp2112 0003:10C4:EA90.0070: Part Number: 0x82 Device Version: 0xFE [ 1795.979049][ T3742] xfrm0: entered promiscuous mode [ 1796.145593][ T3746] netlink: 'syz.9.8236': attribute type 10 has an invalid length. [ 1796.170775][ T3746] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1796.196372][ T3746] team0: Port device bond0 added [ 1796.353991][T29765] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 1796.389385][ T3706] cp2112 0003:10C4:EA90.0070: Error starting transaction: -38 [ 1796.389436][T31128] cp2112 0003:10C4:EA90.0070: error reading lock byte: -32 [ 1796.449422][T31128] usb 4-1: USB disconnect, device number 74 [ 1796.515619][T29765] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1796.558508][T29765] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1796.581107][T29765] usb 9-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1796.623488][T29765] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1796.650860][T29765] usb 9-1: Manufacturer: syz [ 1796.661523][T29765] usb 9-1: config 0 descriptor?? [ 1796.674479][ T3761] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1796.699932][ T3761] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8242'. [ 1796.746634][ T3763] tipc: Enabled bearer , priority 0 [ 1796.754935][ T3763] syzkaller0: entered promiscuous mode [ 1796.760417][ T3763] syzkaller0: entered allmulticast mode [ 1796.774506][ T3763] tipc: Resetting bearer [ 1796.781904][ T3762] tipc: Resetting bearer [ 1796.807144][ T3762] tipc: Disabling bearer [ 1797.074517][T29765] pyra 0003:1E7D:2CF6.0071: unknown main item tag 0x0 [ 1797.081372][T29765] pyra 0003:1E7D:2CF6.0071: unknown main item tag 0x0 [ 1797.088553][T29765] pyra 0003:1E7D:2CF6.0071: unknown main item tag 0x0 [ 1797.096016][T29765] pyra 0003:1E7D:2CF6.0071: unknown main item tag 0x0 [ 1797.102819][T29765] pyra 0003:1E7D:2CF6.0071: unknown main item tag 0x0 [ 1797.110472][T29765] pyra 0003:1E7D:2CF6.0071: unknown main item tag 0x0 [ 1797.118688][T29765] pyra 0003:1E7D:2CF6.0071: unknown main item tag 0x0 [ 1797.147035][T29765] pyra 0003:1E7D:2CF6.0071: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 1797.496797][ T3782] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 1797.630149][ T3786] netlink: 212368 bytes leftover after parsing attributes in process `syz.9.8251'. [ 1797.689726][T29765] pyra 0003:1E7D:2CF6.0071: couldn't init struct pyra_device [ 1797.713012][T29765] pyra 0003:1E7D:2CF6.0071: couldn't install mouse [ 1797.731109][T29765] pyra 0003:1E7D:2CF6.0071: probe with driver pyra failed with error -71 [ 1797.760346][T29765] usb 9-1: USB disconnect, device number 29 [ 1797.856780][ T3790] fido_id[3790]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 1798.860711][ T3824] FAULT_INJECTION: forcing a failure. [ 1798.860711][ T3824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1798.909207][ T3824] CPU: 1 UID: 0 PID: 3824 Comm: syz.8.8263 Tainted: G L syzkaller #0 PREEMPT(full) [ 1798.909242][ T3824] Tainted: [L]=SOFTLOCKUP [ 1798.909250][ T3824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1798.909262][ T3824] Call Trace: [ 1798.909271][ T3824] [ 1798.909280][ T3824] dump_stack_lvl+0xe8/0x150 [ 1798.909311][ T3824] should_fail_ex+0x414/0x560 [ 1798.909346][ T3824] _copy_from_iter+0x1cd/0x1630 [ 1798.909369][ T3824] ? n_hdlc_tty_write+0x186/0x910 [ 1798.909397][ T3824] ? __pfx__copy_from_iter+0x10/0x10 [ 1798.909435][ T3824] file_tty_write+0x4c1/0xa20 [ 1798.909470][ T3824] vfs_write+0x5c9/0xb30 [ 1798.909492][ T3824] ? __pfx_tty_write+0x10/0x10 [ 1798.909517][ T3824] ? __pfx_vfs_write+0x10/0x10 [ 1798.909541][ T3824] ? __fget_files+0x2a/0x420 [ 1798.909569][ T3824] ksys_write+0x145/0x250 [ 1798.909588][ T3824] ? __pfx_ksys_write+0x10/0x10 [ 1798.909613][ T3824] do_syscall_64+0xec/0xf80 [ 1798.909631][ T3824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1798.909647][ T3824] ? trace_irq_disable+0x37/0x100 [ 1798.909668][ T3824] ? clear_bhb_loop+0x60/0xb0 [ 1798.909688][ T3824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1798.909704][ T3824] RIP: 0033:0x7f4c8598f749 [ 1798.909720][ T3824] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1798.909734][ T3824] RSP: 002b:00007f4c8678e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1798.909752][ T3824] RAX: ffffffffffffffda RBX: 00007f4c85be6180 RCX: 00007f4c8598f749 [ 1798.909765][ T3824] RDX: 00000000fffffdef RSI: 0000200000001040 RDI: 0000000000000007 [ 1798.909777][ T3824] RBP: 00007f4c8678e090 R08: 0000000000000000 R09: 0000000000000000 [ 1798.909787][ T3824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1798.909797][ T3824] R13: 00007f4c85be6218 R14: 00007f4c85be6180 R15: 00007f4c85d0fa28 [ 1798.909824][ T3824] [ 1799.246621][ T1586] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 1799.383188][ T1586] usb 10-1: device descriptor read/64, error -71 [ 1799.633287][ T1586] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 1799.793399][ T1586] usb 10-1: device descriptor read/64, error -71 [ 1799.923761][ T1586] usb usb10-port1: attempt power cycle [ 1799.944779][ T3837] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8268'. [ 1800.273594][ T1586] usb 10-1: new high-speed USB device number 26 using dummy_hcd [ 1800.304295][ T1586] usb 10-1: device descriptor read/8, error -71 [ 1800.334104][ T39] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 1800.495304][ T39] usb 9-1: Using ep0 maxpacket: 8 [ 1800.505043][ T39] usb 9-1: config 2 has an invalid interface number: 31 but max is 0 [ 1800.516246][ T3857] mac80211_hwsim hwsim73 wlan0: entered promiscuous mode [ 1800.525210][ T39] usb 9-1: config 2 has an invalid descriptor of length 110, skipping remainder of the config [ 1800.537347][ T3857] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8277'. [ 1800.553219][ T1586] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 1800.563265][ T39] usb 9-1: config 2 has no interface number 0 [ 1800.569379][ T39] usb 9-1: config 2 interface 31 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1800.582755][ T3857] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1800.599479][ T1586] usb 10-1: device descriptor read/8, error -71 [ 1800.606265][ T39] usb 9-1: config 2 interface 31 has no altsetting 0 [ 1800.634806][ T39] usb 9-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 1800.646328][ T39] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1800.654640][ T39] usb 9-1: Product: syz [ 1800.658826][ T39] usb 9-1: Manufacturer: syz [ 1800.666498][ T39] usb 9-1: SerialNumber: syz [ 1800.683819][ T39] ch9200 9-1:2.31: probe with driver ch9200 failed with error -22 [ 1800.713447][ T1586] usb usb10-port1: unable to enumerate USB device [ 1800.949959][ T3869] program syz.3.8282 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1801.018415][ T3871] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1802.242604][ T3895] netlink: 'syz.9.8289': attribute type 4 has an invalid length. [ 1802.262270][ T3895] netlink: 'syz.9.8289': attribute type 4 has an invalid length. [ 1802.538859][ T3901] FAULT_INJECTION: forcing a failure. [ 1802.538859][ T3901] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1802.552492][ T3901] CPU: 1 UID: 0 PID: 3901 Comm: syz.3.8293 Tainted: G L syzkaller #0 PREEMPT(full) [ 1802.552523][ T3901] Tainted: [L]=SOFTLOCKUP [ 1802.552532][ T3901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1802.552543][ T3901] Call Trace: [ 1802.552552][ T3901] [ 1802.552560][ T3901] dump_stack_lvl+0xe8/0x150 [ 1802.552589][ T3901] should_fail_ex+0x414/0x560 [ 1802.552623][ T3901] copy_fpstate_to_sigframe+0xa70/0xcc0 [ 1802.552656][ T3901] ? copy_fpstate_to_sigframe+0x181/0xcc0 [ 1802.552690][ T3901] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 1802.552725][ T3901] ? ktime_get+0x45/0x200 [ 1802.552755][ T3901] ? ktime_get+0x45/0x200 [ 1802.552782][ T3901] ? seqcount_lockdep_reader_access+0xd4/0x100 [ 1802.552811][ T3901] ? read_tsc+0x9/0x20 [ 1802.552836][ T3901] ? ktime_get+0x1d2/0x200 [ 1802.552866][ T3901] ? fpu__alloc_mathframe+0xad/0x130 [ 1802.552895][ T3901] get_sigframe+0x58d/0x7d0 [ 1802.552926][ T3901] ? __pfx_get_sigframe+0x10/0x10 [ 1802.552958][ T3901] ? posixtimer_deliver_signal+0x305/0x410 [ 1802.552984][ T3901] x64_setup_rt_frame+0x15b/0xd40 [ 1802.553020][ T3901] ? _raw_spin_unlock_irq+0x23/0x50 [ 1802.553047][ T3901] ? lockdep_hardirqs_on+0x7b/0x110 [ 1802.553065][ T3901] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1802.553088][ T3901] ? get_signal+0x1150/0x1340 [ 1802.553113][ T3901] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1802.553146][ T3901] arch_do_signal_or_restart+0x3d1/0x7a0 [ 1802.553174][ T3901] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1802.553209][ T3901] ? __x64_sys_pread64+0x16b/0x220 [ 1802.553238][ T3901] exit_to_user_mode_loop+0x87/0x4e0 [ 1802.553259][ T3901] ? rcu_is_watching+0x15/0xb0 [ 1802.553286][ T3901] do_syscall_64+0x2b7/0xf80 [ 1802.553306][ T3901] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1802.553326][ T3901] ? clear_bhb_loop+0x60/0xb0 [ 1802.553349][ T3901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1802.553367][ T3901] RIP: 0033:0x7f404738f749 [ 1802.553384][ T3901] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1802.553401][ T3901] RSP: 002b:00007f404825f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 1802.553422][ T3901] RAX: fffffffffffffff7 RBX: 00007f40475e5fa0 RCX: 00007f404738f749 [ 1802.553437][ T3901] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffffff [ 1802.553451][ T3901] RBP: 00007f404825f090 R08: 0000000000000000 R09: 0000000000000000 [ 1802.553464][ T3901] R10: 0000000000000df8 R11: 0000000000000246 R12: 0000000000000001 [ 1802.553483][ T3901] R13: 00007f40475e6038 R14: 00007f40475e5fa0 R15: 00007f404770fa28 [ 1802.553514][ T3901] [ 1803.087036][ T39] usb 9-1: USB disconnect, device number 30 [ 1803.632268][ T3928] Cannot find add_set index 0 as target [ 1803.844899][ T3934] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8307'. [ 1804.017338][ T3941] tipc: Enabled bearer , priority 0 [ 1804.035938][ T3941] syzkaller0: entered promiscuous mode [ 1804.050867][ T3941] syzkaller0: entered allmulticast mode [ 1804.084825][ T3939] tipc: Resetting bearer [ 1804.101127][ T3949] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8314'. [ 1804.156226][ T3939] tipc: Disabling bearer [ 1804.679203][ T3973] netlink: 24 bytes leftover after parsing attributes in process `syz.7.8322'. [ 1805.027785][ T3995] netlink: 48 bytes leftover after parsing attributes in process `syz.3.8330'. [ 1805.059944][ T3995] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8330'. [ 1805.445822][ T4005] tipc: Enabling of bearer rejected, failed to enable media [ 1805.475122][T15878] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 1805.643325][T15878] usb 9-1: Using ep0 maxpacket: 32 [ 1805.669155][T15878] usb 9-1: config 0 has an invalid interface number: 119 but max is 0 [ 1805.678121][T15878] usb 9-1: config 0 has no interface number 0 [ 1805.690242][T15878] usb 9-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1805.712692][T15878] usb 9-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1805.726278][T15878] usb 9-1: config 0 interface 119 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1805.768426][T15878] usb 9-1: config 0 interface 119 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1805.803960][T15878] usb 9-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1805.846497][T15878] usb 9-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 1805.864992][T15878] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1805.880230][T15878] usb 9-1: Product: syz [ 1805.892333][T15878] usb 9-1: Manufacturer: syz [ 1805.902926][T15878] usb 9-1: SerialNumber: syz [ 1805.911814][T15878] usb 9-1: config 0 descriptor?? [ 1805.919072][ T4001] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 1805.940247][T15878] input: bcm5974 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.119/input/input79 [ 1806.105291][ T4020] fuse: Bad value for 'fd' [ 1806.138545][ T4028] can: request_module (can-proto-0) failed. [ 1806.325603][ T39] usb 9-1: USB disconnect, device number 31 [ 1806.457023][ T4041] netlink: 48 bytes leftover after parsing attributes in process `syz.3.8349'. [ 1806.714274][ T4049] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8353'. [ 1806.979393][ T4053] vlan0: entered promiscuous mode [ 1806.994538][ T4053] team0: entered promiscuous mode [ 1807.006042][ T4053] batadv1: entered promiscuous mode [ 1807.019417][ T4053] batadv2: entered promiscuous mode [ 1807.055833][ T4047] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8352'. [ 1807.358911][ T4068] netlink: 'syz.8.8359': attribute type 4 has an invalid length. [ 1807.379106][ T4068] netlink: 'syz.8.8359': attribute type 4 has an invalid length. [ 