last executing test programs: 16m34.852444294s ago: executing program 0 (id=1486): syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000068e04d206f0e2c586831010203010902240001000000000904000002ff47d000090509e702008000040905", @ANYBLOB="b707"], 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x21) ioctl$KVM_CAP_DISABLE_QUIRKS2(r0, 0x4068aea3, &(0x7f0000000000)={0xd5, 0x0, 0x32}) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f00000001c0)={{0x0, 0x4, 0x1a, 0x2, 0x40, 0xfb, 0x7, 0xd4, 0x0, 0x4, 0x7, 0x2}, {0xffff1000, 0x2, 0xd, 0xb, 0x8, 0x40, 0x6, 0x8, 0x5, 0xf, 0x3, 0xcc}, {0xeeee0000, 0xdddd1000, 0x4, 0x8, 0x2, 0x7, 0x4, 0x1, 0x8c, 0x9, 0x6, 0x5}, {0xeeef0000, 0x3000, 0xd, 0xf, 0x43, 0x46, 0x2, 0xd, 0x46, 0x3, 0xfc, 0x1}, {0x100000, 0x58000, 0x3, 0x3f, 0x3, 0x9, 0x9, 0x7, 0x5, 0x4, 0x1e, 0x4b}, {0x2, 0xd000, 0x9, 0x7, 0x4, 0x6f, 0x1, 0xfb, 0x4, 0x80, 0x1, 0xfc}, {0x8080000, 0x2000, 0xc, 0x9d, 0x3, 0x0, 0x1, 0xb, 0x1, 0x7, 0x0, 0x6}, {0xffff1000, 0x8000000, 0xd, 0x5, 0x3, 0x3, 0x6, 0x9, 0x54, 0x6, 0x2, 0x7}, {0x100000, 0x5}, {0xdddd1000, 0x5}, 0x40010000, 0x0, 0xf000, 0x300, 0x7, 0x0, 0x9000, [0x4, 0x402, 0x8, 0x1]}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) syz_usb_connect$cdc_ncm(0x4, 0x92, &(0x7f00000010c0)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x80, 0x2, 0x1, 0x9, 0x60, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "ebe06d0b07"}, {0x5, 0x24, 0x0, 0x8dc}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x0, 0x4, 0x9}, {0x6, 0x24, 0x1a, 0x3199, 0x20}, [@dmm={0x7, 0x24, 0x14, 0x9, 0x9}, @mbim_extended={0x8, 0x24, 0x1c, 0x4, 0x5, 0x1ff}, @obex={0x5, 0x24, 0x15, 0x9}, @network_terminal={0x7, 0x24, 0xa, 0x5, 0x1, 0x4}, @acm={0x4, 0x24, 0x2, 0x8}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x6d, 0x19, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x1, 0x9, 0x34}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0xff, 0x8c, 0xe5}}}}}}}]}}, &(0x7f0000001300)={0xa, &(0x7f0000001180)={0xa, 0x6, 0x201, 0xc, 0xff, 0xca, 0x20, 0x7}, 0xc, &(0x7f00000011c0)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x6, 0x1, 0x6, 0x3}]}, 0x1, [{0xc4, &(0x7f0000001200)=ANY=[@ANYBLOB="c4035228db874e2bdca13f5fd438e5f0cbd2e1787a09e0aa1836ce11816513d5591fb54e3decf3cdb392ee763aa80d15132e270e838eaea721f4b6cd015dc8c72cacf8cc3d71162f4741fbac94f317ad1714d773079aa2ab5ec28dafa22ef4b7c606e556ab5e11b48829989dac617dbbd6d7110a26f8294733a3d87b4c708de869615df6e3445cccce373150f2286d5b8617d92be58cd52ed561511fa74f341884479fff4db5516f9a840b5e98e50a9eb768b6f17f61406005cf2d72bc25c32d86e8"]}]}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe, 0x0, &(0x7f0000000540)="00000000000000008a7e84d67aa8", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) r4 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r4, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) fchmodat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x12) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f00003c9000/0x4000)=nil, &(0x7f0000678000/0x3000)=nil, 0x3, 0x0, 0x0, 0x403, 0x0, 0x10, 0x0, 0xde}) close(0x3) syz_usb_connect$uac1(0x6, 0xb9, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8215, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa7, 0x3, 0x1, 0x4, 0x20, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x9, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x6, 0x8, 0x1002}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x8, 0x4, 0xba, 0x3, "5ad299", "1a"}, @as_header={0x7, 0x24, 0x1, 0xfa, 0x25, 0x1}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x80, 0x3, 0x4, 0x55}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x9, 0xa0e5, 0x1, "c97f8944bb00b0c8"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x7, 0x6, 0x4e, 0x20}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x1d, 0x11, 0x5, {0x7, 0x25, 0x1, 0x8, 0xd, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x5, 0x4, 0x1, 0x0, "9d"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0xff, 0x5, 0x4, {0x7, 0x25, 0x1, 0x8, 0x8, 0x4}}}}}}}}]}}, &(0x7f00000002c0)={0x0, 0x0, 0x19, &(0x7f0000000180)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x2, "b69ca08173a263cf2ecd76c5505416a9"}]}, 0x4, [{0x0, 0x0}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0xc07}}, {0x28, &(0x7f0000000240)=@string={0x28, 0x3, "ae42b0120c3a66d7654384e6012eadc3b9c8f47fe49b8ba0d52efd07f2b79a3fe4ebb0ee0e4a"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x416}}]}) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) 16m31.756740199s ago: executing program 0 (id=1500): sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, 0x2, 0x1, 0x401, 0x0, 0x0, {0x1, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a090400fffffff5000000020000000900010073797a30000020000900020073797a320000000048000480440001800c0001007061796c6f61640034000280080004400000000008000840000000010800024000000002080005400000000f0800034000000000080006"], 0x9c}}, 0x0) 16m31.526429217s ago: executing program 0 (id=1501): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) preadv(r2, &(0x7f0000000580)=[{&(0x7f0000000380)=""/239, 0xef}], 0x1, 0x3ff, 0x7) ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000200)=@fd={0x23e65978, 0x1, 0x4, 0x4, 0x1, {}, {0x3, 0x10, 0x20, 0x10, 0x2e, 0x4, "a4e2221c"}, 0xa}) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0105500, &(0x7f0000000140)={0x80, 0x6, 0x102, 0xfffd, 0x0, 0x245, 0x0}) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)={0x70, r1, 0x30d, 0x0, 0x0, {}, [@TIPC_NLA_MEDIA={0x5c}]}, 0x70}}, 0x0) r3 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r3, &(0x7f0000000280)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r5, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @sint={0x0, 0x8}}]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f00000002c0)={0x0, 0x1}) socket$netlink(0x10, 0x3, 0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x40000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x152610}], 0x1, 0x0, 0x64}, 0x1f00) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r8 = io_uring_setup(0x801c6c, &(0x7f0000000040)={0x0, 0xaebb, 0x1000, 0x20000b, 0x1c7, 0x0, r2}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x10, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xfff2}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r9 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000300)={'\x00', 0x3, 0xfffffff7, 0x92c, 0x3, 0x3}) io_uring_enter(r8, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 16m31.005630845s ago: executing program 0 (id=1504): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000000000)='./file0\x00', 0x8, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) inotify_init1(0x800) (async) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) (async) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0xc0096616, &(0x7f0000000100)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x20000, 0x0) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x6c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0xfffffffffffffda4, 0x12, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x11}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb4}, 0x1, 0x0, 0x0, 0x20004010}, 0x20050800) 16m30.69835461s ago: executing program 0 (id=1507): sendmsg$RDMA_NLDEV_CMD_RES_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x9f9ec54af98ce9ae}, 0x40840) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f00000000c0)={0x0, 0x115000}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000080), 0x2, 0x0) sendfile(r3, r3, &(0x7f0000000040)=0x8, 0xc) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x1f, 0x2, 0x2}, 0x51) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r7 = syz_open_procfs$namespace(0x0, &(0x7f00000002c0)='ns/net\x00') sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="ed4d0000ef00000000003100000008000300", @ANYRES32=r6, @ANYBLOB="0800db00", @ANYRES32=r7, @ANYBLOB="37d4a11df563710ce8b5d6122d90ef484550f1657eb33eae5b755637503bafcdd0f5f9b2efe1b7d74435b0aa9c19602ed8a53212204ab65597dcb7"], 0x24}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r8 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0xb, 0xc4}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0208000004"], 0x48) io_uring_enter(r8, 0x2219, 0x7721, 0x16, 0x0, 0x0) 16m30.413465565s ago: executing program 0 (id=1512): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000000)=0x64, 0x4) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x8}, 0x1c) sendmmsg$inet6(r0, &(0x7f00000027c0)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, 0x0}, 0x1100}], 0x2, 0x8020) 16m29.990878441s ago: executing program 32 (id=1512): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000000)=0x64, 0x4) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x8}, 0x1c) sendmmsg$inet6(r0, &(0x7f00000027c0)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, 0x0}, 0x1100}], 0x2, 0x8020) 20.527324329s ago: executing program 3 (id=6030): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000540)={&(0x7f00000003c0)=@delsa={0x164, 0x11, 0x300, 0x70bd29, 0x25dfdbff, {@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d3, 0x2, 0x2b}, [@user_kmaddress={0x2c, 0x13, {@in6=@private1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0xa}}, @algo_auth={0x10f, 0x1, {{'blake2s-224\x00'}, 0x638, "f2b9e3ca0608291485d592e4ba558aa92406a8b49dc27db5406125b854250c48348b43cbd5f055750bdda8a68bdad48862e4f7ebee47d58525090aa881528d82f5c71a89d7f5059ff9a3f163251a72be028b99983f264efa903064caae20bd5fd80434aa5768e32a2912d7c12abed3accb0bf964c90f945cfb01f75f69dd1bceac09e61ec56b0bb03291b17e8a9d9d77cadaae4770281fafc4cd919fc6e225d979ee8a929744cd0e3d3af14b699dca2a4c2eca45aa6fd6a92d7f5f78cedd72188482e47d6022ea"}}]}, 0x164}, 0x1, 0x0, 0x0, 0x2000c040}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsopen(0x0, 0x0) r5 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_FILTER(r5, 0x403c6f2b, &(0x7f0000000040)={0x1, {"40a568bf607c2094e9c6a0c0f550f7f8", "241e6a0b37e28869f574458eb6417d55", "a34d3bcc4817356e5c266b26fe399bde"}, 0x7, 0x4}) socket$xdp(0x2c, 0x3, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f00000001c0)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x4}, 0x1c, 0x0}, 0x4048043) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone(0x1100000, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) getsockopt$bt_hci(r0, 0x0, 0x3, 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000100000000000000020000000000000004d55cba711c55303b6c8c0e9d52aab"], 0x24, 0x0) mkdir(&(0x7f0000000040)='./bus\x00', 0x0) setxattr$system_posix_acl(&(0x7f00000001c0)='./bus\x00', &(0x7f00000002c0)='system.posix_acl_access\x00', 0x0, 0x0, 0x3) rmdir(&(0x7f0000000280)='./bus\x00') setsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x0, 0x33}, 0x2, @in6=@loopback, 0x0, 0x0, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) setsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x12}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd}, 0x5, 0x0, 0x1, 0x0, 0x3, 0x2}, {{@in=@rand_addr=0x64010102, 0x200001, 0x6c}, 0x1c, @in6=@loopback, 0x0, 0x0, 0x0, 0xb7}}, 0xe8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) 18.465068401s ago: executing program 3 (id=6042): timer_create(0xfffffffd, 0x0, &(0x7f0000000040)=0x0) timer_settime(r0, 0x0, &(0x7f00000001c0)={{}, {0x0, 0x9}}, 0x0) syz_open_dev$loop(0x0, 0x2, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000006940)="bd5b42b1cdd8978ab9a6d751175588136f1bc7ae56c467f380f0f67d5454ec17c8f3d0e6a97c24e2fc0a63148fcc2e01b340fa770ff4c6bf501d4267ce19ea5522b18bbbcc62a95117e731cfea5eea75c42f3e86283d8372fc886ebcfef5e5cbb42f40808e0e909b967a13b4c3c64db4b04e", 0x72}, {&(0x7f00000001c0)="4888", 0x2}, {&(0x7f0000000440)="88325d41f049e68258482f5176c31ed01a3259a4d2521ad145d66456f5eb3d0d555d25fdad6ba33fa1dbd0444e2a921d0facce2dbbbda19b66389d09fd1f7689f599faf15ebe76a6f98a1cf9bf2575b81c49683f141da2d1b6ebc5c54cae792f11525f0b257b78c90de0d8c88a88820ad8a0", 0x72}], 0x3) landlock_restrict_self(0xffffffffffffffff, 0xa) r2 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@bridge_newneigh={0x34, 0x1c, 0x401, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r5, 0x40, 0x4c, 0x6}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}, @NDA_FDB_EXT_ATTRS={0xc, 0xe, 0x0, 0x1, [@NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x3}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x44801}, 0x840) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) writev(r2, &(0x7f0000000700)=[{&(0x7f0000000300)="aefdf79d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76632cb010852f426072a", 0x2a}], 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r6 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xe5d8, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) socket$alg(0x26, 0x5, 0x0) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_usb_connect$uac1(0x4, 0xa2, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000206b1d01014000010203010902900003010000000904000000010100000a240100000002010211240600000500000000000000000000000b24070000000009040101010102000009050109000000008007250100000000090402000001020000090402010101020000072401000003000e2402030e000000f5138d22419e09058209400d610ca3301092147d5a6ea83aabc80339e15c11b9b36f048f4028024918ca88d88539d3f54fd044bda3aae22e60902db30966fae2a4146e5cfa9ca7fba5c6a14f3920b8a0eaea5ef95e7e9207083e1799a62d88c209844ad7e87e6585ecbaf76193fb9554cfee6cd7936cce9f34bb8318b86113fbe1cce697300d34965076f389f1c2152abf234d1e6981c08ce57c9588e04ab2c765d950795825df3242053d7923d39d7920b1dc7139b5ed60cb8a16cec20ed2ec3dd24dbe91277bd7d2c5ee3d47543841d3e41d412e7edad2cb605795f7a3f3ac2b2dad3e", @ANYRES64=0x0, @ANYRESDEC, @ANYRES64], 0x0) 17.805460451s ago: executing program 3 (id=6045): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) r1 = syz_usb_connect$cdc_ncm(0x4, 0x0, 0x0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x5f, &(0x7f0000000840)=ANY=[@ANYRES32=r0]}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000022"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000640)=ANY=[@ANYBLOB="201104060000000101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15.928956261s ago: executing program 3 (id=6051): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read$FUSE(r2, &(0x7f0000002100)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000a80)={0x5a8, 0x0, r3, [{{0x2, 0x3, 0x4, 0xfffffffffffffff7, 0x5, 0x8, {0x2, 0xbeb2, 0x2, 0x0, 0x8000000000000001, 0x1, 0x4, 0x200, 0x6, 0xa000, 0x1, r4, r5, 0x0, 0x9}}, {0x3, 0x5, 0x10, 0x2, ' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, {{0x1, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x9, {0x3, 0xd6f4, 0xfffffffffffffff8, 0x3, 0x8000000000000000, 0xbe, 0x5, 0x7ff, 0x100, 0x1000, 0x8, 0x0, 0x0, 0xe, 0x40}}, {0x6, 0x7, 0x9, 0x7, '/dev/kvm\x00'}}, {{0x0, 0x2, 0x6, 0x8000000000000001, 0x80000001, 0x1, {0x3, 0x4, 0xb, 0x8, 0x4, 0x1, 0x6f9, 0xfffffffc, 0x7, 0x1000, 0x5, 0x0, 0x0, 0x8000, 0x3}}, {0x3, 0x2, 0xa, 0x6, '/dev/cuse\x00'}}, {{0x5, 0x1, 0x8000000000000001, 0x85, 0x2, 0x795, {0x0, 0x7, 0x7fff, 0x7, 0x1000, 0x4aa, 0x1, 0x0, 0x8, 0x8000, 0x4, 0x0, 0x0, 0x7, 0x6}}, {0x1, 0x7, 0x99, 0x10001, '\x04ootmode\x8e\x12\x05\xf3\x81}\xa0\xeb`\xbf\xb2T\xf1\xad\xa1\a y\x8b,+\xa2w\xad\xb8&.\xe5>\xd7\x88\xcd\xd8p\xc4F\xa9\x1e{\xf4\x8c\x94\x89\xa3\xa4\xaf\xf0Ng]\x9c\xdc*\xe2G\xa6yV\xd6\xa5\x80O\xa9]`U\xd9\x9b\x95\x8a\xa7Z\xb4\xf1xQ(\x9cy\x9a\xeb\xe7\x1a\x9b\x0e\xf7M\xa0\x0eP\x9aS\x0e7\x90z)o\xceV\x80)^\xef@\xb6\x8c\x17IK\xa1\xb0\x0e:R\x01\x03_\x87\bJj\xd3\x9f\x80\x13\xfadj\x053\x1e\x91r\xaa\b_\x04\xd7\xc1!