1807.514753][ T4074] No such timeout policy "syz0" [ 1807.643229][T15878] usb 10-1: new high-speed USB device number 28 using dummy_hcd [ 1807.783122][T15878] usb 10-1: device descriptor read/64, error -71 [ 1807.963142][T18541] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1808.023174][T15878] usb 10-1: new high-speed USB device number 29 using dummy_hcd [ 1808.126541][T18541] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 90, changing to 10 [ 1808.162809][T18541] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1808.176547][T15878] usb 10-1: device descriptor read/64, error -71 [ 1808.193535][T18541] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1808.217368][T18541] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1808.238492][T18541] usb 4-1: config 0 descriptor?? [ 1808.313771][T15878] usb usb10-port1: attempt power cycle [ 1808.668495][T15878] usb 10-1: new high-speed USB device number 30 using dummy_hcd [ 1808.732689][T15878] usb 10-1: device descriptor read/8, error -71 [ 1808.750147][T18541] cp2112 0003:10C4:EA90.0072: unknown main item tag 0x0 [ 1808.770351][T18541] cp2112 0003:10C4:EA90.0072: item fetching failed at offset 3/7 [ 1808.808627][T18541] cp2112 0003:10C4:EA90.0072: parse failed [ 1808.830927][T18541] cp2112 0003:10C4:EA90.0072: probe with driver cp2112 failed with error -22 [ 1808.993142][T15878] usb 10-1: new high-speed USB device number 31 using dummy_hcd [ 1809.035666][T15878] usb 10-1: device descriptor read/8, error -71 [ 1809.153424][T15878] usb usb10-port1: unable to enumerate USB device [ 1810.183119][ T1586] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 1810.333167][ T1586] usb 9-1: Using ep0 maxpacket: 32 [ 1810.340682][ T1586] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 102, changing to 10 [ 1810.365796][ T1586] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24624, setting to 1024 [ 1810.396400][ T1586] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1810.432697][ T1586] usb 9-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 1810.455004][ T1586] usb 9-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 1810.464424][ T1586] usb 9-1: Product: syz [ 1810.468720][ T1586] usb 9-1: Manufacturer: syz [ 1810.473837][ T1586] usb 9-1: SerialNumber: syz [ 1810.492633][ T1586] input: appletouch as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/input/input80 [ 1810.705216][ T1586] usb 9-1: USB disconnect, device number 32 [ 1810.736787][ T1586] appletouch 9-1:1.0: input: appletouch disconnected [ 1811.184119][T15878] usb 4-1: USB disconnect, device number 75 [ 1811.288005][ T4140] tipc: Enabled bearer , priority 0 [ 1811.297562][ T4140] syzkaller0: entered promiscuous mode [ 1811.327289][ T4140] syzkaller0: entered allmulticast mode [ 1811.351064][ T4140] tipc: Resetting bearer [ 1811.366771][ T4139] tipc: Resetting bearer [ 1811.422530][ T4139] tipc: Disabling bearer [ 1811.535970][ T4149] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8386'. [ 1811.573228][ T4149] netlink: 348 bytes leftover after parsing attributes in process `syz.8.8386'. [ 1811.582291][ T4149] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8386'. [ 1811.589637][ T4153] netlink: 'syz.8.8386': attribute type 9 has an invalid length. [ 1811.601434][ T4153] netlink: 'syz.8.8386': attribute type 11 has an invalid length. [ 1811.613096][ T4153] netlink: 'syz.8.8386': attribute type 12 has an invalid length. [ 1811.623102][ T4149] netlink: 348 bytes leftover after parsing attributes in process `syz.8.8386'. [ 1811.628866][ T4153] netlink: 210020 bytes leftover after parsing attributes in process `syz.8.8386'. [ 1811.632205][ T4149] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8386'. [ 1811.692605][ T4153] netlink: 4 bytes leftover after parsing attributes in process `syz.8.8386'. [ 1811.886347][ T4160] fuse: Unknown parameter 'user_id00000000000000000000' [ 1811.993007][ T4162] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1812.018905][ T4162] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1812.227958][ T4172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1812.256840][ T4172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1812.355407][T15878] usb 10-1: new high-speed USB device number 32 using dummy_hcd [ 1812.473608][ T39] usb 9-1: new full-speed USB device number 33 using dummy_hcd [ 1812.515216][T15878] usb 10-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1812.537251][T15878] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1812.557218][T15878] usb 10-1: too many endpoints for config 1 interface 0 altsetting 0: 36, using maximum allowed: 30 [ 1812.568623][T15878] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 36 [ 1812.597449][T15878] usb 10-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1812.618608][T15878] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1812.635698][ T39] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1812.643126][T15878] usb 10-1: SerialNumber: syz [ 1812.646103][ T39] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 1812.666113][ T39] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 1812.677285][T18541] usb 4-1: new full-speed USB device number 76 using dummy_hcd [ 1812.685153][ T39] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 65535, setting to 64 [ 1812.700712][ T39] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 1812.713756][ T39] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1812.726510][ T39] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1812.742584][ T39] usb 9-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 1812.752218][ T39] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1812.760574][ T39] usb 9-1: Product: syz [ 1812.765484][ T39] usb 9-1: Manufacturer: syz [ 1812.770199][ T39] usb 9-1: SerialNumber: syz [ 1812.779592][ T39] usb 9-1: config 0 descriptor?? [ 1812.786755][ T4170] raw-gadget.4 gadget.8: fail, usb_ep_enable returned -22 [ 1812.797684][ T39] ati_remote 9-1:0.0: Initializing ati_remote hardware failed. [ 1812.808420][ T39] ati_remote 9-1:0.0: probe with driver ati_remote failed with error -5 [ 1812.844889][T18541] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 1812.880899][T18541] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1812.893131][T18541] usb 4-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 1812.904719][T18541] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1812.927383][T18541] usb 4-1: config 0 descriptor?? [ 1812.937980][ T4180] raw-gadget.6 gadget.3: fail, usb_ep_enable returned -22 [ 1812.995884][ T39] usb 9-1: USB disconnect, device number 33 [ 1813.434844][T18541] samsung 0003:0419:0600.0073: hidraw0: USB HID v0.04 Device [HID 0419:0600] on usb-dummy_hcd.3-1/input0 [ 1813.565401][ T4192] fuse: Unknown parameter 'user_id00000000000000000000' [ 1813.632391][ T1586] usb 4-1: USB disconnect, device number 76 [ 1814.431608][ T4226] hsr0: entered allmulticast mode [ 1814.436918][ T4226] hsr_slave_0: entered allmulticast mode [ 1814.442623][ T4226] hsr_slave_1: entered allmulticast mode [ 1815.379302][T15878] usb 10-1: USB disconnect, device number 32 [ 1815.396533][ T4239] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8414'. [ 1815.671057][ T4248] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1815.700433][ T4251] netlink: 'syz.8.8420': attribute type 10 has an invalid length. [ 1815.704171][ T4248] netlink: 28 bytes leftover after parsing attributes in process `syz.9.8419'. [ 1815.765063][ T4251] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1815.912486][ T4257] batman_adv: batadv0: Adding interface: ip6gretap2 [ 1815.922588][ T4257] batman_adv: batadv0: The MTU of interface ip6gretap2 is too small (1434) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 1815.954673][ T4257] batman_adv: batadv0: Interface activated: ip6gretap2 [ 1816.087111][ T4270] netlink: 'syz.8.8423': attribute type 4 has an invalid length. [ 1816.113880][ T4271] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8426'. [ 1816.127711][ T4270] netlink: 'syz.8.8423': attribute type 4 has an invalid length. [ 1816.931878][ T4292] __nla_validate_parse: 1 callbacks suppressed [ 1816.931892][ T4292] netlink: 28 bytes leftover after parsing attributes in process `syz.9.8435'. [ 1817.159035][ T4301] netlink: 32 bytes leftover after parsing attributes in process `syz.6.8438'. [ 1817.371631][ T4307] tipc: Enabled bearer , priority 0 [ 1817.394686][ T4307] syzkaller0: entered promiscuous mode [ 1817.400509][ T4307] syzkaller0: entered allmulticast mode [ 1817.451062][ T4307] tipc: Resetting bearer [ 1817.463012][ T4306] tipc: Resetting bearer [ 1817.494560][ T4306] tipc: Disabling bearer [ 1817.762588][ T4318] tipc: Enabling of bearer rejected, already enabled [ 1817.940733][ T4322] FAULT_INJECTION: forcing a failure. [ 1817.940733][ T4322] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1817.969081][ T4322] CPU: 0 UID: 0 PID: 4322 Comm: syz.9.8447 Tainted: G L syzkaller #0 PREEMPT(full) [ 1817.969113][ T4322] Tainted: [L]=SOFTLOCKUP [ 1817.969121][ T4322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1817.969133][ T4322] Call Trace: [ 1817.969141][ T4322] [ 1817.969146][ T4322] dump_stack_lvl+0xe8/0x150 [ 1817.969164][ T4322] should_fail_ex+0x414/0x560 [ 1817.969183][ T4322] _copy_to_user+0x31/0xb0 [ 1817.969198][ T4322] copy_siginfo_to_user+0x22/0xc0 [ 1817.969211][ T4322] x64_setup_rt_frame+0x776/0xd40 [ 1817.969236][ T4322] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1817.969255][ T4322] arch_do_signal_or_restart+0x3d1/0x7a0 [ 1817.969272][ T4322] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1817.969290][ T4322] ? ksys_write+0x22a/0x250 [ 1817.969304][ T4322] exit_to_user_mode_loop+0x87/0x4e0 [ 1817.969316][ T4322] ? rcu_is_watching+0x15/0xb0 [ 1817.969330][ T4322] do_syscall_64+0x2b7/0xf80 [ 1817.969342][ T4322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1817.969352][ T4322] ? clear_bhb_loop+0x60/0xb0 [ 1817.969364][ T4322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1817.969373][ T4322] RIP: 0033:0x7f3c56d8e1ff [ 1817.969384][ T4322] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1817.969393][ T4322] RSP: 002b:00007f3c57c05030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1817.969406][ T4322] RAX: 0000000000000001 RBX: 0000000000000004 RCX: 00007f3c56d8e1ff [ 1817.969414][ T4322] RDX: 0000000000000001 RSI: 00007f3c57c05090 RDI: 0000000000000004 [ 1817.969420][ T4322] RBP: 00007f3c57c05090 R08: 0000000000000000 R09: 00007f3c57c04df7 [ 1817.969427][ T4322] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 1817.969434][ T4322] R13: 00007f3c56fe6038 R14: 00007f3c56fe5fa0 R15: 00007f3c5710fa28 [ 1817.969449][ T4322] [ 1818.667036][ T4336] program syz.3.8453 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1818.813852][ T4346] tipc: Enabled bearer , priority 0 [ 1818.822230][ T4346] syzkaller0: entered promiscuous mode [ 1818.828478][ T4346] syzkaller0: entered allmulticast mode [ 1818.880093][ T4346] tipc: Resetting bearer [ 1818.904583][ T4344] tipc: Resetting bearer [ 1818.982322][ T4344] tipc: Disabling bearer [ 1819.193413][T15878] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1819.246536][ T4368] netlink: 16 bytes leftover after parsing attributes in process `syz.7.8466'. [ 1819.268736][ T4368] netlink: 16 bytes leftover after parsing attributes in process `syz.7.8466'. [ 1819.293878][ T4368] netlink: 20 bytes leftover after parsing attributes in process `syz.7.8466'. [ 1819.324020][ T4373] netlink: 28 bytes leftover after parsing attributes in process `syz.6.8468'. [ 1819.363557][T29765] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 1819.393168][T15878] usb 4-1: Using ep0 maxpacket: 32 [ 1819.404918][T15878] usb 4-1: config 0 has an invalid interface number: 101 but max is 0 [ 1819.414386][T15878] usb 4-1: config 0 has no interface number 0 [ 1819.420537][T15878] usb 4-1: too many endpoints for config 0 interface 101 altsetting 244: 52, using maximum allowed: 30 [ 1819.432830][T15878] usb 4-1: config 0 interface 101 altsetting 244 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 1819.452890][T15878] usb 4-1: config 0 interface 101 has no altsetting 0 [ 1819.465379][T15878] usb 4-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 1819.485591][T15878] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1819.499230][T15878] usb 4-1: config 0 descriptor?? [ 1819.536879][T29765] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1819.548835][T29765] usb 9-1: config 0 has no interface number 0 [ 1819.561150][T29765] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1819.575044][T29765] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1819.596157][T29765] usb 9-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1819.616954][T29765] usb 9-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 