\xb4\xc5\xe5h'}}, {{0x0, 0x2, 0x8, 0x1, 0x4, 0x5, {0x1, 0x7, 0x5, 0xf46b, 0x6, 0x5, 0xc4, 0x5, 0xc9a7, 0xc000, 0x51, 0xee01, 0x0, 0xa32, 0x101}}, {0x0, 0x9, 0x4, 0xf6, ')+@)'}}, {{0x5, 0x1, 0x6, 0x93, 0xe, 0x9, {0x0, 0x4, 0x0, 0x2, 0x3, 0xffffffffffffffff, 0x1, 0x7f, 0x5, 0xa000, 0x4, r4, 0x0, 0x3ff, 0x9}}, {0x4, 0x1, 0x0, 0x6}}, {{0x0, 0x1, 0xfffffffffffffffd, 0x0, 0x9, 0x2, {0x6, 0xb, 0x8, 0x8000000000000001, 0x100000000, 0xffffffffffffffff, 0x7f, 0x6, 0x5, 0xa000, 0x0, 0x0, r5, 0x400, 0x7fffffff}}, {0x5, 0x2}}, {{0x5, 0x0, 0x8, 0x3, 0x825, 0x7, {0x3, 0xe1c, 0xff, 0x3, 0x0, 0x6, 0x40, 0x8, 0xfffffff8, 0xa000, 0x9, 0x0, 0x0, 0x10001, 0x7}}, {0x6, 0xc, 0x0, 0xb4}}]}, 0x5a8) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000001300310327bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="85660200a32004001400030064756d6d7930000000000000000000005c001a800800028004000180500002804c00018008000300010000000800130003000000080016008100000008001d0004000000080021000300000005"], 0x98}}, 0x20040850) 14.862413633s ago: executing program 3 (id=6054): write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES16, @ANYRES8, @ANYBLOB="a0ff2a428aa15ab9c2"], 0xffdd) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000140)=0x4) io_pgetevents(0x0, 0x7, 0x0, 0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000140)={[0x4]}, 0x8}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc040, 0x8, 0xc1}) r1 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000000)=0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f000000e000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000845000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000507000/0x2000)=nil, &(0x7f000000e000/0x4000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x1632, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000040)={0xf0f046}) r4 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x2100) ioctl$DRM_IOCTL_MODE_GET_LEASE(r5, 0xc01064c8, &(0x7f0000000140)={0x1, 0x0, &(0x7f0000000100)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_SETPROPERTY(r5, 0xc01864ba, &(0x7f0000000180)={0x3, 0x0, r6}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f00000003c0)={&(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0], 0x8, 0x0, 0xb0b0b0b0}) ioctl$DRM_IOCTL_MODE_ATOMIC(r4, 0xc03864bc, &(0x7f0000000480)={0x300, 0x1, &(0x7f0000000240)=[r6], &(0x7f0000000280)=[0xfffffffa, 0x80000000, 0xfffffffe, 0x2, 0x8, 0x2, 0x5, 0x75a, 0x3], &(0x7f0000000400)=[r7], &(0x7f0000000440)=[0x89, 0x80000001, 0x64b, 0x7, 0x5, 0x7fffffff, 0x1], 0x0, 0x7}) sendto$inet(0xffffffffffffffff, &(0x7f0000000100)='5', 0x1, 0x8080, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x2, 0x0, 0x0, 0xd7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) 14.549285407s ago: executing program 3 (id=6056): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) r2 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x103000) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f00000001c0)={"f2efe21e", 0x4000, 0x6, 0x4d, 0xffffffff, 0x1ff, "2179d46fd08e3c0ced34c7d0c7e6d7", "7ca24a13", '\x00', "a2d1d4a2", ['\x00', "bed0f3d6ce7a5f7389827f04", "33af343c60abc64f2fdc9ddf", "9b3842fc63849f62b6eb1c3c"]}) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000140)={0xf871, 0x4, 0x5, 0x3, 0xfe1c, 0x737, "32a0a977db08bbabc15000", 0x10, 0x2, 0x3, 0x3, 0x17, 0x3, 0x1}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0x6}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x0, 0x1, 0x3, 0x2}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc891}, 0x40020) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000200)={0x0, 0x16, 0x1, "16"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14.036886653s ago: executing program 33 (id=6056): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) r2 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x103000) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f00000001c0)={"f2efe21e", 0x4000, 0x6, 0x4d, 0xffffffff, 0x1ff, "2179d46fd08e3c0ced34c7d0c7e6d7", "7ca24a13", '\x00', "a2d1d4a2", ['\x00', "bed0f3d6ce7a5f7389827f04", "33af343c60abc64f2fdc9ddf", "9b3842fc63849f62b6eb1c3c"]}) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000140)={0xf871, 0x4, 0x5, 0x3, 0xfe1c, 0x737, "32a0a977db08bbabc15000", 0x10, 0x2, 0x3, 0x3, 0x17, 0x3, 0x1}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0x6}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x0, 0x1, 0x3, 0x2}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc891}, 0x40020) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000680)={0x84, &(0x7f0000000200)={0x0, 0x16, 0x1, "16"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 9.606571156s ago: executing program 5 (id=6074): timer_create(0xfffffffd, 0x0, &(0x7f0000000040)=0x0) timer_settime(r0, 0x0, &(0x7f00000001c0)={{}, {0x0, 0x9}}, 0x0) syz_open_dev$loop(0x0, 0x2, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000006940)="bd5b42b1cdd8978ab9a6d751175588136f1bc7ae56c467f380f0f67d5454ec17c8f3d0e6a97c24e2fc0a63148fcc2e01b340fa770ff4c6bf501d4267ce19ea5522b18bbbcc62a95117e731cfea5eea75c42f3e86283d8372fc886ebcfef5e5cbb42f40808e0e909b967a13b4c3c64db4b04e", 0x72}, {&(0x7f00000001c0)="4888", 0x2}, {&(0x7f0000000440)="88325d41f049e68258482f5176c31ed01a3259a4d2521ad145d66456f5eb3d0d555d25fdad6ba33fa1dbd0444e2a921d0facce2dbbbda19b66389d09fd1f7689f599faf15ebe76a6f98a1cf9bf2575b81c49683f141da2d1b6ebc5c54cae792f11525f0b257b78c90de0d8c88a88820ad8a0", 0x72}], 0x3) landlock_restrict_self(0xffffffffffffffff, 0xa) r2 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) writev(r2, &(0x7f0000000700)=[{&(0x7f0000000300)="aefdf79d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76632cb010852f426072a", 0x2a}], 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xe5d8, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x700) syz_usb_connect$uac1(0x4, 0xa2, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000206b1d01014000010203010902900003010000000904000000010100000a240100000002010211240600000500000000000000000000000b24070000000009040101010102000009050109000000008007250100000000090402000001020000090402010101020000072401000003000e2402030e000000f5138d22419e09058209400d610ca3301092147d5a6ea83aabc80339e15c11b9b36f048f4028024918ca88d88539d3f54fd044bda3aae22e60902db30966fae2a4146e5cfa9ca7fba5c6a14f3920b8a0eaea5ef95e7e9207083e1799a62d88c209844ad7e87e6585ecbaf76193fb9554cfee6cd7936cce9f34bb8318b86113fbe1cce697300d34965076f389f1c2152abf234d1e6981c08ce57c9588e04ab2c765d950795825df3242053d7923d39d7920b1dc7139b5ed60cb8a16cec20ed2ec3dd24dbe91277bd7d2c5ee3d47543841d3e41d412e7edad2cb605795f7a3f3ac2b2dad3e", @ANYRES64=0x0, @ANYRESDEC, @ANYRES64], 0x0) 8.789398258s ago: executing program 2 (id=6078): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c010000130001000000000000000000fc0100000000000000000000000000f1ffffffff0000000000000000000000000000000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000000000000000200000000000000000000000000ffffffffffffffff00000000000000000900000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000084000500ff020000000000000000000000000001000004d52b00000002000000ffffffff000000000000000000000000053500000400040004000000ff07000009000000fc010000000000000000000000000001000004d23c00000002000000ff0100000000000000000000000000010000000050"], 0x13c}}, 0x0) 8.759716851s ago: executing program 2 (id=6079): mmap(&(0x7f0000800000/0x3000)=nil, 0x3000, 0x4, 0x66032, 0xffffffffffffffff, 0x40000000) mremap(&(0x7f00007fd000/0xe000)=nil, 0xe000, 0x2000, 0x0, &(0x7f00007fe000/0x2000)=nil) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fsopen(&(0x7f0000000000)='nfs4\x00', 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000002140)=ANY=[]) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000900)=@file={0x1, './file0\x00'}, 0x6e) r2 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) renameat2(r3, &(0x7f00000001c0)='./file0\x00', r3, &(0x7f0000000200)='.\x02\x00', 0x4) r4 = socket(0x10, 0x803, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x90, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x7}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x60, 0x2, {{0x6, 0x0, 0x4, 0x7, 0x7, 0x7}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x10001, 0x6, 0xf2, 0x617, 0xffffffffffff3a5b, 0x3}}, @TCA_NETEM_CORRUPT={0xc, 0x4, {0x81}}, @TCA_NETEM_CORRUPT={0xc, 0x4, {0x1ff, 0x4}}]}}}]}, 0x90}}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0xfff2}, {}, {0xfff2, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x54, 0x2, [@TCA_BASIC_ACT={0x50, 0x3, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x4, 0xffff, 0x6, 0x6, 0x6}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x7f}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x4) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r9, &(0x7f0000000b80)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000980)={0x190, 0x9, 0x8, 0x801, 0x70bd2d, 0x25dfdbfc, {0x7, 0x0, 0x5}, [@generic="3165622d2b4d4ac15dbfc6f20935fff5a5321ae1bb3649c8dcb1d8ca35946bd62ab6d0fc32371e941fa3586706f780e1f327768974af5a44c03aff4b53da8c87a3aae6ce8db5c3963aaf6e9e7fc52125f26e971b2bb4f8d836240574be06e31ea908466b362e5140aa34f76022778e80a4d1e45f13e20815bb1e9d56401dce354794f2cbcc954773d1751071fb5058ae6829c2df859d30aef925af4f1c4d6ce247296b035b37b055ce5aa8a2703fd0976aa6afa626d14309eac47755fad8d4b4ce62e7491a17502cda3eb1042f9186604813ccec0751c21e29e07a55f0a809f5c70616d3", @nested={0x85, 0x7, 0x0, 0x1, [@generic="3662b5ea529598f4c9d956d469d9d5c17935129ff5745166af6207932b541a58dc80adbf0b0e714046aac5ba2dd757bcadedfcf7fe7ed988cda5227a11396006afceddfe7bcb157d637d4a59f2722f2da00f7ee075b64755d0788fd5caa65f812af185779a434cd45e9140bc82c6bb81684e3471ced9828a929a3a9f0022f487f5"]}, @generic="2345a1774a860fee2dc4cc513638"]}, 0x190}, 0x1, 0x0, 0x0, 0x27c875e7801b32a1}, 0x40010) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='.\x02\x00', r3, &(0x7f0000000000)='./file0\x00', 0x2) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b04000000000000000002006a000900020073797a32000000000900010073797a30000000002400048020000180070001006374000014000280080001"], 0x80}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000070a010900020000000c000025d8f4f36000"/40], 0x38}, 0x1, 0x0, 0x0, 0x4001}, 0x20000014) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000780)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') syz_usb_connect(0x0, 0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000be02e708cf100355678f0102030109022d00010806007c0904bc0003e404ac000905040310"], 0x0) 8.661890845s ago: executing program 5 (id=6080): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1}, 0x18) sendmmsg(r0, &(0x7f0000003e40)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="b875a1431a05b9319c1bd65f19b7bb04bde66b6cfaf855ccf9e1e754d54a18a96c4c4583dcc7e1733542d013c6e21c7a0f870b237fe63eebcf7cf3624588b6eec3360e", 0x9}], 0x6}}], 0x1, 0x10000) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000480)=""/219, 0xdb}, 0xfffffffc}], 0x1, 0x0, 0x0) 7.735402228s ago: executing program 5 (id=6084): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(0xffffffffffffffff, 0x80085665, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000a00), 0x8280, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff000000004e04010000000000d3400202010000004704000001ed00007b130000000000001d440200000000007a0a00fe00ffffffc3030000e1000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a6c3692e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5be14ecf7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e347a8ad880d2cd829b847400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c35b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af8612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5e69048ddff6da409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f50000e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc286463a2b1e992894269f478341d02d0f5ad4bcb524a5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39e415140200000020cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a22048516d6aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe0e669e5e20100005353193f82ade69d0540059fe6c7fe7cd8697502c7596566d6740300da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc02290beaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24c87afce829ba0f85da6d8a8f18ea40ab959f6074ab2a4009b9e5f07ab5138aa6e3d37fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e6b0b384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208160fb04c98375b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27feeb741680f6f2f9a6a8346962a350845ffa0d829e4f79ad7d87906943408e6df3adbfd03aac93df8866fb010aecfed9092ca4d0f3e1116a0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a530600d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe92c7719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b1dba94a6ea80c33ead5722c3293986e02c8e0a6dda1eca493f14795bd068826fe8df15efaaeea831555877f958a19e499666a38d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a8784d0899ed888141e2fae6691d1aee1da02ba516467df3e7d1daac19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa57d2c93f49c47944fec01a8aa7749f3187e9efb00000000e0884160b765b07ec9ba020362310223c81e48d6d3b6e5b50d45248efe43a409773e3ed01cd663f3aaab9e1c0000f43b64bb54e5b30be3399e3dd1eb1cfd1935a323023fe5792879833c7eb356b95cfb135045b1d8f7da2fa5bfedef411d0791523a9e64c884e9dfed9cd413afe66bd8ee831cdb34726fe0434fbf44c7b33a853330bcaf37ba4e36705807468b37d32087e599165f1bce015145444ef5967b443222f46173cc876015b2d1874be9846f7c1653c02d2ef9a75fdc45820c69bbe1cb575f9aa21aa9d3d58bd5e5fe026142a72e24049b8400c4a28b2d5db8d5f53cb354fba19975fb0b3739baae51cb4b034993ef1463dcdba2da419b320420efdd091d7f6e83c8ac2ccc6c9392a42a33907421ab847c9590c213eda9a7e1db598a23e75a3c0933fc803ca994a86476b995c37c445f68fd99fb4d335ff00d15bc4630c993fffffe000000000000a236a791bcb6eff8d488041db6b8f2c158c2c3f4baacd0c8cc7eb1fd7fba93237e598771cf6f281aa72139"], &(0x7f00000001c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) close(r2) fcntl$lock(r1, 0x7, &(0x7f0000000a40)={0x2, 0x1, 0x6, 0x3}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000009c0), 0x40000) ioctl$SNDRV_TIMER_IOCTL_INFO(r3, 0x80e85411, &(0x7f0000000400)) socket$inet6_sctp(0xa, 0x5, 0x84) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x0, 0x1000002d, 0x12000, 0x299c0, 0x7, 0x395400000000000, 0xfc5, 0x3, 0x5507}, 0x0) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0xfffffffb}) prctl$PR_SET_SECUREBITS(0x1c, 0x28) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000000306010400000000000000000200e704050001000700000030692b5aebac0cd17186e7779be9ab9e218cc6ca0af0bd83226a6865a9f66727"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f00000029c0)={0x6, 0x8000005, 0x9, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000200)={0x200, 0x1fb, 0xc38}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000140)={0xffc, 0x2, 0x9}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064d2, &(0x7f0000000980)={0x4, 0x80, 0x2}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r6, 0xc00464b4, &(0x7f0000000040)={r7}) sendto$inet(0xffffffffffffffff, &(0x7f0000000b00)="35a236452a47c78207adc904765e74e716fffa24486ae43493c88509342385976f88a886c960fcdbaf5cbc68865d255c778dea6cddedf91759363275d0d9bc187e4194070ef9e814b6621f704ef1f92e8d0e5c29280034b50bef4a48bc1118c9b3147537dec3522998273d366c18f50a20aba85ee448699c8474001409f83f27bd1031d508f9c8132b", 0x89, 0x800, &(0x7f00000000c0)={0x2, 0x4e1c, @remote}, 0x10) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f00000001c0)={0x1, 0x0, [{0x8f}]}) socket$nl_generic(0x10, 0x3, 0x10) 7.496022645s ago: executing program 1 (id=6085): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000140), 0x10) (async) sendmsg$can_bcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x5, 0xc9a, 0x1, {0x77359400}, {0x0, 0x2710}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "645b6048a2e4931133f6d9919fd48557d76811cd874f3c107bbfc1c8831026d40798a2be4cc414e02216198977dc3d41ed0880c64c39e5f4059bae641ed15112"}}, 0x80}}, 0x4) (async) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f00000001c0)=0x2) 7.393879242s ago: executing program 1 (id=6086): socket$kcm(0x10, 0x2, 0x10) socket$xdp(0x2c, 0x3, 0x0) unshare(0x6a040000) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x940d, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f0000000280)="1a20020000000000", 0x8) syz_emit_ethernet(0xc2, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a31f5ffffff38000000030a01040000000000000000010000010900030001007a32000000000c00024000000000000000010900010073797a300000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x2004041}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000080)={0x84, @private=0xa010100, 0x15, 0x3, 'sh\x00', 0x28, 0x0, 0x70}, 0x2c) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x140}}, 0x844) r6 = socket$kcm(0xa, 0x2, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_SIOCSIFBRDADDR(r6, 0x891a, &(0x7f0000000100)={'veth0_to_team\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xa}}}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000140)={@private2={0xfc, 0x2, '\x00', 0x1}, 0xffffff2f, 0x2, 0x2, 0x18, 0x3, 0xf0a6}, 0x20) close(r1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000b40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01080000000000000000020000000900020073797a310000000008000440000000000900010073797a300000000008000340000000c7140000001100010000000000000000000000000a"], 0x64}, 0x1, 0x0, 0x0, 0x114435b29ef03429}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, 0x0, 0x0) sendmsg$sock(r6, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) sendmsg$sock(r6, 0x0, 0x0) 7.09446293s ago: executing program 6 (id=6087): ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000040)='loginuid\x00') r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20280, 0x0) r3 = syz_io_uring_setup(0x309d, &(0x7f00000000c0)={0x0, 0x5bf9, 0x10000, 0x2, 0xa9, 0x0, r1}, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_PBUF_RING(r3, 0x16, &(0x7f0000000300)={&(0x7f0000001000)={[{&(0x7f0000000200)="06a15e0e91eb8792f972dd2e2d17ea91519c7cfdc4a6b5d168305e57204e9e3cbf81586fb783759f775f151d25f096f23d8aba1d11f99400b3a10c1c3497d10ffb91d6b1515f2e2f67248bedadda62aefae550900356cb16151dccfa9b552257253e79e70cc35dea66de0c937ff3d6be2f4d7d63abc6e6aa03659f1a8d3ca1fa6c653b8f581a64788a6b066f99247ef8338c3acc2bbacc156ae30d9e887f0e2e57df61acd03e35d2bfaa9153bc892719dee410dbbc9c7ef5c766e486cb9f59a92f83db22c52aedd839603465fea1acf41dd81419afcb2d1e291b080c137d2ba519f3e5cf4abb30bdc66a7daf", 0xec}]}, 0x1, 0x3}, 0x1) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r1, 0x80605414, &(0x7f0000000340)) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r2, {0x2}}, './file0\x00'}) r5 = openat$cgroup_devices(r4, &(0x7f0000000400)='devices.allow\x00', 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r4, 0xc01064c8, &(0x7f0000000480)={0x6, 0x0, &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) write$cgroup_devices(r4, &(0x7f00000004c0)={'b', ' *:* ', 'w\x00'}, 0x8) r6 = syz_open_dev$evdev(&(0x7f0000000500), 0x7, 0x4080) clock_gettime(0x1, &(0x7f0000000540)) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000580)={0x4}) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r4, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, 0x4, 0x1, 0x3, 0x0, 0x0, {0x8, 0x0, 0x8}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x4) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r5, 0x6628) sendmsg$nl_route(r1, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)=@ipv4_delrule={0x5c, 0x21, 0x100, 0x70bd2a, 0x25dfdbfd, {0x2, 0x14, 0x0, 0x10, 0x4, 0x0, 0x0, 0x7, 0xc}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x3}, @FRA_SRC={0x8, 