1819.639512][T29765] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1819.661417][T29765] usb 9-1: config 0 descriptor?? [ 1819.790538][ T4354] [ 1819.792881][ T4354] ====================================================== [ 1819.799883][ T4354] WARNING: possible circular locking dependency detected [ 1819.806950][ T4354] syzkaller #0 Tainted: G L [ 1819.812929][ T4354] ------------------------------------------------------ [ 1819.819943][ T4354] syz.3.8458/4354 is trying to acquire lock: [ 1819.826055][ T4354] ffff888089f58420 (sb_writers#3){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 1819.834797][ T4354] [ 1819.834797][ T4354] but task is already holding lock: [ 1819.842161][ T4354] ffff8880683c40a8 (&ctx->uring_lock){+.+.}-{4:4}, at: __se_sys_io_uring_enter+0x2d5/0x2b60 [ 1819.852275][ T4354] [ 1819.852275][ T4354] which lock already depends on the new lock. [ 1819.852275][ T4354] [ 1819.862676][ T4354] [ 1819.862676][ T4354] the existing dependency chain (in reverse order) is: [ 1819.871691][ T4354] [ 1819.871691][ T4354] -> #2 (&ctx->uring_lock){+.+.}-{4:4}: [ 1819.879438][ T4354] __mutex_lock+0x187/0x1350 [ 1819.884560][ T4354] io_uring_del_tctx_node+0xf0/0x2c0 [ 1819.890382][ T4354] io_uring_clean_tctx+0xd4/0x1a0 [ 1819.895941][ T4354] io_uring_cancel_generic+0x6ca/0x7d0 [ 1819.901935][ T4354] begin_new_exec+0x10ed/0x2440 [ 1819.907318][ T4354] load_elf_binary+0x9f8/0x2d70 [ 1819.912701][ T4354] bprm_execve+0x92e/0x1400 [ 1819.917722][ T4354] do_execveat_common+0x510/0x6a0 [ 1819.923270][ T4354] __x64_sys_execveat+0xc4/0xe0 [ 1819.928640][ T4354] do_syscall_64+0xec/0xf80 [ 1819.933665][ T4354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1819.940081][ T4354] [ 1819.940081][ T4354] -> #1 (&sig->cred_guard_mutex){+.+.}-{4:4}: [ 1819.948343][ T4354] __mutex_lock+0x187/0x1350 [ 1819.953458][ T4354] proc_pid_attr_write+0x547/0x630 [ 1819.959092][ T4354] vfs_write+0x27e/0xb30 [ 1819.963911][ T4354] ksys_write+0x145/0x250 [ 1819.968759][ T4354] do_syscall_64+0xec/0xf80 [ 1819.973792][ T4354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1819.980210][ T4354] [ 1819.980210][ T4354] -> #0 (sb_writers#3){.+.+}-{0:0}: [ 1819.987618][ T4354] __lock_acquire+0x15a6/0x2cf0 [ 1819.992992][ T4354] lock_acquire+0x107/0x340 [ 1819.998026][ T4354] sb_start_write+0x4d/0x1c0 [ 1820.003154][ T4354] mnt_want_write+0x41/0x90 [ 1820.008189][ T4354] path_openat+0xadd/0x3dd0 [ 1820.013225][ T4354] do_filp_open+0x1fa/0x410 [ 1820.018249][ T4354] io_openat2+0x3e0/0x5c0 [ 1820.023102][ T4354] __io_issue_sqe+0x181/0x4b0 [ 1820.028308][ T4354] io_issue_sqe+0x165/0x1060 [ 1820.033423][ T4354] io_submit_sqes+0xbf4/0x2140 [ 1820.038720][ T4354] __se_sys_io_uring_enter+0x2e0/0x2b60 [ 1820.044808][ T4354] do_syscall_64+0xec/0xf80 [ 1820.049849][ T4354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1820.056265][ T4354] [ 1820.056265][ T4354] other info that might help us debug this: [ 1820.056265][ T4354] [ 1820.066477][ T4354] Chain exists of: [ 1820.066477][ T4354] sb_writers#3 --> &sig->cred_guard_mutex --> &ctx->uring_lock [ 1820.066477][ T4354] [ 1820.080041][ T4354] Possible unsafe locking scenario: [ 1820.080041][ T4354] [ 1820.087480][ T4354] CPU0 CPU1 [ 1820.092832][ T4354] ---- ---- [ 1820.098182][ T4354] lock(&ctx->uring_lock); [ 1820.102674][ T4354] lock(&sig->cred_guard_mutex); [ 1820.110196][ T4354] lock(&ctx->uring_lock); [ 1820.117205][ T4354] rlock(sb_writers#3); [ 1820.121437][ T4354] [ 1820.121437][ T4354] *** DEADLOCK *** [ 1820.121437][ T4354] [ 1820.129557][ T4354] 1 lock held by syz.3.8458/4354: [ 1820.134558][ T4354] #0: ffff8880683c40a8 (&ctx->uring_lock){+.+.