0x2, @broadcast}, @FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x4}, @FRA_GENERIC_POLICY=@FRA_FWMARK={0x8, 0xa, 0x5ed}, @FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x474e}, @FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x3}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8040}, 0x20000001) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000800), 0x402, 0x0) write$cgroup_subtree(r7, &(0x7f0000000840)={[{0x2d, 'cpuset'}, {0x2b, 'freezer'}, {0x2b, 'net_prio'}, {0xd36ce6fd799188f6, 'rdma'}]}, 0x21) r8 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece) fchdir(r8) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000000880)={r7, 0x2, {0x0, 0x0, 0x0, 0xaf, 0x3, 0x0, 0x0, 0x1, 0x0, "49597a56f3de0b54ce1d6b2a805dd27f88d02593e17e15c09a042b573e1b138c4f7330529b07ee246d795ab3790f1a85ccf4a2daaa79c2e64ef3df1f8b50468f", "31fe72defa2af1d5321ef97d6a7d512132a4a9c971f3c7df159793fbc87d6a649a46c4a3a514f3645284bf472ef9d5d1d93d7006546e27573610624a8c6ca799", "abb6d7284304b578d548bf8aa139df14be6d34533107eb56219536fe472e635c", [0xc700]}}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r8, 0x84, 0x6d, &(0x7f00000009c0)={0x0, 0x63, "6810a81237bc7b42de16f45109b7904e93ec22a8a4e7a3d8804e78817636e753d9fe8182fc1c69307afbbf616792f5761218b131f022c33f863a2b22f7c09c812fa274c08994e0f81c8990b0b96ddd14929556b86b0ba28c0181d444afe574e04f9516"}, &(0x7f0000000a40)=0x6b) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r9, 0x84, 0x17, &(0x7f0000000a80)={r10, 0x2bf3, 0x69, "7f33f2dfae860561bdfde92d30acc258e855fa3a9d7e9b33a957d7d232d3567e4baae083c285895385579d78207a66de7d20cc414d1680bbb57878caed8622d557ae7879cc6fbe1b255cce39df78e16823bb9165b3e1f6b74beca00063899743746660c15d93e51f90"}, 0x71) socket$nl_generic(0x10, 0x3, 0x10) fcntl$addseals(r2, 0x409, 0xb) ioctl$DRM_IOCTL_GEM_OPEN(r4, 0xc010640b, &(0x7f0000000b00)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_CLOSE(r7, 0x40086409, &(0x7f0000000b40)={r11}) ioctl$KVM_RUN(r1, 0xae80, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000d40)=[0xffffffffffffffff, r7, r6, r5, 0xffffffffffffffff, r9, 0xffffffffffffffff], 0x7) 6.909877712s ago: executing program 6 (id=6088): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="600000001000ff07000000bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYRES16], 0x60}, 0x1, 0x0, 0x0, 0x1}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000001e00)={{0x80, 0x80}, 'port0\x00', 0x8719470d9569919, 0x110c34, 0x7ffc, 0x1, 0x4, 0x1, 0x5, 0x0, 0x4, 0x9}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000500)={{0x80, 0x9}, 'port0\x00', 0x57, 0x40800, 0x9, 0x10, 0x0, 0x800, 0x8, 0x0, 0x3, 0x7d}) close(0x3) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r3, 0x6, 0x9, 0x0, 0x0) setsockopt$inet_int(r3, 0x0, 0x18, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYRES32=r5, @ANYRES32=r6, @ANYBLOB='N'], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x24000800) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'macvlan1\x00', 0x0}) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000240)={r0, 0x4, 0xf96, 0x100}) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="540000001d000104062d7000fb07000000000000c085761b44dc5de4ab62cb0bbaab4d1f81c57be44aef2c28533a403a408c5c05f17c702d60540b23cd66bb1fa5b78f406000f1d455249978fe117d8a051758894c95e0b6af6b209547ece0d71b55c7852c8726e55fda25baed6efd5603d2c197cbd8230fc2e0f4c510dc9bfe692d1304e5598353bf307ff5173e92d81cc2aed5bae29c048d1f06577b37519a7771bacc93587538b49d849081100adca922cb17b41263917354703c2f6fe12b57df8abf4066c90397f726b75c2ca45d8e301992b1fa3972b0c6bf97f7786f4c", @ANYRES32=r7, @ANYRES32, @ANYRES64=r8], 0x54}, 0x1, 0x0, 0x0, 0x40001}, 0x4000080) r9 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x7ff, 0x0, 0x2, 0xb, 0x5}, 0xffffff8b) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r10) sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, r11, 0x8, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x1c, 0x17, {0x1f, 0x0, @l2={'eth', 0x3a, 'pim6reg1\x00'}}}}, ["", ""]}, 0x38}, 0x1, 0x0, 0x0, 0xf3926bd3c130bc13}, 0x42809) syz_usb_ep_write$ath9k_ep2(r9, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000040), &(0x7f0000000080)) quotactl$Q_GETFMT(0xffffffff80000402, &(0x7f0000000380)=@rnullb, r12, &(0x7f0000000140)) 5.952668554s ago: executing program 5 (id=6091): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) rt_tgsigqueueinfo(0x0, 0x0, 0xb, &(0x7f0000000080)={0x0, 0x0, 0x3}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r3, 0x4038ae7a, &(0x7f0000000000)={0x80, 0x40000105, 0x0, 0x0}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5.66995453s ago: executing program 2 (id=6092): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 32) socket(0xa, 0x3, 0x3a) (async, rerun: 32) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x4, 0x1, 0xfa14, 0xffffffff}, 0x0) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) (async) r4 = userfaultfd(0x800) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 32) r5 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) (rerun: 32) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000080)=0x1e, 0x4) (async) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(0xffffffffffffffff, 0x0, 0x86) fchdir(r6) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20) (async) symlink(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='./file0/file0\x00') (async) mkdir(&(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x40000000000001, 0x6, 0xfa11, 0xffefffff}, 0x0) (async, rerun: 64) socket$inet_mptcp(0x2, 0x1, 0x106) (async, rerun: 64) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x62002, 0x0) (rerun: 64) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) 5.044607407s ago: executing program 5 (id=6093): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0x0) syz_io_uring_setup(0x4757, &(0x7f0000000040)={0x0, 0x27eb, 0x2, 0x0, 0x36a}, 0x0, &(0x7f00000002c0), &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x20000000) r2 = socket(0x840000000002, 0x3, 0xfa) getsockname$inet(r2, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000200)={0xfffffffe, 0x3, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[], 0x50) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, 0x0) socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) 4.875448028s ago: executing program 4 (id=6094): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c0000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="20ba0100380a04001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r2, @ANYBLOB="0500110001000000a552a07a6d1497a74b1f484db1825bec860301000000842c1c7880dbeca4928832aa389fb2593ad9e95575cbbdafad5bfea5ab9ee939"], 0x4c}}, 0x8000002) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r5 = dup3(r4, r3, 0x0) ioctl$PPPIOCGIDLE32(r5, 0x8008743f, &(0x7f0000000280)) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000bc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}, @flat=@handle={0x73682a85, 0xb}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) 4.789639993s ago: executing program 1 (id=6095): syz_emit_ethernet(0x1f2, &(0x7f0000003600)=ANY=[], 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) shutdown(r2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285629, &(0x7f0000000080)={0x3, @win={{0x0, 0x0, 0x0, 0x10000}, 0x0, 0x0, 0x0, 0x0, 0x0}}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xffc}]}, 0x4) pselect6(0x40, &(0x7f0000004c00)={0x1e, 0x400, 0x3, 0x6, 0x10001, 0x1, 0x4229, 0xf64}, 0x0, 0x0, 0x0, 0x0) 4.292815252s ago: executing program 6 (id=6096): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_GETIPTR(r2, 0x800c5011, &(0x7f0000000040)) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket(0x1d, 0x2, 0x6) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r3, 0x40405514, &(0x7f0000000200)={0x9, 0x1, 0x0, 0x0, 'syz1\x00', 0xffffff7d}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0xc1105511, &(0x7f0000000040)={0x9}) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) socketpair$unix(0x1, 0x3, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e000000200"/195], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) r5 = syz_open_dev$hidraw(&(0x7f0000000140), 0x5, 0xc000) ioctl$HIDIOCGFEATURE(r5, 0xc0404807, &(0x7f0000000380)={0x6, "992199597c35239fc0ed5b84d8a6656b60a06a52f86f07c05915feffffff0000b40100000000000000000000000000000000000000000000000000000800"}) clock_gettime(0xfffffffffffffffd, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4d7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) creat(&(0x7f0000000300)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000040), 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f00000002c0)={r8, 0x10, 0x1, "c5"}, 0x9) 3.794800651s ago: executing program 1 (id=6097): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x54, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x4c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x20, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}]}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}}], {0x14}}, 0xfc}, 0x1, 0x4000000000000000}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYRESOCT=r3, @ANYRESOCT=0x0, @ANYRES64=r3, @ANYRESHEX=0x0, @ANYRESHEX=r4, @ANYRESOCT=r1, @ANYRES8=r3, @ANYRESHEX=r0], 0x38}}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80800, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001800010000000000000000000a800000000300080000"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) close(r5) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r7, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, '\x00', "5193bb672965593497c186a80e00", '\x00\x00=\a', "1202000000040030"}, 0x38) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback, 0xffff}, 0x1c) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, 0x0, 0x20000804) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r10, {0x0, 0xffe0}, {0x2, 0xb}, {0xd, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x24000050}, 0x0) set_mempolicy(0x4005, &(0x7f0000000080)=0x4, 0x8) r11 = socket$rds(0x15, 0x5, 0x0) bind$rds(r11, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r11, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 3.240541879s ago: executing program 4 (id=6098): r0 = syz_open_procfs(0x0, &(0x7f00000011c0)='io\x00') sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x0, 0x400, 0x70bd25, 0x25dfdbff, {{}, {}, {0x8, 0x2, 0x4}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4010) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$DVB_DEMUX_DMX_EXPBUF(r0, 0xc00c6f3e, &(0x7f0000000040)={0x7, 0x0, r1}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000800), 0xc000, 0x0) quotactl_fd$Q_SYNC(r2, 0xffffffff80000100, 0x0, 0x0) 2.913740153s ago: executing program 2 (id=6099): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d507df08c410448200dc01020301090212000100000000090400000003"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$uac3(0x1, 0x9c, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x499, 0x100c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8a, 0x3, 0x1, 0x4, 0x80, 0x1, {0x8, 0xb, 0x2, 0x1}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xf, 0x14, 0xda0}, [@mixer_unit={0xa, 0x24, 0x5, 0x1, 0x6, "39802ea6cc"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x9a, 0x9, 0xf, {0xa, 0x25, 0x25, 0xfffff846, 0x3, 0x9}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x7, 0xf7, 0x16, 0x9b, 0x6}, @format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0xf8, 0x2, 0x6, 0x4, '='}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x6, 0x8, 0x9, {0xa, 0x25, 0x25, 0x2, 0xff, 0x3}}}}}}}}]}}, &(0x7f0000000380)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x8, 0x0, 0xb, 0x20, 0x8}, 0x19, &(0x7f0000000100)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x8b, "1e77f06643b2b769d258c5f743c58318"}]}, 0x3, [{0xec, &(0x7f0000000140)=@string={0xec, 0x3, "0c93e6c60740a95cfdfa94cb7d0fc02851925f927e30a0da2545204298a4afc3bcdaec6dcea8e6e737c8a2140475dcf0534b0cb9bec106bd4ef070d7e5e98b4386aed513c13a2419a75ceb36f925a30db522883425b44831ac5cb206c9add580511ae742d4a3f5670199a4a54e7e06e65ce2600d9b528c12a3b7a2bedcb42be88ed21347c4dfeae1f6d4c20d854373987dbb287dd62f5db3fe0c647c8c8302cc379bbb5864e8e4a512c871cdf84b21c9a28545a7a5108bceab92fc5effe3baac5ca165931854b41aa8a43d54182d720f2ca25c84f105aee5770cb59bb2e49832e184feec14516e2c2517"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x44b}}, {0xe3, &(0x7f0000000280)=@string={0xe3, 0x3, "d625db00e625172baa13c7771293153599f25a0acdd164828d4aa1aa29de964fc23c1f82af965103c8bf3aaef92339fed01a4dc3f2d48b2a0dcc51e77648d5062a81ffc696652895f293dabb09d33530875334294ddbe4157178b287840b854c1ca3e8906cfa248a543573e6d7e84a3f9d727d0bc351533394812ea3f0bcdde17ba1c2ec57d510067e277d2beb56b136d5d3bbb96fbb9af0fb0d67062bc7f72d98361de802eb7263e2cd4b8e615e7b1699898982bcd07b1a6041f5a8a15e5848685b9710deb703aa0631762d300807bdec97f8d0d4ab02869645dd6d284ae1594f"}}]}) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000044c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000004380)=ANY=[@ANYBLOB="200180"], 0x0}) 2.913373138s ago: executing program 4 (id=6100): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x358, 0xffffffff, 0xe8, 0x1b8, 0xe8, 0xffffffff, 0xffffffff, 0xe8, 0x288, 0x288, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000140)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4008000}, 0x4840) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x70a, 0x183e, 0x30314142, 0x6, 0x4, [{0x8c, 0xf}, {0x4, 0x5}, {0x5, 0x5}, {0x400, 0x7fff}, {0x2, 0xffffff78}, {0x2e, 0xfdfd}, {0xffffdffb, 0x10}, {0xffff, 0x1f}], 0x9, 0x2, 0x2, 0x0, 0x6}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r5, 0x28, 0x1, 0xfffffffffffffffc, &(0x7f0000000100)) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r10, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/250, 0xfa}], 0x2}}], 0x1, 0x34000, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000", @ANYRES16=r9, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x70, r9, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x6, 0x2) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000048000000030a05020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000008000700"], 0xcc}, 0x1, 0x0, 0x0, 0x880}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000014c0)=ANY=[@ANYBLOB="4400000010001fff000000008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f00001c0012800b00010062726964676500000c000280050007000600000008000a00", @ANYRES32=r3, @ANYBLOB="0edded8d513b9bd183a0e326078e8d40dbc0fd99f09aeb75eb40f3f25348d726cf83d6557586fc2a0e402cdd081044b2b1593b047df8e305e80a43215f93450103e11c24a716dcebd146c2df25d64b2a95b5cbf63d97ae902a775c092912473dff0226116fcf46b0"], 0x44}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) 2.849349209s ago: executing program 1 (id=6101): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000340)={0x40, 0x6, 0x1, "b3"}, 0x0, 0x0, 0x0, 0x0}) syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x2, 0x3, 0xc}, @l2cap_cid_le_signaling={{0x8}, @l2cap_ecred_reconf_req={{0x19, 0x7, 0x4}, {0x0, 0x1000}}}}, 0x11) (async) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f0000006b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="480000000e148b6929bd7000fbdbdf250800030009000000080005"], 0x48}, 0x1, 0x0, 0x0, 0xc080}, 0x10) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 2.521664597s ago: executing program 6 (id=6102): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000006001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 1.729693087s ago: executing program 6 (id=6103): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) rt_tgsigqueueinfo(0x0, 0x0, 0xb, &(0x7f0000000080)={0x0, 0x0, 0x3}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r3, 0x4038ae7a, &(0x7f0000000000)={0x80, 0x40000105, 0x0, 0x0}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.718953583s ago: executing program 5 (id=6104): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000106666018800000000000109023400010000b00009040005190300030009210800030122290009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000000040)='./file1\x00', 0xc0000008) link(&(0x7f0000000200)='./file1\x00', &(0x7f0000000300)='./bus\x00') 1.245851123s ago: executing program 6 (id=6105): capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x800, 0x0, 0xfffffffc}) socket$kcm(0x10, 0x2, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007292bd404020305582a80000000109021b0001000000000904000001df7fa9000905", @ANYBLOB="868f54"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000040)={0x6, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x41000, 0x66, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)={0x2c, 0x10, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r5}, @typed={0x8, 0x0, 0x0, 0x0, @fd=r5}, @nested={0xc, 0x2b, 0x0, 0x1, [@nested={0x8, 0x8, 0x0, 0x1, [@nested={0x4, 0x94}]}]}]}, 0x2c}], 0x1}, 0x24000000) ioctl$KVM_CAP_DISABLE_QUIRKS(r4, 0x4068aea3, &(0x7f0000000200)={0x74, 0x0, 0x10}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000001010000040003000000400001802c0004001400010002004e227f00000100000000000000001400020002000000e000000200000000000010000d0001007564703a73797a320000000069b6e7f56cfbc9bbfd40c9f0e75c607900a5f243c4fb689000ea58f514246e395e06191a4383a8505f8c0f2c4204bd18f50ebbdfc372c10db66c7d7d53cc1ba656de427c3ae40b1809c7c688dcb19ee8159017ad36c04d83d9c83f5f12a5817ceeacda5215442ef6504cb446786b00f6d942b42117c5ce8acc82022268b55e0845b3443fb3c08ac90c5b514b8e03534de51f86f5c99b56bca086259c472733f4b6f7ccfbe6d5a5b4ffa7ad9bb54c74"], 0x54}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendmsg$TIPC_NL_KEY_SET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x58, r8, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) 1.208780953s ago: executing program 4 (id=6106): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@delchain={0x68, 0x65, 0x2, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x2c, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_POLICE={0x20, 0x2, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0x2}, @TCA_POLICE_RESULT={0x8}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x101, 0x4) recvmmsg(r0, &(0x7f0000008d00)=[{{0x0, 0x0, &(0x7f0000008980)=[{&(0x7f0000006580)=""/10, 0xa}, {0x0}], 0x2}, 0x6}], 0x1, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x84) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0) sendfile(r2, r2, 0x0, 0x5) r3 = socket(0x10, 0x803, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000340)={'batadv0\x00', 0x0}) recvfrom$packet(r3, &(0x7f0000000300)=""/32, 0x20, 0x100, &(0x7f0000000540)={0x11, 0xc, r4, 0x1, 0x7, 0x6, @remote}, 0x14) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000080)=""/82, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffff44}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.000695816s ago: executing program 2 (id=6107): syz_emit_ethernet(0x1f2, &(0x7f0000003600)=ANY=[], 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x8, 0x2, 0xfffffffffffffffd, 0x1}, 0x0, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) shutdown(r2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285629, &(0x7f0000000080)={0x3, @win={{0x0, 0x0, 0x0, 0x10000}, 0x0, 0x0, 0x0, 0x0, 0x0}}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xffc}]}, 0x4) pselect6(0x40, &(0x7f0000004c00)={0x1e, 0x400, 0x3, 0x6, 0x10001, 0x1, 0x4229, 0xf64}, 0x0, 0x0, 0x0, 0x0) 986.780631ms ago: executing program 4 (id=6108): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x18b040, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2(&(0x7f0000000140), 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd(0x3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8b07, &(0x7f0000000440)={'wlan1\x00', @random="8dffffffebff"}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000240)={0xf000, 0xf000, 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000000)={0x7c, 0x3000, 0x0, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000003c0)={0xb03, 0x3000, 0x0, r3, 0x4}) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r7 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000001180), 0x0, 0x0) pidfd_send_signal(r7, 0x1f00, &(0x7f0000002280)={0x0, 0x0, 0xfffffffe}, 0x0) lseek(r6, 0x2, 0x0) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r8, 0xc018643a, &(0x7f0000000080)={0x40000000, 0x0, 0x9661}) getdents64(r6, 0x0, 0x22) ioctl$KVM_SET_IRQCHIP(r5, 0x4048aec9, &(0x7f0000000140)={0x2, 0x0, @pic={0x5, 0x7e, 0x2, 0x10, 0x2, 0xf, 0xff, 0x6, 0x1, 0x7, 0x0, 0x3, 0xb, 0x6, 0x7, 0x1}}) 576.674132ms ago: executing program 4 (id=6109): mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x2010, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffe0000000002, 0xfa0f, 0xffffffff}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005f40), 0x0, 0x4000004) r2 = socket(0x11, 0x800000002, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000540)={'wlan0\x00', {0x2, 0x0, @private=0xf30a4000}}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000000000000001"], 0x14}}, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000240)=0xe) ioctl$TIOCSSOFTCAR(r4, 0x541a, &(0x7f0000000800)=0x10001) read(r3, &(0x7f0000000640)=""/187, 0xbb) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket(0x10, 0x80003, 0x0) write(r5, &(0x7f0000000000)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r6, 0xc018643a, &(0x7f0000000080)={0x40000000, 0x0, 0x9661}) r7 = socket$netlink(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) write(r7, &(0x7f00000002c0)="29000000140005b7ff00000004eabdeb0101b6ff02159f7e5520756b1933b49db96ad24d12595fbea5", 0x29) syz_genetlink_get_family_id$smc(&(0x7f00000000c0), r7) 518.390993ms ago: executing program 1 (id=6110): mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x2010, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffe0000000002, 0xfa0f, 0xffffffff}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005f40), 0x0, 0x4000004) r2 = socket(0x11, 0x800000002, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000540)={'wlan0\x00', {0x2, 0x0, @private=0xf30a4000}}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000150001030000000000000000"], 0x14}}, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000240)=0xe) ioctl$TIOCSSOFTCAR(r4, 0x541a, &(0x7f0000000800)=0x10001) read(r3, &(0x7f0000000640)=""/187, 0xbb) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket(0x10, 0x80003, 0x0) write(r5, &(0x7f0000000000)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r6, 0xc018643a, &(0x7f0000000080)={0x40000000, 0x0, 0x9661}) r7 = socket$netlink(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) write(r7, &(0x7f00000002c0)="29000000140005b7ff00000004eabdeb0101b6ff02159f7e5520756b1933b49db96ad24d12595fbea5", 0x29) syz_genetlink_get_family_id$smc(&(0x7f00000000c0), r7) 0s ago: executing program 2 (id=6111): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0xc, r1, 0x0, 0x0, 0x808a}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="05000000ff7f00000500000007000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00V'], 0x48) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0x3, &(0x7f0000002040)=0x4, 0x4) (async, rerun: 32) sendmsg$NL80211_CMD_GET_MPP(r3, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000690005"], 0x28}}, 0x0) (async, rerun: 32) recvmmsg(r3, &(0x7f0000000800)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/91, 0x5b}}, {{&(0x7f0000000000)=@isdn, 0x0, &(0x7f0000000640)=[{&(0x7f0000000080)=""/225}, {&(0x7f00000001c0)=""/65}, {&(0x7f0000000d40)=""/4096}, {&(0x7f0000000240)=""/99}, {&(0x7f00000002c0)=""/122}, {&(0x7f0000000340)=""/217}, {&(0x7f00000008c0)=""/35}, {&(0x7f0000000500)=""/227}, {&(0x7f0000000600)=""/1}]}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000700)=""/27}], 0x0, &(0x7f0000000780)=""/112}}], 0x40000000000024a, 0x40002002, 0x0) (async) mbind(&(0x7f0000bdc000/0x3000)=nil, 0x3000, 0x1, &(0x7f0000000140)=0x3ff, 0x3, 0x0) (async) mbind(&(0x7f0000bdb000/0x3000)=nil, 0x3000, 0x1, &(0x7f0000000080)=0x103e, 0x5, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) socket$packet(0x11, 0x3, 0x300) (async, rerun: 32) socket$kcm(0x2, 0xa, 0x2) (async, rerun: 32) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r4, &(0x7f0000000240)=[{&(0x7f00000001c0)=""/40, 0x28}], 0x1, 0x38, 0x9) (async, rerun: 64) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmsg(r5, &(0x7f00000031c0)={0x0, 0x0, 0x0}, 0x2000) (async) recvmmsg(r5, &(0x7f0000000d80)=[{{0x0, 0x0, 0x0}, 0xac}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000480)=""/77, 0x4d}, {&(0x7f0000001880)=""/4112, 0x1010}, {&(0x7f0000001680)=""/100, 0x64}, {&(0x7f0000001740)=""/72, 0x48}, {&(0x7f00000005c0)=""/48, 0x30}], 0x5}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8000d3a7}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0xef23fe83}, {{0x0, 0x0, 0x0}, 0x10001}, {{0x0, 0x0, 0x0}, 0xd9f}], 0x9, 0x2030, 0x0) (async, rerun: 32) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r2) (async, rerun: 32) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) (async) r7 = accept4(r6, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r7) writev(r7, &(0x7f0000000200)=[{&(0x7f0000002100)="a4eac90f8e3ae7580e2e693731ef6b447fc2057d9a84e61f40c79e10218d131f865d68b23cd7c3f2b681e2205f67f140252abcc3b8015e176881d81a9e61b6a2c92a9d8e1f51861b64e7b61bf9a131e197f5a6c6d4d887d86c79836e81c69e211d2bf4c595b01c94de464ff9aa72b6058fe774c81142bbce9bd0d83f6239362c3347e3daadb292cf3fee4766a2d43cf006a476ce0e4dd221acdcdefcf67733ed2978c2cd564772844077920cf54543db03688079168e36709dbbf84933a2415a32617f7de4336d89967c2cbcd76a973d88a3c440862bc11e51df6f1cd25f1aa711b721c33703645bcf93b775f1eb28c7640d1b7cbe44b9fc0e55d1a4d8f83b8fd537a231fe75ebb7255387d089ae7924c86b36f11d4c09d27626fd8cd62dbee1662558322e3dffdb4c4816e8ee2501b8e73eda5a8caf70487ea6edede6b8337d5ff348bd874de5b9a5058b85c0659031d237abfcdc40bd6b45d4845b08adc7bdaefa8099bef8d5f6cae07abc605dc651a21b04ae53f6d89d9fac3ec696ca9508a681ca65a4524242fae4d79e40840ce54330107125a916b03459f58e4e6c3215a97e391c069926a24d9486909ef1f0c210514e2cd81cbaa6352a2de4f5829eb670a6500c83eb8c8bd5edbe4005bfb524fce3d4796d028acf27fb9df67851db5d59b2f88d97aa591d607d602dbb9bb4211abbc8641610aae237e8d47f8381dced80019a4e9b3d0eb531087947e0a010a96e2a978ffeec19fe0a6077eb48d3d4d478801eb1902bb3f8552d402dd8de49cb6bb7c78600c75e3bcf53bf58e391d6484423cbfe17cf95f3b30a41b849af63ffd6a7b5aaab0ce5ac6d78519430c27415fd46f150671ee860341b9c473937c498cc9aae0cb64a73f24780b4771b1ea51816bd68f19c49747c4caf0acd418517e88e1f82cd9d2d870abb33624483670269aac3d2fe75fff726d60fe1be2fc2abc47b98eb75ef2f7f4eca0b50450ef48d71921cd10307563d120eed0416e3dcf4b198ec8424d857ab872d9de56e614e3fba275bae2c21793bebe86cdfbe822bffd2c9be6e623fcbb441e202cf8107da69cb06f93f7956a4ee88de99dc881fac8894ea5acaf4cac4c65de055017ab0dcd1adab2a22e1c2a12e73316be0f4d07b405d6bf4adda88fac3f081f8f180b403a067184b26e35860e1064d87748390e6f63217d7db40f002f85c57c125be768d68600e2c795a83a3477481a41b8392a6ae2c3a51cec2da15980c299f528e658641960ef2983ae3e30955586dd9e6a6591d81645ed451dfc14b2c648a89655af1f66067350c6fb356610469ae7b20ccd14cbb0fb04f58bfda8f28f90ebade9b6f8017094f1d467d9df73dfcc48cea0307ca833b72978e64651c8eb429f2b36adab59251452b4abaa2ecb42eaf674b12b49081b40c324d6da586212f187c51e32c42b00622b3fcb1acfecaeb603cec87a0010c199a80cf184894b0992fe709613c672ec91587afe94c637cce86a50dfe9c695c8398e963e68156537014405962d20610846691a352dad6204a33f07f175e5dbdc89aab549ef4150320084fd999a090d86affac5ac371dfe5dd595b7459b39bd78ba5bb77469da251d4f9906356667a27ac58025eed8d0ded3a69cd2a6cae52ac4dd5799802421fd8a818c5bc787da162a42f5dec2175b4ff37a543d214bdf0cc071de0b77c9902ce7dbb42ace340e64a020100b677a73bc4449655f4165f074cb1b85cd491f18f3fbeb03ca708a91fe041a46433d8d8e1693dbff6333981c243b1d412c87741aca8e790f3ebb3151e3b44870ba74c64cc5c3011d7ac138ef0bd48f197a32c31fac8d53ba54ae114119328eb9e8825555ba29e9d45cbe656eeff1b4e39600695d3911ab4f5075c3d5691b731c50adc226d3ebf50d3c38561a5d0cef2c9d16e071bb8221ab4f85a802a63b7071402f88c7cf39cfc916f8622357b3234f3761f89cfbf3aded40c512a614702ae867e197510d3bdb4ee60df96c4e51b5a338b58b07e8ee62be9822e0d166ff874b8d1f9e4486c601d9b56a26eb0b83a80704dee19d10cc05c63b95f7d1efef88177645bc30d8473983ed552926d219bd0c3dbcb0fb464649624ba7a57f5163f49f33fb79a46e7ac9797e300262a843f15f644f5230546f3c62450242fe12a79bd44c61fd946165662b0bfbcffd12deb93e0cb82dc8cc66bebf0721b94a5fa0d66381540246ff78c6225a952ab984c06c07902ed42e40fcc9151b0a59be83f454698f302f349014082ff08bcecbf0b9dea7e32b063449d573ca1b6efc812acf382ef7b7e6cd206185e063c985b8c44fe38d62d4a8d3d15228406f3abed51fe90bae3ddc283069d46e0ebd3a8bb87e4e0eb116dff6fc881e8fd0e5032e6a6494cadfd85652ed1c9c2d7aa00e18ccbde0aa3c857c50ee86975aff735f633471ab8e6db33bfcefeae661bd1bd6dfb55a9a4b4f9be01fd15e27e03fc943ccdb91a799d2eb168d9fdeecd32c19169cc0443ebb8e2f681d773efff72530f61a288cfb49c0217b9a9223ceb3798390e15fbe9475975c05f22a7c4d1990f9400a249d32eec4a5773bea0d15cc0df06d223e057b3693ac906cf632da8c9092e52718bd9f16af452dacfab22cfc2c58a3168de9914570f1035ae9b3092346db21dda270393a992cb967dc074ae2fe8b545df855b9e8b251cac7935a842bda9e850a9efb5309cc0fb83a630dcb3684fec4999ed6c4cc91aea72961420523be74711ff4c3f16a5f6ee906dae87d2bbc194b2d8b7743c157f6c8d80e6f4e377cf05810bef82e51fa5c1e442018466071f7d572cae794fab5cfbbd8e8d398c3a2823e8ce4357572a32123312d0d3976d63dc2a00b2d474ad288762e768e31ab7b4f09e7f3cfcb7a48adbdbca43d30c9bc8f67d115bc34f24eaf0318bb5e2994ff0f8b62c13f46abebdd0846da71a5d106e62266ec3e5a3f2c7166628220568807b595dc73920a0a7a9f2644db70fc53fac0a547cf6cbefe7aee975e0159fe8f413eab912925757581d2fe97cc5f19343f329b2ef081397737414a822432b5f9fa2044aebda92c1d6a065401b70c20a6867fb93e8f6f575aa9fae3e67b6fc6e0418f58731d932b3e5bd1dddbb9854a25144a334d00bea2995d7a751d40a06c37372b05cc584aaf62b90fdd95f87ff53eab367600d50eebbbb4cf04f225824086cfaca6aa82b3e3433881f7ec32cd419780ed0de6fb2234368983282fb93b9d1a6bd96c3d14aff8272328db634b02bbbc5b8957c695e469f80fc50eac333b88303d0bf29c42c13a92a58a9bf30391cfe6a0c5df40cd5b7a8637cbece9a4f251e5aa4aa2fdf883d82d2a430f06416f0372911e426620b25d8839d2ac9d73cb782194f0daddd4caa68f1ff6892981c00d6812d21ffb5fcd9b1cd187d519040968aa2d7f4ccfcc236ffe2cae8d349f39feb3fa574272a428dfbfba0a735a349188b1396b96d1fc2e86069fc797de98985bf338e495d66cbed89c2f5f2cc78ec2b880f04627e5cd49e93bb606d241149b936ab29b790e22022361c483d760e07cabdfdd204114fc3808b7bb7cf977ffe0b8c58584364571578084f1dfbb592e47e0f01c020d02aafc8c83a56299f31836574923a706e7a46861502dfbf0e9d2893a38aca39a16cec44664541e092ec489abfa28128ebd73e7bbe062515384c69c656268ef42c37632ce2db76afd09e6de7928136cfaae1b4fdeaab590617584831a7eb19af64625ec2ca635f79f50caa48524b0fcd1e08a09bcf52e231f3487ab54fc77ae44e13a966976e9e9deaf8ab9da7f804fe6290e16629c6f83110f54e5c206798033c614be334a5ee04f4ecb30f58371eeb3664eab1d00f52725992897279d21d475cefbe2345a7f1df6e916a806e7c39b651866f6c1108d00990673ca858d8af73a26a74e1f8d7818859e7d0123224f866ed0745382b2a29f5374d7c6c0fa54ddf743d89c85dc56cfab74ee786d054a5f4f1db15d85e9fe1a7fdaa3746d9e7429735f2253cb2a600b81f969c7c7e56f22b47f15aa700b3369102ea105106b96cebd1161673ae4725a4d96421833f65f76c64de5aa7957b0df8ab64583e8d5018faa1f4e0376f1d38103ac78403f65f809619c3a9fe43c6b3493d29c52d4c230a39914b1b49c627fba1612c6479205c256ef023cb52ca142c6c37391ec9f74ba334ddebce6438cdf6e99527e68585324cbf6547872366d2d0b7db30a33528a745cbc8820e52a3cf77e50a76935ff4a7f41dfc58c86ff05e24436faf28f423467105b314bd6e4edbf1a352840728e8fe4dd79ee5f770dd987eb62ba3ff5c26c9de6685afefa5a227a4a6dfc1d23ba09eefab45402b138b53b83873a3797096d4b62450c579a894be0c05b947646ef2039ed37955155b58fae377c727605979505b037a0a72e622b883cd1001f69da95ffdd143e68e1fc2cc42db37bde33184ff85c89713a722e1eba4ad292ec9ccd1c8c18674e77bf6394edd47ad635b278ec09921020507104485a6453585c385d0cd4cf611d0c6da50ec3d34eecaf3bba0ae5051a55450ae2e40c4fd0ba420b04b2e1b4d1592e8b80f92d40d42de588e719fe2b022c30a5187c64cc5c48679f680387464d3681edea585006a2e85820cd02be2266e8c4230a6bf60dd8efb0e3c1b4dcfed2844d495957ae734470d0199a0e0278f80018a39e9c82c15cb9c73a3deb2579444b414ca7061bfb4f599fe3968334c0ebde54b9a046370bb7d3227c9dd23e8edcf8b07aabf328bb164c79c6df5f0bd46a276413dee370e32da823d5e9839937e72b6480ac0439d104cadba1a8d6d0542f73f720ecdafece52fc6fa291e44b3852af376a3aceb05c2c293a2576175a3b4135ff6799a232d9c3907fcdd49e0d97e80ece0135dac08c37a16a93046d7ca3f3db91d0c28447522759017980f4d3321981ab53000fbe5293b396f6163e3ae016329bc42f6c958d648a30ed5c6e14eeef235fb74cbc24e183a0f89ee89b3c51a8b7106afefb2e406a026619793fe4c3f4bdc7d66fbf98a740afb32485ae5451b905c22bf63f9b3b42b30a3287f266559db4067d1c00d2ffee58378a44614dafed9107d97d9c3048f2bdba374ccc827f302dae2a4637354cedfc0a2d7f2d2462f5ed43f1b682e1f922cf255ff78267c08ae419bcb47781e016ebc197e75f7da13cd9d6c1cb80adc03a40db059c83e635e61b6d4500e4924a53a783644e0fa05364b6d047ef9a5fbcccc500777db98c7b44d0d7bfdb8beaf17dcb77f5a11296b4399f58f849d08bd779453a5175a29e93c37497ff2bde63a5d41fd8d8e1e545474bae69ea1e3dff2320a794935e03bf2aaa82591914f4c1b811479381d12cc86d0ef6f57c8dc914520c5946b1d906e09cd61d33b6fb8c42bf0e65365151a8cf5b270d41bc581876b86bac6a5df6f097271f1d77d9312bef53a650970547976d8f0d6efcbcfebccb718e4158e8d004ae7d28f0d6e822d59dae4ec387ccf6d0971031bc3d0f1720a7aa0fccff744b1b962aefda91e69af301f7e3b4d454790cbf42a97f728ba0e66d073708cd7584f181d56d1c45457", 0xf70}, {&(0x7f0000000480)="cf227556949d4c68c907070cf51f021a2ac35148c0bd07df511575666dad6f12876eb0cb1d1b45b00c7b3840a6a6febb12063a9eae66eef57a2b15ed3a7ae23a37f75498b93300ec9b316bb7fb6d55ed5663e65dbfd86cc2c248b2a0d478c46c58", 0x61}], 0x2) (async, rerun: 32) sendmsg$NL80211_CMD_JOIN_MESH(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000001c0)=ANY=[], 0x3bc}, 0x1, 0x0, 0x0, 0x2004400d}, 0x4000000) (rerun: 32) recvmmsg(r2, &(0x7f0000006900)=[{{0x0, 0x0, &(0x7f0000001880)=[{&(0x7f00000006c0)=""/237, 0xed}, {&(0x7f0000000580)=""/162, 0xa2}, {&(0x7f00000007c0)=""/173, 0xad}, {&(0x7f0000000880)=""/4088, 0xff8}], 0x4}, 0x7}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x8}], 0x3, 0x40020062, 0x0) kernel console output (not intermixed with test programs): 4 comm="syz.3.5708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe027f9c819 code=0x7ffc0000 [ 1298.804063][ T30] audit: type=1326 audit(1776092086.428:2776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25324 comm="syz.3.5708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe027f9c819 code=0x7ffc0000 [ 1298.854667][T25329] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5709'. [ 1298.972569][T25332] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1299.000083][T25332] netlink: 112 bytes leftover after parsing attributes in process `syz.4.5709'. [ 1299.540669][ T5828] usb 5-1: new low-speed USB device number 64 using dummy_hcd [ 1299.772340][ T5828] usb 5-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 1299.782942][ T5828] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1299.848086][ T5828] usb 5-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1299.943779][ T5828] usb 5-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 1299.955962][ T5828] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1299.966234][ T5828] usb 5-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1299.983746][ T5828] usb 5-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 1299.997199][ T5828] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1300.024089][ T5828] usb 