}-{4:4}, at: __se_sys_io_uring_enter+0x2d5/0x2b60 [ 1820.145064][ T4354] [ 1820.145064][ T4354] stack backtrace: [ 1820.150935][ T4354] CPU: 0 UID: 0 PID: 4354 Comm: syz.3.8458 Tainted: G L syzkaller #0 PREEMPT(full) [ 1820.150952][ T4354] Tainted: [L]=SOFTLOCKUP [ 1820.150956][ T4354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1820.150963][ T4354] Call Trace: [ 1820.150969][ T4354] [ 1820.150975][ T4354] dump_stack_lvl+0xe8/0x150 [ 1820.150991][ T4354] print_circular_bug+0x2e2/0x300 [ 1820.151006][ T4354] check_noncircular+0x12e/0x150 [ 1820.151020][ T4354] __lock_acquire+0x15a6/0x2cf0 [ 1820.151032][ T4354] ? do_raw_spin_lock+0x121/0x290 [ 1820.151048][ T4354] ? mnt_want_write+0x41/0x90 [ 1820.151064][ T4354] lock_acquire+0x107/0x340 [ 1820.151073][ T4354] ? mnt_want_write+0x41/0x90 [ 1820.151090][ T4354] sb_start_write+0x4d/0x1c0 [ 1820.151105][ T4354] ? mnt_want_write+0x41/0x90 [ 1820.151119][ T4354] mnt_want_write+0x41/0x90 [ 1820.151134][ T4354] path_openat+0xadd/0x3dd0 [ 1820.151146][ T4354] ? __kernel_text_address+0xd/0x40 [ 1820.151161][ T4354] ? arch_stack_walk+0xfc/0x150 [ 1820.151175][ T4354] ? __pfx_path_openat+0x10/0x10 [ 1820.151185][ T4354] ? __lock_acquire+0x6b6/0x2cf0 [ 1820.151197][ T4354] do_filp_open+0x1fa/0x410 [ 1820.151206][ T4354] ? __pfx_do_filp_open+0x10/0x10 [ 1820.151220][ T4354] ? _raw_spin_unlock+0x28/0x50 [ 1820.151235][ T4354] ? alloc_fd+0x64c/0x6c0 [ 1820.151248][ T4354] io_openat2+0x3e0/0x5c0 [ 1820.151260][ T4354] ? __pfx_io_openat2+0x10/0x10 [ 1820.151269][ T4354] ? getname_flags+0x1e5/0x540 [ 1820.151283][ T4354] __io_issue_sqe+0x181/0x4b0 [ 1820.151296][ T4354] io_issue_sqe+0x165/0x1060 [ 1820.151310][ T4354] io_submit_sqes+0xbf4/0x2140 [ 1820.151328][ T4354] __se_sys_io_uring_enter+0x2e0/0x2b60 [ 1820.151344][ T4354] ? debug_object_free+0x2b2/0x400 [ 1820.151360][ T4354] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1820.151372][ T4354] ? do_futex+0x333/0x420 [ 1820.151384][ T4354] ? __pfx_do_futex+0x10/0x10 [ 1820.151396][ T4354] ? __se_sys_futex+0x36f/0x400 [ 1820.151408][ T4354] ? rcu_is_watching+0x15/0xb0 [ 1820.151422][ T4354] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1820.151435][ T4354] do_syscall_64+0xec/0xf80 [ 1820.151445][ T4354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1820.151455][ T4354] ? trace_irq_disable+0x37/0x100 [ 1820.151468][ T4354] ? clear_bhb_loop+0x60/0xb0 [ 1820.151480][ T4354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1820.151495][ T4354] RIP: 0033:0x7f404738f749 [ 1820.151511][ T4354] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1820.151520][ T4354] RSP: 002b:00007f4048231038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1820.151532][ T4354] RAX: ffffffffffffffda RBX: 00007f40475e6090 RCX: 00007f404738f749 [ 1820.151540][ T4354] RDX: 0000000000000000 RSI: 0000000000005cae RDI: 0000000000000004 [ 1820.151547][ T4354] RBP: 00007f4047413f91 R08: 0000000000000000 R09: 0000000000000000 [ 1820.151554][ T4354] R10: 0000000000000024 R11: 0000000000000246 R12: 0000000000000000 [ 1820.151561][ T4354] R13: 00007f40475e6128 R14: 00007f40475e6090 R15: 00007f404770fa28 [ 1820.151576][ T4354] [ 1820.516274][ T4390] tipc: Enabled bearer , priority 0 [ 1820.524024][ T4390] syzkaller0: entered promiscuous mode [ 1820.529573][ T4390] syzkaller0: entered allmulticast mode [ 1820.550961][ T4390] tipc: Resetting bearer [ 1820.558027][ T4388] tipc: Resetting bearer [ 1820.569160][ T4388] tipc: Disabling bearer [ 1820.603179][T18541] usb 10-1: new high-speed USB device number 33 using dummy_hcd [ 1820.773268][T18541] usb 10-1: Using ep0 maxpacket: 16 [ 1820.779845][T18541] usb 10-1: config 0 has no interfaces? [ 1820.786423][T18541] usb 10-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1820.795845][T18541] usb 10-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1820.804717][T18541] usb 10-1: Manufacturer: syz [ 1820.811351][T18541] usb 10-1: config 0 descriptor?? [ 1820.889216][T29765] uclogic 0003:28BD:0042.0074: failed retrieving string descriptor #100: -71 [ 1820.898860][T29765] uclogic 0003:28BD:0042.0074: failed retrieving pen parameters: -71 [ 1820.907026][T29765] uclogic 0003:28BD:0042.0074: pen probing failed: -71 [ 1820.914128][T29765] uclogic 0003:28BD:0042.0074: failed probing parameters: -71 [ 1820.921721][T29765] uclogic 0003:28BD:0042.0074: probe with driver uclogic failed with error -71 [ 1820.945609][T29765] usb 9-1: USB disconnect, device number 34 [ 1821.831290][T15878] usb 4-1: string descriptor 0 read error: -71 [ 1821.842094][T15878] gspca_main: sunplus-2.14.0 probing 041e:400b [ 1821.849245][T15878] gspca_sunplus: reg_w_riv err -71 [ 1821.863553][T15878] sunplus 4-1:0.101: probe with driver sunplus failed with error -71 [ 1821.873902][T15878] usb 4-1: USB disconnect, device number 77 [ 1822.278307][T15878] usb 10-1: USB disconnect, device number 33