5-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1300.073145][ T5828] usb 5-1: string descriptor 0 read error: -22 [ 1300.091073][ T5828] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1300.100273][ T5828] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1300.144970][ T5828] adutux 5-1:168.0: interrupt endpoints not found [ 1300.222748][ T5907] usb 3-1: USB disconnect, device number 79 [ 1300.335117][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.346828][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.382483][T25345] xt_hashlimit: size too large, truncated to 1048576 [ 1301.111281][T25355] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5714'. [ 1301.193048][T25358] IPVS: sync thread started: state = MASTER, mcast_ifn = sit0, syncid = 4, id = 0 [ 1301.525082][ T5929] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1301.683406][ T5929] usb 4-1: device descriptor read/64, error -71 [ 1301.827566][ T5887] usb 5-1: USB disconnect, device number 64 [ 1301.950648][ T5929] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1302.091686][ T5929] usb 4-1: device descriptor read/64, error -71 [ 1302.170191][T25361] fuse: Bad value for 'fd' [ 1302.201321][ T5929] usb usb4-port1: attempt power cycle [ 1302.600581][ T5929] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1302.651136][ T5929] usb 4-1: device descriptor read/8, error -71 [ 1302.690639][ T5887] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 1302.884838][ T5887] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1302.920580][ T5887] usb 2-1: Duplicate descriptor for config 0 interface 0 altsetting 0, skipping [ 1302.929809][ T5929] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 1302.971174][ T5887] usb 2-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 1302.996361][ T5929] usb 4-1: device descriptor read/8, error -71 [ 1303.003073][ T5887] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1303.040834][ T5887] usb 2-1: Product: syz [ 1303.045063][ T5887] usb 2-1: Manufacturer: syz [ 1303.049713][ T5887] usb 2-1: SerialNumber: syz [ 1303.130989][ T5929] usb usb4-port1: unable to enumerate USB device [ 1303.149480][ T5887] usb 2-1: config 0 descriptor?? [ 1303.211422][T25374] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5720'. [ 1303.270773][T25374] netlink: 'syz.2.5720': attribute type 30 has an invalid length. [ 1303.416383][ T5887] usb 2-1: USB disconnect, device number 90 [ 1303.430051][T25375] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5720'. [ 1303.441175][T25375] netlink: 'syz.2.5720': attribute type 30 has an invalid length. [ 1303.502689][T23163] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1303.515380][T23163] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1303.590729][T23163] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1303.599540][T23163] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1304.353462][ T5907] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1304.491063][ T5887] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 1304.560812][ T5907] usb 2-1: Using ep0 maxpacket: 16 [ 1304.568128][ T5907] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1304.711755][ T5887] usb 3-1: Using ep0 maxpacket: 16 [ 1304.771199][ T5887] usb 3-1: config 0 has no interfaces? [ 1304.794319][ T5907] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1304.821863][ T5887] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1304.840698][ T5887] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1304.848879][ T5907] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1304.881499][ T5887] usb 3-1: Manufacturer: syz [ 1304.888106][ T5907] usb 2-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 1304.911397][ T5887] usb 3-1: config 0 descriptor?? [ 1304.949601][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1305.044797][ T5907] usb 2-1: config 0 descriptor?? [ 1305.211340][T25389] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1305.367889][T25334] Set syz1 is full, maxelem 65536 reached [ 1305.514806][ T5907] hid-multitouch 0003:0457:07DA.0070: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.1-1/input0 [ 1305.656038][T25410] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5729'. [ 1307.097454][ T5907] usb 2-1: USB disconnect, device number 91 [ 1307.148887][ T5826] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1307.160370][ T5826] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1307.179104][ T5826] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1307.194295][ T5826] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1307.201942][ T5826] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1307.361439][T23163] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1307.598825][T25431] chnl_net:caif_netlink_parms(): no params data found [ 1307.646072][ T5916] usb 3-1: USB disconnect, device number 80 [ 1307.780593][ T5907] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1308.110604][ T5907] usb 2-1: Using ep0 maxpacket: 8 [ 1308.139177][ T5907] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1308.183711][ T5907] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1308.222590][ T5907] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1308.295134][T25431] bridge0: port 1(bridge_slave_0) entered blocking state [ 1308.330849][T25431] bridge0: port 1(bridge_slave_0) entered disabled state [ 1308.338117][T25431] bridge_slave_0: entered allmulticast mode [ 1308.347157][T25431] bridge_slave_0: entered promiscuous mode [ 1308.354990][ T5907] usb 2-1: Product: syz [ 1308.356240][T25431] bridge0: port 2(bridge_slave_1) entered blocking state [ 1308.361230][ T5907] usb 2-1: Manufacturer: syz [ 1308.403052][T25451] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5738'. [ 1308.510733][ T5907] usb 2-1: SerialNumber: syz [ 1308.556108][T25431] bridge0: port 2(bridge_slave_1) entered disabled state [ 1308.573916][T25431] bridge_slave_1: entered allmulticast mode [ 1308.611860][T25431] bridge_slave_1: entered promiscuous mode [ 1308.862810][T20766] bond1: (slave syz_tun): Releasing active interface [ 1308.869557][T20766] syz_tun (unregistering): left promiscuous mode [ 1308.884504][ T5907] usb 2-1: palm_os_3_probe - error -110 getting connection information [ 1308.904087][ T5907] visor 2-1:1.0: probe with driver visor failed with error -110 [ 1308.928493][T25463] SET target dimension over the limit! [ 1308.951544][T20766] syz_tun (unregistering): left allmulticast mode [ 1309.070585][ T5916] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1309.251784][T25431] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1309.267840][T25468] macsec1: entered promiscuous mode [ 1309.273524][T25468] dummy0: entered promiscuous mode [ 1309.283060][ T5916] usb 3-1: Using ep0 maxpacket: 16 [ 1309.288485][ T5826] Bluetooth: hci1: command tx timeout [ 1309.296825][T25468] dummy0: left promiscuous mode [ 1309.312514][ T5916] usb 3-1: config 0 has no interfaces? [ 1309.363863][ T5916] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1309.373530][ T5916] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1309.386137][ T5916] usb 3-1: Manufacturer: syz [ 1309.402752][ T5916] usb 3-1: config 0 descriptor?? [ 1309.479996][T25431] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1309.519704][T25471] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1309.532710][T25472] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1309.868769][ T5907] usb 2-1: USB disconnect, device number 92 [ 1309.969030][T25431] team0: Port device team_slave_0 added [ 1309.998861][T25431] team0: Port device team_slave_1 added [ 1310.088175][T25431] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1310.181099][T25431] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1310.222075][T25431] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1310.251849][T25431] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1310.259042][T25431] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1310.286715][T25431] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1310.623692][T25431] hsr_slave_0: entered promiscuous mode [ 1310.635635][T25431] hsr_slave_1: entered promiscuous mode [ 1310.701244][T25431] debugfs: 'hsr0' already exists in 'hsr' [ 1310.721955][ T5828] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1310.732111][T25431] Cannot create hsr debugfs directory [ 1310.868760][ T5907] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1311.005285][ T5828] usb 6-1: Using ep0 maxpacket: 16 [ 1311.020618][ T5828] usb 6-1: config 0 has no interfaces? [ 1311.027572][ T5828] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1311.073782][ T5828] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1311.083274][ T5828] usb 6-1: Manufacturer: syz [ 1311.090613][ T5907] usb 2-1: Using ep0 maxpacket: 32 [ 1311.108830][ T5828] usb 6-1: config 0 descriptor?? [ 1311.139010][ T5907] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1311.163106][ T5907] usb 2-1: config 0 has no interface number 0 [ 1311.190601][ T5907] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1311.233202][ T5907] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1311.263349][ T5907] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1311.291574][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1311.358176][T25483] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1311.370106][ T5826] Bluetooth: hci1: command tx timeout [ 1311.373058][ T5907] usb 2-1: config 0 descriptor?? [ 1311.426334][T25489] syzkaller0: entered promiscuous mode [ 1311.433253][T25489] syzkaller0: entered allmulticast mode [ 1311.455492][ T5916] usb 3-1: USB disconnect, device number 81 [ 1311.818283][ T5907] hid_parser_main: 51 callbacks suppressed [ 1311.818303][ T5907] ft260 0003:0403:6030.0071: unknown main item tag 0x0 [ 1312.064786][T25499] fuse: Bad value for 'rootmode' [ 1312.146400][ T5907] ft260 0003:0403:6030.0071: chip code: 6424 8183 [ 1312.261952][T25431] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1312.390703][T25431] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1312.411092][ T5907] ft260 0003:0403:6030.0071: uart interface is not supported [ 1312.473739][T25431] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1312.753892][T25431] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1312.795190][T25431] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1312.836763][T25431] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1313.223409][T25431] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1313.245801][T25431] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1313.277174][T25431] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1313.429862][T25431] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1313.446396][ T5826] Bluetooth: hci1: command tx timeout [ 1313.450437][T25431] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1313.464885][T18650] usb 6-1: USB disconnect, device number 8 [ 1313.520744][T25431] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1313.903092][T18650] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1313.910662][T25431] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1313.925446][T25431] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1314.001661][T25431] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1314.080912][T18650] usb 6-1: device descriptor read/64, error -71 [ 1314.116453][ T796] usb 2-1: USB disconnect, device number 93 [ 1314.202636][T25431] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1314.336678][T18650] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1314.485292][T18650] usb 6-1: device descriptor read/64, error -71 [ 1314.503261][T25431] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1314.539868][ T5907] hid-generic 0000:0000:0000.0072: unknown main item tag 0x0 [ 1314.545866][T25431] 8021q: adding VLAN 0 to HW filter on device team0 [ 1314.568167][ T5907] hid-generic 0000:0000:0000.0072: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1314.604011][T25537] bridge0: port 1(bridge_slave_0) entered blocking state [ 1314.611174][T25537] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1314.619779][T18650] usb usb6-port1: attempt power cycle [ 1314.648608][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 1314.655839][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1314.682798][T25562] fuse: Unknown parameter 'ÿÿ0x0000000000000007' [ 1314.836478][T25431] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1314.928452][T25431] veth0_vlan: entered promiscuous mode [ 1314.950361][T25431] veth1_vlan: entered promiscuous mode [ 1315.087145][T18650] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1315.141364][T18650] usb 6-1: device descriptor read/8, error -71 [ 1315.308210][T25431] veth0_macvtap: entered promiscuous mode [ 1315.335356][T25570] geneve2: entered promiscuous mode [ 1315.345203][T25431] veth1_macvtap: entered promiscuous mode [ 1315.380670][T18650] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1315.384251][T25431] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1315.411479][T18650] usb 6-1: device descriptor read/8, error -71 [ 1315.426024][T25431] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1315.454452][T25539] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1315.521713][ T5826] Bluetooth: hci1: command tx timeout [ 1315.528095][T18650] usb usb6-port1: unable to enumerate USB device [ 1315.565253][T25539] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1315.589582][T25539] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1315.634925][T25578] fuse: Bad value for 'rootmode' [ 1315.649926][T25539] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1316.038446][ T86] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1316.090939][ T86] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1316.245607][T25539] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1316.268198][T25539] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1316.470596][ T5887] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1316.630055][ T5887] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1316.662267][T25590] netlink: 'syz.3.5765': attribute type 10 has an invalid length. [ 1316.667085][ T5887] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1316.703402][T25590] team0: Device vxcan1 is of different type [ 1316.773011][ T5887] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1316.828988][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1316.857714][T25593] tipc: Enabled bearer , priority 0 [ 1316.885151][T25593] syzkaller0: entered promiscuous mode [ 1316.892222][T25593] syzkaller0: entered allmulticast mode [ 1316.898442][T25581] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1316.964516][ T5887] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1317.008127][T25592] tipc: Resetting bearer [ 1317.120664][T18650] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1317.134295][T25592] tipc: Disabling bearer [ 1317.342638][T18650] usb 5-1: Using ep0 maxpacket: 16 [ 1317.466502][T18650] usb 5-1: config 0 has no interfaces? [ 1317.477859][T25581] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 1317.500932][T18650] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1317.512511][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1317.542924][ T5887] usb 3-1: USB disconnect, device number 82 [ 1317.554903][T18650] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1317.593248][T18650] usb 5-1: Manufacturer: syz [ 1317.608293][T25602] FAULT_INJECTION: forcing a failure. [ 1317.608293][T25602] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1317.627184][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1317.627938][T25602] CPU: 0 UID: 0 PID: 25602 Comm: syz.5.5769 Tainted: G L syzkaller #0 PREEMPT(full) [ 1317.627965][T25602] Tainted: [L]=SOFTLOCKUP [ 1317.627973][T25602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1317.627984][T25602] Call Trace: [ 1317.627992][T25602] [ 1317.628000][T25602] dump_stack_lvl+0xe8/0x150 [ 1317.628031][T25602] should_fail_ex+0x412/0x560 [ 1317.628064][T25602] _copy_to_iter+0x589/0x17d0 [ 1317.628082][T25602] ? unwind_get_return_address+0x4d/0x90 [ 1317.628123][T25602] ? __pfx__copy_to_iter+0x10/0x10 [ 1317.628142][T25602] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1317.628198][T25602] ? lockdep_hardirqs_on+0x7a/0x110 [ 1317.628223][T25602] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1317.628245][T25602] ? __skb_try_recv_datagram+0x3d4/0x4d0 [ 1317.628283][T25602] __skb_datagram_iter+0xf8/0x980 [ 1317.628309][T25602] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 1317.628342][T25602] skb_copy_datagram_iter+0xb5/0x270 [ 1317.628371][T25602] netlink_recvmsg+0x2c3/0xa50 [ 1317.628399][T25602] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1317.628424][T25602] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1317.628454][T25602] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1317.628473][T25602] ? security_socket_recvmsg+0x7e/0x2c0 [ 1317.628494][T25602] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1317.628514][T25602] sock_recvmsg+0x172/0x1b0 [ 1317.628536][T25602] ____sys_recvmsg+0x1e6/0x4a0 [ 1317.628567][T25602] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1317.628605][T25602] ? import_iovec+0x73/0xa0 [ 1317.628630][T25602] ___sys_recvmsg+0x215/0x590 [ 1317.628659][T25602] ? __pfx____sys_recvmsg+0x10/0x10 [ 1317.628705][T25602] ? __fget_files+0x3a0/0x420 [ 1317.628732][T25602] do_recvmmsg+0x334/0x800 [ 1317.628764][T25602] ? __pfx_do_recvmmsg+0x10/0x10 [ 1317.628799][T25602] ? _copy_from_user+0x94/0xb0 [ 1317.628834][T25602] __x64_sys_recvmmsg+0x1b7/0x250 [ 1317.628862][T25602] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1317.628897][T25602] do_syscall_64+0x14d/0xf80 [ 1317.628920][T25602] ? trace_irq_disable+0x3b/0x150 [ 1317.628936][T25602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.628955][T25602] ? clear_bhb_loop+0x40/0x90 [ 1317.628977][T25602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.628996][T25602] RIP: 0033:0x7fec6539c819 [ 1317.629013][T25602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1317.629027][T25602] RSP: 002b:00007fec66233028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1317.629048][T25602] RAX: ffffffffffffffda RBX: 00007fec65615fa0 RCX: 00007fec6539c819 [ 1317.629061][T25602] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 1317.629074][T25602] RBP: 00007fec66233090 R08: 0000200000003700 R09: 0000000000000000 [ 1317.629086][T25602] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 1317.629097][T25602] R13: 00007fec65616038 R14: 00007fec65615fa0 R15: 00007fec6573fa48 [ 1317.629126][T25602] [ 1317.947372][T18650] usb 5-1: config 0 descriptor?? [ 1318.005912][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1318.022657][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1318.032645][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1318.042144][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1318.092765][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1318.116712][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1318.128413][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1318.138116][T25599] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5767'. [ 1318.407520][T25594] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1318.498621][T25613] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1319.101867][T25638] fuse: Bad value for 'rootmode' [ 1319.290585][ T5828] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1319.551854][ T5828] usb 3-1: Using ep0 maxpacket: 16 [ 1319.570345][ T5828] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1319.592429][ T5828] usb 3-1: config 0 has no interfaces? [ 1319.612445][ T5828] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1319.621786][ T5828] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1319.629855][ T5828] usb 3-1: Manufacturer: syz [ 1319.637339][T25645] FAULT_INJECTION: forcing a failure. [ 1319.637339][T25645] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1319.653635][ T5828] usb 3-1: config 0 descriptor?? [ 1319.683780][T25645] CPU: 0 UID: 0 PID: 25645 Comm: syz.1.5780 Tainted: G L syzkaller #0 PREEMPT(full) [ 1319.683816][T25645] Tainted: [L]=SOFTLOCKUP [ 1319.683825][T25645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1319.683836][T25645] Call Trace: [ 1319.683843][T25645] [ 1319.683849][T25645] dump_stack_lvl+0xe8/0x150 [ 1319.683871][T25645] should_fail_ex+0x412/0x560 [ 1319.683894][T25645] _copy_to_iter+0x589/0x17d0 [ 1319.683907][T25645] ? unwind_get_return_address+0x4d/0x90 [ 1319.683934][T25645] ? __pfx__copy_to_iter+0x10/0x10 [ 1319.683947][T25645] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1319.683963][T25645] ? lockdep_hardirqs_on+0x7a/0x110 [ 1319.683979][T25645] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1319.683995][T25645] ? __skb_try_recv_datagram+0x3d4/0x4d0 [ 1319.684016][T25645] __skb_datagram_iter+0xf8/0x980 [ 1319.684034][T25645] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 1319.684056][T25645] skb_copy_datagram_iter+0xb5/0x270 [ 1319.684076][T25645] netlink_recvmsg+0x2c3/0xa50 [ 1319.684095][T25645] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1319.684112][T25645] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1319.684140][T25645] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1319.684164][T25645] ? security_socket_recvmsg+0x7e/0x2c0 [ 1319.684187][T25645] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1319.684209][T25645] sock_recvmsg+0x172/0x1b0 [ 1319.684234][T25645] ____sys_recvmsg+0x1e6/0x4a0 [ 1319.684270][T25645] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1319.684314][T25645] ? import_iovec+0x73/0xa0 [ 1319.684343][T25645] ___sys_recvmsg+0x215/0x590 [ 1319.684376][T25645] ? __pfx____sys_recvmsg+0x10/0x10 [ 1319.684426][T25645] ? __fget_files+0x3a0/0x420 [ 1319.684457][T25645] do_recvmmsg+0x334/0x800 [ 1319.684503][T25645] ? __pfx_do_recvmmsg+0x10/0x10 [ 1319.684544][T25645] ? _copy_from_user+0x94/0xb0 [ 1319.684585][T25645] __x64_sys_recvmmsg+0x1b7/0x250 [ 1319.684616][T25645] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1319.684658][T25645] do_syscall_64+0x14d/0xf80 [ 1319.684685][T25645] ? trace_irq_disable+0x3b/0x150 [ 1319.684704][T25645] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1319.684726][T25645] ? clear_bhb_loop+0x40/0x90 [ 1319.684752][T25645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1319.684773][T25645] RIP: 0033:0x7f70e9d9c819 [ 1319.684794][T25645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1319.684812][T25645] RSP: 002b:00007f70eab6e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1319.684835][T25645] RAX: ffffffffffffffda RBX: 00007f70ea015fa0 RCX: 00007f70e9d9c819 [ 1319.684850][T25645] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 1319.684864][T25645] RBP: 00007f70eab6e090 R08: 0000200000003700 R09: 0000000000000000 [ 1319.684877][T25645] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 1319.684889][T25645] R13: 00007f70ea016038 R14: 00007f70ea015fa0 R15: 00007f70ea13fa48 [ 1319.684921][T25645] [ 1320.094659][T25634] netlink: 'syz.2.5774': attribute type 1 has an invalid length. [ 1320.442849][T25634] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1320.690408][T25648] syzkaller0: entered promiscuous mode [ 1320.710695][T25648] syzkaller0: entered allmulticast mode [ 1321.198721][T25654] FAULT_INJECTION: forcing a failure. [ 1321.198721][T25654] name failslab, interval 1, probability 0, space 0, times 0 [ 1321.271728][T18650] usb 5-1: USB disconnect, device number 65 [ 1321.291302][T25654] CPU: 0 UID: 0 PID: 25654 Comm: syz.3.5783 Tainted: G L syzkaller #0 PREEMPT(full) [ 1321.291325][T25654] Tainted: [L]=SOFTLOCKUP [ 1321.291331][T25654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1321.291338][T25654] Call Trace: [ 1321.291345][T25654] [ 1321.291351][T25654] dump_stack_lvl+0xe8/0x150 [ 1321.291374][T25654] should_fail_ex+0x412/0x560 [ 1321.291402][T25654] should_failslab+0xa8/0x100 [ 1321.291427][T25654] ? skb_clone+0x212/0x3a0 [ 1321.291445][T25654] kmem_cache_alloc_noprof+0x87/0x650 [ 1321.291458][T25654] ? __netlink_lookup+0xc6/0x8b0 [ 1321.291477][T25654] skb_clone+0x212/0x3a0 [ 1321.291496][T25654] __netlink_deliver_tap+0x404/0x850 [ 1321.291517][T25654] ? netlink_deliver_tap+0x2e/0x1b0 [ 1321.291531][T25654] netlink_deliver_tap+0x19c/0x1b0 [ 1321.291545][T25654] netlink_unicast+0x7e3/0x9b0 [ 1321.291574][T25654] ? __pfx_netlink_unicast+0x10/0x10 [ 1321.291594][T25654] ? netlink_sendmsg+0x650/0xb40 [ 1321.291607][T25654] ? skb_put+0x11b/0x210 [ 1321.291623][T25654] netlink_sendmsg+0x813/0xb40 [ 1321.291642][T25654] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1321.291658][T25654] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1321.291678][T25654] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1321.291695][T25654] ____sys_sendmsg+0x972/0x9f0 [ 1321.291717][T25654] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1321.291739][T25654] ? import_iovec+0x73/0xa0 [ 1321.291756][T25654] ___sys_sendmsg+0x2a5/0x360 [ 1321.291776][T25654] ? __pfx____sys_sendmsg+0x10/0x10 [ 1321.291812][T25654] ? __fget_files+0x2a/0x420 [ 1321.291823][T25654] ? __fget_files+0x3a0/0x420 [ 1321.291840][T25654] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1321.291858][T25654] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1321.291888][T25654] ? __pfx_ksys_write+0x10/0x10 [ 1321.291923][T25654] do_syscall_64+0x14d/0xf80 [ 1321.291950][T25654] ? trace_irq_disable+0x3b/0x150 [ 1321.291968][T25654] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1321.291982][T25654] ? clear_bhb_loop+0x40/0x90 [ 1321.291997][T25654] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1321.292010][T25654] RIP: 0033:0x7ffa43f9c819 [ 1321.292023][T25654] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1321.292033][T25654] RSP: 002b:00007ffa44f0a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1321.292048][T25654] RAX: ffffffffffffffda RBX: 00007ffa44215fa0 RCX: 00007ffa43f9c819 [ 1321.292058][T25654] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1321.292066][T25654] RBP: 00007ffa44f0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1321.292074][T25654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1321.292081][T25654] R13: 00007ffa44216038 R14: 00007ffa44215fa0 R15: 00007ffa4433fa48 [ 1321.292100][T25654] [ 1322.158164][T25671] input: syz1 as /devices/virtual/input/input116 [ 1322.174035][T25671] input: failed to attach handler leds to device input116, error: -6 [ 1322.761718][T25683] fuse: Bad value for 'rootmode' [ 1323.428753][ T5828] usb 3-1: USB disconnect, device number 83 [ 1323.435122][ T5914] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1323.610861][ T5914] usb 4-1: Using ep0 maxpacket: 16 [ 1323.656528][ T5914] usb 4-1: config 0 has no interfaces? [ 1323.694037][ T5914] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1323.734156][T25539] bond0 (unregistering): Released all slaves [ 1323.744648][ T5914] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1323.789236][ T5914] usb 4-1: Manufacturer: syz [ 1323.805109][ T5914] usb 4-1: config 0 descriptor?? [ 1323.990619][T18650] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 1324.087942][T25695] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1324.202112][T18650] usb 3-1: Using ep0 maxpacket: 8 [ 1324.243800][T18650] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1324.260608][T18650] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1324.282130][T18650] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1324.301634][T18650] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1324.325263][T18650] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1324.340322][T18650] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1324.742902][T25711] netlink: 'syz.5.5798': attribute type 4 has an invalid length. [ 1324.757828][T25711] netlink: 'syz.5.5798': attribute type 4 has an invalid length. [ 1324.861829][T18650] usb 3-1: GET_CAPABILITIES returned 0 [ 1324.871379][T18650] usbtmc 3-1:16.0: can't read capabilities [ 1325.090214][T19096] usb 3-1: USB disconnect, device number 84 [ 1325.571264][T19096] usb 4-1: USB disconnect, device number 69 [ 1326.316002][ T5828] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1326.348159][T25749] fuse: Bad value for 'rootmode' [ 1326.381501][T25748] x_tables: duplicate underflow at hook 2 [ 1326.542424][ T5828] usb 5-1: Using ep0 maxpacket: 8 [ 1326.732878][ T5828] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1326.762168][ T5828] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1326.772851][ T5828] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1326.834381][ T5828] usb 5-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 1326.844072][ T5828] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1326.853282][ T5828] usb 5-1: Product: syz [ 1326.857727][ T5828] usb 5-1: Manufacturer: syz [ 1326.908343][ T5828] usb 5-1: SerialNumber: syz [ 1327.036138][ T5914] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1327.230719][ T5914] usb 2-1: Using ep0 maxpacket: 16 [ 1327.257636][ T5914] usb 2-1: config 0 has no interfaces? [ 1327.285678][ T5914] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1327.312687][ T5914] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1327.329026][ T5914] usb 2-1: Manufacturer: syz [ 1327.351912][ T5914] usb 2-1: config 0 descriptor?? [ 1327.373087][T25737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1327.438744][T25737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1327.632451][T25759] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1327.883369][ T5828] usb 5-1: cannot find UAC_HEADER [ 1327.901401][T25764] FAULT_INJECTION: forcing a failure. [ 1327.901401][T25764] name failslab, interval 1, probability 0, space 0, times 0 [ 1327.914659][T25764] CPU: 1 UID: 0 PID: 25764 Comm: syz.3.5814 Tainted: G L syzkaller #0 PREEMPT(full) [ 1327.914681][T25764] Tainted: [L]=SOFTLOCKUP [ 1327.914686][T25764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1327.914694][T25764] Call Trace: [ 1327.914700][T25764] [ 1327.914706][T25764] dump_stack_lvl+0xe8/0x150 [ 1327.914730][T25764] should_fail_ex+0x412/0x560 [ 1327.914753][T25764] should_failslab+0xa8/0x100 [ 1327.914771][T25764] __kmalloc_noprof+0xe8/0x760 [ 1327.914785][T25764] ? percpu_ref_get_many+0x21/0x1e0 [ 1327.914798][T25764] ? io_cache_alloc_new+0x40/0x100 [ 1327.914813][T25764] io_cache_alloc_new+0x40/0x100 [ 1327.914826][T25764] __io_prep_rw+0x2bd/0xed0 [ 1327.914844][T25764] ? __pfx___io_prep_rw+0x10/0x10 [ 1327.914858][T25764] ? __pfx___io_alloc_req_refill+0x10/0x10 [ 1327.914881][T25764] io_prep_read+0x33/0x110 [ 1327.914893][T25764] ? blk_start_plug_nr_ios+0x7e/0x1c0 [ 1327.914911][T25764] io_submit_sqes+0xbf0/0x24e0 [ 1327.914943][T25764] __se_sys_io_uring_enter+0x2c6/0x1960 [ 1327.914961][T25764] ? __fget_files+0x3a0/0x420 [ 1327.914976][T25764] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1327.914990][T25764] ? fput+0xa0/0xd0 [ 1327.915008][T25764] ? ksys_write+0x242/0x270 [ 1327.915024][T25764] ? __pfx_ksys_write+0x10/0x10 [ 1327.915040][T25764] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1327.915056][T25764] do_syscall_64+0x14d/0xf80 [ 1327.915075][T25764] ? trace_irq_disable+0x3b/0x150 [ 1327.915087][T25764] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1327.915107][T25764] ? clear_bhb_loop+0x40/0x90 [ 1327.915122][T25764] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1327.915134][T25764] RIP: 0033:0x7ffa43f9c819 [ 1327.915147][T25764] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1327.915158][T25764] RSP: 002b:00007ffa44f0a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1327.915172][T25764] RAX: ffffffffffffffda RBX: 00007ffa44215fa0 RCX: 00007ffa43f9c819 [ 1327.915182][T25764] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 1327.915190][T25764] RBP: 00007ffa44f0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1327.915197][T25764] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 1327.915205][T25764] R13: 00007ffa44216038 R14: 00007ffa44215fa0 R15: 00007ffa4433fa48 [ 1327.915223][T25764] [ 1328.522873][ T5828] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1328.542838][ T5828] usb 5-1: USB disconnect, device number 66 [ 1328.549646][T23987] udevd[23987]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1328.940618][ T5914] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1329.190589][ T5914] usb 4-1: Using ep0 maxpacket: 8 [ 1329.220553][ T5914] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1329.242642][ T5914] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1329.267474][ T5914] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1329.370806][T18650] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 1329.484035][ T5914] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1329.510175][T25791] bridge0: entered promiscuous mode [ 1329.515759][T25791] bridge0: entered allmulticast mode [ 1329.549029][ T5914] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1329.565773][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1329.585799][T18650] usb 3-1: config index 0 descriptor too short (expected 8192, got 36) [ 1329.606156][T18650] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1329.677125][T18650] usb 3-1: config 0 has no interfaces? [ 1329.774885][T19096] usb 2-1: USB disconnect, device number 94 [ 1329.834129][T18650] usb 3-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1329.839602][ T5914] usb 4-1: GET_CAPABILITIES returned 0 [ 1329.866180][ T5914] usbtmc 4-1:16.0: can't read capabilities [ 1329.905502][T18650] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1330.112187][T18650] usb 3-1: config 0 descriptor?? [ 1330.170103][T25776] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1330.179075][T25776] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1330.211952][T25798] tipc: Failed to remove unknown binding: 66,1,1/0:1972245003/1972245005 [ 1330.476608][T25776] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1330.572584][T25806] x_tables: duplicate underflow at hook 2 [ 1330.968629][T25802] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1331.006615][T25811] fuse: Bad value for 'group_id' [ 1331.011649][T25811] fuse: Bad value for 'group_id' [ 1331.187443][T25814] __nla_validate_parse: 56 callbacks suppressed [ 1331.187458][T25814] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5828'. [ 1331.213890][T25814] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5828'. [ 1331.890898][T25820] syzkaller0: entered promiscuous mode [ 1331.901643][T25820] syzkaller0: entered allmulticast mode [ 1331.935907][T25820] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5831'. [ 1331.954574][T25820] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1331.961849][T25820] IPv6: NLM_F_CREATE should be set when creating new route [ 1331.969166][T25820] IPv6: NLM_F_CREATE should be set when creating new route [ 1332.180375][T18650] usb 4-1: USB disconnect, device number 70 [ 1332.573996][T25836] lo: Caught tx_queue_len zero misconfig [ 1332.844981][T19096] usb 3-1: USB disconnect, device number 85 [ 1333.249835][T18650] usb 4-1: new low-speed USB device number 71 using dummy_hcd [ 1333.507536][T18650] usb 4-1: device descriptor read/64, error -71 [ 1333.727881][T25853] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5839'. [ 1333.727900][T25853] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5839'. [ 1333.780563][T18650] usb 4-1: new low-speed USB device number 72 using dummy_hcd [ 1334.013183][T18650] usb 4-1: device descriptor read/64, error -71 [ 1334.032748][T25861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5840'. [ 1334.210193][T18650] usb usb4-port1: attempt power cycle [ 1334.270782][ T5887] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1334.450548][ T5887] usb 3-1: Using ep0 maxpacket: 16 [ 1334.468692][ T5887] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1334.484557][ T5887] usb 3-1: config 0 has no interfaces? [ 1334.561881][ T5887] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1334.571406][T18650] usb 4-1: new low-speed USB device number 73 using dummy_hcd [ 1334.589949][ T5887] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1334.600153][T18650] usb 4-1: device descriptor read/8, error -71 [ 1334.613284][ T5887] usb 3-1: Manufacturer: syz [ 1334.671629][ T5887] usb 3-1: config 0 descriptor?? [ 1334.730601][ T5828] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1334.850611][T18650] usb 4-1: new low-speed USB device number 74 using dummy_hcd [ 1334.880735][ T5828] usb 6-1: device descriptor read/64, error -71 [ 1334.929648][T18650] usb 4-1: device descriptor read/8, error -71 [ 1335.022437][T25857] netlink: 'syz.2.5836': attribute type 1 has an invalid length. [ 1335.053842][T18650] usb usb4-port1: unable to enumerate USB device [ 1335.130585][ T5828] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1335.240598][T19096] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1335.305899][T25857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1335.331282][ T5828] usb 6-1: device descriptor read/64, error -71 [ 1335.416535][T19096] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 128, changing to 7 [ 1335.433874][T19096] usb 2-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice= 0.40 [ 1335.456347][ T5828] usb usb6-port1: attempt power cycle [ 1335.464434][T19096] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1335.489550][T19096] usb 2-1: Product: syz [ 1335.499683][T19096] usb 2-1: Manufacturer: syz [ 1335.511682][T19096] usb 2-1: SerialNumber: syz [ 1335.800726][ T5828] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1335.834198][ T5828] usb 6-1: device descriptor read/8, error -71 [ 1335.914748][T25881] geneve3: entered promiscuous mode [ 1335.990108][T19096] usb 2-1: USB disconnect, device number 95 [ 1336.100618][ T5828] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1336.144843][ T5828] usb 6-1: device descriptor read/8, error -71 [ 1336.270961][ T5828] usb usb6-port1: unable to enumerate USB device [ 1336.578668][T25900] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5852'. [ 1336.930592][ T5887] usb 3-1: USB disconnect, device number 86 [ 1336.977523][T25903] netlink: 100 bytes leftover after parsing attributes in process `syz.3.5853'. [ 1337.210186][T25539] bond0 (unregistering): Released all slaves [ 1337.471027][ T5887] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 1337.508721][T25917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5857'. [ 1337.670716][ T5887] usb 3-1: Using ep0 maxpacket: 8 [ 1337.810166][ T5887] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1337.822046][ T5887] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1337.833049][ T5887] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1337.846885][ T5887] usb 3-1: Product: syz [ 1337.855618][ T5887] usb 3-1: Manufacturer: syz [ 1337.866900][ T5887] usb 3-1: SerialNumber: syz [ 1338.250904][ T5887] usb 3-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 1338.341630][ T5887] usb 3-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 1338.384324][ T5887] usb 3-1: Handspring Visor / Palm OS: Number of ports: 2 [ 1338.419134][ T5887] visor 3-1:1.0: Handspring Visor / Palm OS converter detected [ 1338.473105][ T5887] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 1338.513773][ T5887] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 1338.720747][ T5929] usb 2-1: new low-speed USB device number 96 using dummy_hcd [ 1339.009043][ T5929] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1339.019091][ T5929] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1339.031031][ T5929] usb 2-1: config 0 has no interface number 0 [ 1339.049593][ T5929] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1339.073956][ T5929] usb 2-1: config 0 interface 55 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1339.115615][ T5929] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1339.143611][ T5929] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1339.147656][ T5916] usb 3-1: USB disconnect, device number 87 [ 1339.163129][ T5929] usb 2-1: config 0 descriptor?? [ 1339.167733][ T5916] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 1339.177402][ T5929] ldusb 2-1:0.55: Interrupt in endpoint not found [ 1339.215876][ T5916] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 1339.246142][ T5916] visor 3-1:1.0: device disconnected [ 1339.301478][T25937] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5863'. [ 1339.311568][ T5914] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1339.370560][ T36] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1339.402603][ T5929] usb 2-1: USB disconnect, device number 96 [ 1339.462408][ T5914] usb 5-1: Using ep0 maxpacket: 32 [ 1339.482211][ T5914] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 25963, setting to 1024 [ 1339.497069][ T5914] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1339.508811][ T5914] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1339.524245][ T5914] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1339.533848][ T5914] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1339.542234][ T5914] usb 5-1: Product: syz [ 1339.547714][ T5914] usb 5-1: Manufacturer: syz [ 1339.552965][ T5914] usb 5-1: SerialNumber: syz [ 1339.563769][ T5914] usb 5-1: config 0 descriptor?? [ 1339.569840][T25935] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 1339.733106][T25946] netlink: 100 bytes leftover after parsing attributes in process `syz.5.5865'. [ 1339.985391][ T5914] gs_usb 5-1:0.0: Configuring for 1 interfaces [ 1340.138179][T25961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1340.176432][T25961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1340.216818][ T5914] gs_usb 5-1:0.0: Couldn't get bit timing const for channel 0 (-EPROTO) [ 1340.231624][ T5914] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -71 [ 1340.253124][ T5914] usb 5-1: USB disconnect, device number 67 [ 1340.310442][T25968] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5874'. [ 1340.333758][T25974] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5873'. [ 1340.364510][T25976] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5872'. [ 1340.402118][ T5916] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 1341.530579][ T5916] usb 6-1: device descriptor read/64, error -71 [ 1341.560592][ T5828] usb 5-1: new low-speed USB device number 68 using dummy_hcd [ 1341.703188][T25995] tipc: Started in network mode [ 1341.708266][T25995] tipc: Node identity 32f4bc0d66dc, cluster identity 4711 [ 1341.719342][T25995] tipc: Enabled bearer , priority 0 [ 1341.728383][T25997] veth1_vlan: left promiscuous mode [ 1341.729606][ T5828] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 1341.742634][ T5828] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1341.753764][ T5828] usb 5-1: config 0 has no interface number 0 [ 1341.756882][T25997] netlink: 'syz.2.5884': attribute type 1 has an invalid length. [ 1341.759910][ T5828] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1341.779957][ T5916] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1341.789605][ T5828] usb 5-1: config 0 interface 55 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1341.803595][T25997] netlink: 'syz.2.5884': attribute type 2 has an invalid length. [ 1341.813128][T25995] syzkaller0: entered promiscuous mode [ 1341.818730][ T5828] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1341.835939][T25995] syzkaller0: entered allmulticast mode [ 1341.849705][ T5828] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1341.862087][ T5828] usb 5-1: config 0 descriptor?? [ 1341.867558][T25994] tipc: Resetting bearer [ 1341.880630][ T5828] ldusb 5-1:0.55: Interrupt in endpoint not found [ 1341.908416][T25994] tipc: Disabling bearer [ 1341.965006][ T5916] usb 6-1: Using ep0 maxpacket: 32 [ 1341.987028][ T5916] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 1341.995712][ T5916] usb 6-1: config 0 has no interface number 0 [ 1342.002713][ T5916] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1342.016181][ T5916] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1342.026298][ T5916] usb 6-1: config 0 interface 85 has no altsetting 0 [ 1342.036564][ T5916] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1342.045729][ T5916] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1342.054311][ T5916] usb 6-1: Product: syz [ 1342.056967][T26005] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5886'. [ 1342.058497][ T5916] usb 6-1: Manufacturer: syz [ 1342.058518][ T5916] usb 6-1: SerialNumber: syz [ 1342.061510][ T5916] usb 6-1: config 0 descriptor?? [ 1342.091210][ T5929] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1342.112766][T18650] usb 5-1: USB disconnect, device number 68 [ 1342.171236][ T5887] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1342.254752][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1342.276617][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1342.296203][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1342.306812][ T5929] usb 3-1: New USB device found, idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 1342.334061][ T5887] usb 2-1: Using ep0 maxpacket: 8 [ 1342.344024][ T5887] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1342.355049][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1342.365454][ T5887] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 1342.381976][ T5887] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1342.402387][ T5887] usb 2-1: config 0 descriptor?? [ 1342.408093][ T5929] usb 3-1: config 0 descriptor?? [ 1342.426866][ T5887] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 1342.652987][ T5916] appletouch 6-1:0.85: Failed to request geyser raw mode [ 1342.660338][ T5916] appletouch 6-1:0.85: probe with driver appletouch failed with error -5 [ 1342.689801][ T5916] usb 6-1: USB disconnect, device number 18 [ 1342.730587][T18650] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1342.933068][T18650] usb 4-1: Using ep0 maxpacket: 16 [ 1342.945181][T18650] usb 4-1: config 0 has no interfaces? [ 1342.954722][T18650] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1342.980569][T18650] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1342.990561][T18650] usb 4-1: Manufacturer: syz [ 1342.998056][T18650] usb 4-1: config 0 descriptor?? [ 1343.045778][T26021] IPVS: set_ctl: invalid protocol: 51 127.0.0.1:20001 [ 1343.360200][T26011] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1343.431037][ T5916] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1343.583384][ T5916] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1343.612254][ T5916] usb 5-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 1343.622768][ T5916] usb 5-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 1343.717056][ T5916] usb 5-1: Manufacturer: syz [ 1343.726314][ T5916] usb 5-1: SerialNumber: syz [ 1344.037735][ T5887] gspca_vc032x: reg_w err -71 [ 1344.043042][ T5887] vc032x 2-1:0.0: probe with driver vc032x failed with error -71 [ 1344.056494][ T5887] usb 2-1: USB disconnect, device number 97 [ 1344.257757][T26038] netlink: 'syz.5.5894': attribute type 322 has an invalid length. [ 1344.883753][ T5887] usb 3-1: USB disconnect, device number 88 [ 1345.370780][T26051] x_tables: unsorted underflow at hook 2 [ 1345.647869][T26056] fuse: Bad value for 'rootmode' [ 1345.814344][ T5887] usb 4-1: USB disconnect, device number 75 [ 1346.602588][ T5916] usbhid 5-1:36.0: couldn't find an input interrupt endpoint [ 1346.664042][T26071] netlink: 136 bytes leftover after parsing attributes in process `syz.1.5903'. [ 1346.690939][T26071] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1346.736189][ T5916] usb 5-1: USB disconnect, device number 69 [ 1346.742417][T26075] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5904'. [ 1346.976630][T26079] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5905'. [ 1347.849955][T26096] netlink: 'syz.3.5910': attribute type 322 has an invalid length. [ 1347.929194][ T5916] usb 6-1: new full-speed USB device number 19 using dummy_hcd [ 1348.149699][ T5916] usb 6-1: config 8 has an invalid interface number: 80 but max is 0 [ 1348.178041][ T5916] usb 6-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1348.389407][ T5916] usb 6-1: config 8 has no interface number 0 [ 1348.410673][ T5828] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 1348.432796][ T5916] usb 6-1: config 8 interface 80 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1348.454709][ T5916] usb 6-1: config 8 interface 80 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 14 [ 1348.470642][ T5916] usb 6-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice=c1.6f [ 1348.484039][ T5916] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1348.532194][T26093] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1348.594465][ T5916] usb 6-1: NFC: intf ffff88807de8c000 id ffffffff8f1d3060 [ 1348.609395][ T5828] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1348.618911][ T5828] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1348.651410][ T5828] usb 2-1: Product: syz [ 1348.663007][ T5828] usb 2-1: Manufacturer: syz [ 1348.667655][ T5828] usb 2-1: SerialNumber: syz [ 1348.692576][ T5828] usb 2-1: config 0 descriptor?? [ 1348.740374][T26108] netlink: 136 bytes leftover after parsing attributes in process `syz.2.5916'. [ 1348.815427][T26111] usb 6-1: USB disconnect, device number 19 [ 1348.831632][T26108] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1348.866231][T26114] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5917'. [ 1349.115817][ T5828] usb 2-1: Firmware version (0.0) predates our first public release. [ 1349.128926][ T5828] usb 2-1: Please update to version 0.2 or newer [ 1349.398243][ T5828] usb 2-1: Firmware: build [ 1349.410666][T26111] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 1349.560820][T26111] usb 3-1: device descriptor read/64, error -71 [ 1349.619571][T26132] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 1349.637768][T26132] dvmrp1: linktype set to 769 [ 1349.856847][T26111] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 1350.072644][T26111] usb 3-1: device descriptor read/64, error -71 [ 1350.165186][ T5916] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1350.190975][T26111] usb usb3-port1: attempt power cycle [ 1350.320623][ T5916] usb 4-1: Using ep0 maxpacket: 16 [ 1350.328337][ T5916] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1350.338851][ T5916] usb 4-1: config 0 has no interfaces? [ 1350.346036][ T5916] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1350.376634][ T5916] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1350.385467][ T5916] usb 4-1: Manufacturer: syz [ 1350.414643][ T5916] usb 4-1: config 0 descriptor?? [ 1350.530983][T26111] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1350.583015][T26111] usb 3-1: device descriptor read/8, error -71 [ 1350.698096][T26146] x_tables: duplicate underflow at hook 1 [ 1350.889283][T26138] netlink: 'syz.3.5923': attribute type 1 has an invalid length. [ 1350.920586][T26111] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1351.003345][T26138] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1351.071131][T26111] usb 3-1: device descriptor read/8, error -71 [ 1351.180832][T26111] usb usb3-port1: unable to enumerate USB device [ 1351.630139][T26153] netlink: 136 bytes leftover after parsing attributes in process `syz.5.5928'. [ 1351.665882][T26153] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1352.480883][T13342] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1352.510742][T13342] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1352.520366][T13342] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1352.563712][T13342] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1352.577827][T13342] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1352.598931][T26163] netlink: 'syz.2.5930': attribute type 322 has an invalid length. [ 1353.226401][T26111] usb 2-1: USB disconnect, device number 98 [ 1353.305672][ T5916] usb 4-1: USB disconnect, device number 76 [ 1353.350660][T21477] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1353.512815][T21477] usb 6-1: config index 0 descriptor too short (expected 65183, got 72) [ 1353.546301][T21477] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1353.568361][T21477] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.587230][T21477] usb 6-1: Product: syz [ 1353.596513][T21477] usb 6-1: Manufacturer: syz [ 1353.604322][T21477] usb 6-1: SerialNumber: syz [ 1353.630203][T26164] chnl_net:caif_netlink_parms(): no params data found [ 1353.653171][T21477] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1353.677587][T26111] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1353.905444][T26167] netlink: 36 bytes leftover after parsing attributes in process `syz.5.5931'. [ 1353.925425][T26164] bridge0: port 1(bridge_slave_0) entered blocking state [ 1353.937772][T26164] bridge0: port 1(bridge_slave_0) entered disabled state [ 1353.948628][T26164] bridge_slave_0: entered allmulticast mode [ 1353.980634][ T5914] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1353.982017][T26164] bridge_slave_0: entered promiscuous mode [ 1354.025628][T26164] bridge0: port 2(bridge_slave_1) entered blocking state [ 1354.029954][ T5828] usb 6-1: USB disconnect, device number 20 [ 1354.058495][T26164] bridge0: port 2(bridge_slave_1) entered disabled state [ 1354.089611][T26164] bridge_slave_1: entered allmulticast mode [ 1354.105908][T26182] sctp: [Deprecated]: syz.2.5935 (pid 26182) Use of int in max_burst socket option. [ 1354.105908][T26182] Use struct sctp_assoc_value instead [ 1354.122220][T26164] bridge_slave_1: entered promiscuous mode [ 1354.140556][ T5914] usb 4-1: Using ep0 maxpacket: 16 [ 1354.149631][ T5914] usb 4-1: config 128 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1354.158406][T26164] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1354.183119][ T5914] usb 4-1: config 128 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1354.186625][T26164] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1354.204854][ T5914] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1354.224376][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1354.317818][T26164] team0: Port device team_slave_0 added [ 1354.338968][T26164] team0: Port device team_slave_1 added [ 1354.410974][T26164] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1354.420208][T26164] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1354.449489][T26164] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1354.465316][T26164] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1354.509755][T26164] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1354.554394][T26164] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1354.650984][ T5826] Bluetooth: hci0: command tx timeout [ 1354.739674][ T5914] mcp2221 0003:04D8:00DD.0073: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 1354.773581][T26164] hsr_slave_0: entered promiscuous mode [ 1354.781028][T26164] hsr_slave_1: entered promiscuous mode [ 1354.788304][T26164] debugfs: 'hsr0' already exists in 'hsr' [ 1354.802683][T26111] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1354.810757][T26164] Cannot create hsr debugfs directory [ 1354.851320][T26111] ath9k_htc: Failed to initialize the device [ 1354.867243][ T5828] usb 6-1: ath9k_htc: USB layer deinitialized [ 1354.951752][ T5887] usb 4-1: USB disconnect, device number 77 [ 1355.206469][T26204] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1355.515878][T26209] x_tables: duplicate underflow at hook 3 [ 1355.607719][T26164] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1355.640550][T26164] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1355.673505][T26164] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1355.853493][T26164] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1355.878891][T26164] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1355.901818][T26164] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1356.424468][T26164] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1356.453004][T26164] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1356.494795][T26164] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1356.720815][ T5826] Bluetooth: hci0: command tx timeout [ 1356.756468][T26164] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1356.787982][T26164] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1356.844823][T26164] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1356.930199][T26209] netlink: 52 bytes leftover after parsing attributes in process `syz.5.5941'. [ 1356.930605][T26219] FAULT_INJECTION: forcing a failure. [ 1356.930605][T26219] name failslab, interval 1, probability 0, space 0, times 0 [ 1356.970985][T26219] CPU: 1 UID: 0 PID: 26219 Comm: syz.3.5943 Tainted: G L syzkaller #0 PREEMPT(full) [ 1356.971007][T26219] Tainted: [L]=SOFTLOCKUP [ 1356.971021][T26219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1356.971029][T26219] Call Trace: [ 1356.971034][T26219] [ 1356.971040][T26219] dump_stack_lvl+0xe8/0x150 [ 1356.971064][T26219] should_fail_ex+0x412/0x560 [ 1356.971086][T26219] should_failslab+0xa8/0x100 [ 1356.971104][T26219] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1356.971118][T26219] ? __alloc_skb+0x186/0x7d0 [ 1356.971133][T26219] ? __alloc_skb+0x1d0/0x7d0 [ 1356.971145][T26219] ? __local_bh_enable_ip+0xd0/0x130 [ 1356.971164][T26219] __alloc_skb+0x1d0/0x7d0 [ 1356.971178][T26219] ? netlink_ack_tlv_len+0x6c/0x210 [ 1356.971192][T26219] netlink_ack+0x146/0xa50 [ 1356.971204][T26219] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1356.971216][T26219] ? ref_tracker_free+0x693/0x840 [ 1356.971228][T26219] ? __copy_skb_header+0xa3/0x4a0 [ 1356.971245][T26219] ? __pfx_ref_tracker_free+0x10/0x10 [ 1356.971263][T26219] netlink_rcv_skb+0x2b6/0x4b0 [ 1356.971277][T26219] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1356.971291][T26219] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1356.971310][T26219] ? netlink_deliver_tap+0x2e/0x1b0 [ 1356.971327][T26219] netlink_unicast+0x80f/0x9b0 [ 1356.971350][T26219] ? __pfx_netlink_unicast+0x10/0x10 [ 1356.971370][T26219] ? netlink_sendmsg+0x650/0xb40 [ 1356.971382][T26219] ? skb_put+0x11b/0x210 [ 1356.971398][T26219] netlink_sendmsg+0x813/0xb40 [ 1356.971417][T26219] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1356.971432][T26219] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1356.971452][T26219] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1356.971469][T26219] ____sys_sendmsg+0x972/0x9f0 [ 1356.971490][T26219] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1356.971511][T26219] ? import_iovec+0x73/0xa0 [ 1356.971528][T26219] ___sys_sendmsg+0x2a5/0x360 [ 1356.971547][T26219] ? __pfx____sys_sendmsg+0x10/0x10 [ 1356.971586][T26219] ? __fget_files+0x2a/0x420 [ 1356.971597][T26219] ? __fget_files+0x3a0/0x420 [ 1356.971613][T26219] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1356.971631][T26219] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1356.971652][T26219] ? __pfx_ksys_write+0x10/0x10 [ 1356.971672][T26219] do_syscall_64+0x14d/0xf80 [ 1356.971690][T26219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.971702][T26219] ? clear_bhb_loop+0x40/0x90 [ 1356.971717][T26219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.971729][T26219] RIP: 0033:0x7ffa43f9c819 [ 1356.971742][T26219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1356.971753][T26219] RSP: 002b:00007ffa44f0a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1356.971767][T26219] RAX: ffffffffffffffda RBX: 00007ffa44215fa0 RCX: 00007ffa43f9c819 [ 1356.971776][T26219] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1356.971785][T26219] RBP: 00007ffa44f0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1356.971792][T26219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1356.971800][T26219] R13: 00007ffa44216038 R14: 00007ffa44215fa0 R15: 00007ffa4433fa48 [ 1356.971817][T26219] [ 1357.562659][T26164] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1357.572652][T26164] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1357.595416][T26164] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1357.607948][T26164] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1357.633675][T26226] netlink: 'syz.2.5944': attribute type 322 has an invalid length. [ 1357.875337][T26239] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5946'. [ 1357.945039][T26242] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5946'. [ 1357.981478][T26239] netlink: 96 bytes leftover after parsing attributes in process `syz.1.5946'. [ 1358.078029][T26164] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1358.128781][T26164] 8021q: adding VLAN 0 to HW filter on device team0 [ 1358.130652][ T5914] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1358.349653][T25535] bridge0: port 1(bridge_slave_0) entered blocking state [ 1358.356876][T25535] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1358.373686][T25535] bridge0: port 2(bridge_slave_1) entered blocking state [ 1358.380934][T25535] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1358.403697][ T5914] usb 4-1: config index 0 descriptor too short (expected 65183, got 72) [ 1358.415021][ T5914] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1358.424536][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1358.450829][ T5914] usb 4-1: Product: syz [ 1358.459374][T26249] veth1_to_bond: entered allmulticast mode [ 1358.494876][ T5914] usb 4-1: Manufacturer: syz [ 1358.508188][ T5914] usb 4-1: SerialNumber: syz [ 1358.590352][ T5914] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1358.651843][ T5828] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1358.800678][ T5826] Bluetooth: hci0: command tx timeout [ 1358.866377][T26241] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5947'. [ 1358.904765][ T5887] usb 4-1: USB disconnect, device number 78 [ 1358.935415][T26243] veth1_to_bond: left allmulticast mode [ 1358.995615][T26164] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1359.174410][T26164] veth0_vlan: entered promiscuous mode [ 1359.218153][T26164] veth1_vlan: entered promiscuous mode [ 1359.289176][T26256] netlink: 'syz.1.5950': attribute type 4 has an invalid length. [ 1359.313426][T26256] netlink: 'syz.1.5950': attribute type 4 has an invalid length. [ 1359.401024][T26164] veth0_macvtap: entered promiscuous mode [ 1359.426152][T26164] veth1_macvtap: entered promiscuous mode [ 1359.466991][T26164] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1359.482355][T26164] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1359.589173][ T36] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1359.626047][ T36] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1359.656100][ T36] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1359.693737][ T36] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1359.764787][ T5828] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1359.820356][ T5828] ath9k_htc: Failed to initialize the device [ 1359.858127][ T5887] usb 4-1: ath9k_htc: USB layer deinitialized [ 1359.918996][T26267] x_tables: duplicate underflow at hook 2 [ 1360.061042][T26269] FAULT_INJECTION: forcing a failure. [ 1360.061042][T26269] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1360.135863][T26269] CPU: 0 UID: 0 PID: 26269 Comm: syz.3.5954 Tainted: G L syzkaller #0 PREEMPT(full) [ 1360.135894][T26269] Tainted: [L]=SOFTLOCKUP [ 1360.135900][T26269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1360.135910][T26269] Call Trace: [ 1360.135918][T26269] [ 1360.135927][T26269] dump_stack_lvl+0xe8/0x150 [ 1360.135957][T26269] should_fail_ex+0x412/0x560 [ 1360.135990][T26269] _copy_to_user+0x31/0xb0 [ 1360.136014][T26269] simple_read_from_buffer+0xe1/0x170 [ 1360.136044][T26269] proc_fail_nth_read+0x1bb/0x230 [ 1360.136074][T26269] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1360.136102][T26269] ? rw_verify_area+0x2a6/0x4d0 [ 1360.136121][T26269] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1360.136147][T26269] vfs_read+0x20c/0xa70 [ 1360.136164][T26269] ? fdget_pos+0x246/0x320 [ 1360.136184][T26269] ? __pfx___mutex_lock+0x10/0x10 [ 1360.136209][T26269] ? __pfx_vfs_read+0x10/0x10 [ 1360.136230][T26269] ? __fget_files+0x2a/0x420 [ 1360.136250][T26269] ? __fget_files+0x3a0/0x420 [ 1360.136265][T26269] ? __fget_files+0x2a/0x420 [ 1360.136290][T26269] ksys_read+0x150/0x270 [ 1360.136313][T26269] ? __pfx_ksys_read+0x10/0x10 [ 1360.136342][T26269] do_syscall_64+0x14d/0xf80 [ 1360.136364][T26269] ? trace_irq_disable+0x3b/0x150 [ 1360.136379][T26269] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1360.136398][T26269] ? clear_bhb_loop+0x40/0x90 [ 1360.136420][T26269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1360.136440][T26269] RIP: 0033:0x7ffa43f5d04e [ 1360.136456][T26269] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1360.136470][T26269] RSP: 002b:00007ffa44f09fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1360.136490][T26269] RAX: ffffffffffffffda RBX: 00007ffa44f0a6c0 RCX: 00007ffa43f5d04e [ 1360.136503][T26269] RDX: 000000000000000f RSI: 00007ffa44f0a0a0 RDI: 0000000000000004 [ 1360.136514][T26269] RBP: 00007ffa44f0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1360.136524][T26269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1360.136535][T26269] R13: 00007ffa44216038 R14: 00007ffa44215fa0 R15: 00007ffa4433fa48 [ 1360.136564][T26269] [ 1360.421187][T25539] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1360.429059][T25539] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1360.687136][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1360.704606][T18650] hid-generic 0000:0000:0000.0074: unknown main item tag 0x0 [ 1360.704958][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1360.726948][T18650] hid-generic 0000:0000:0000.0074: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1360.863540][T26277] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5955'. [ 1360.881364][ T5826] Bluetooth: hci0: command tx timeout [ 1361.556964][T26283] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5957'. [ 1361.700617][ T5887] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1361.765121][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.780634][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.848716][T26293] netlink: 'syz.1.5960': attribute type 322 has an invalid length. [ 1361.997607][ T5887] usb 4-1: Using ep0 maxpacket: 8 [ 1362.011121][ T5887] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1362.020136][ T5887] usb 4-1: config 1 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1362.037881][ T5887] usb 4-1: config 1 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1362.078621][ T5887] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1362.153085][ T5887] usb 4-1: New USB device found, idVendor=05ac, idProduct=0254, bcdDevice= 0.40 [ 1362.170536][ T5887] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.183393][ T5887] usb 4-1: Product: syz [ 1362.198011][ T5887] usb 4-1: Manufacturer: syz [ 1362.217620][ T5887] usb 4-1: SerialNumber: syz [ 1362.410642][T19096] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1362.487126][ T5887] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input118 [ 1362.708889][ T5887] usb 4-1: USB disconnect, device number 79 [ 1362.717195][ T5179] bcm5974 4-1:1.0: could not read from device [ 1362.765065][T19096] usb 3-1: config index 0 descriptor too short (expected 65183, got 72) [ 1362.779261][T19096] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1362.789817][T19096] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.816056][T26298] syzkaller0: entered promiscuous mode [ 1362.823379][T26298] syzkaller0: entered allmulticast mode [ 1362.839054][T19096] usb 3-1: Product: syz [ 1362.840198][T26298] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5962'. [ 1362.855366][T19096] usb 3-1: Manufacturer: syz [ 1362.859969][T19096] usb 3-1: SerialNumber: syz [ 1362.891434][T19096] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1362.914967][ T5914] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1362.932255][T26298] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1362.939520][T26298] IPv6: NLM_F_CREATE should be set when creating new route [ 1362.946800][T26298] IPv6: NLM_F_CREATE should be set when creating new route [ 1363.210163][T26296] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5961'. [ 1363.420996][ T5887] usb 3-1: USB disconnect, device number 93 [ 1363.607842][ T30] kauditd_printk_skb: 201 callbacks suppressed [ 1363.607863][ T30] audit: type=1800 audit(1776092151.568:2978): pid=26303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.5964" name="SYSV00000000" dev="tmpfs" ino=3 res=0 errno=0 [ 1364.001175][ T5914] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1364.015265][ T5914] ath9k_htc: Failed to initialize the device [ 1364.035600][ T5887] usb 3-1: ath9k_htc: USB layer deinitialized [ 1364.893912][T26323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5968'. [ 1365.713082][T19096] hid-generic 0000:0000:0000.0075: unknown main item tag 0x0 [ 1365.764738][T19096] hid-generic 0000:0000:0000.0075: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1366.367148][T26352] netlink: 'syz.1.5977': attribute type 322 has an invalid length. [ 1366.412460][T26358] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5979'. [ 1366.437078][T26358] erspan0: entered promiscuous mode [ 1366.453449][T26358] erspan0: left promiscuous mode [ 1366.570648][ T5914] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1366.750550][ T5914] usb 5-1: Using ep0 maxpacket: 32 [ 1366.799532][ T5914] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1366.847748][ T5914] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 1366.873059][ T5914] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.940572][ T5914] usb 5-1: Product: syz [ 1366.944802][ T5914] usb 5-1: Manufacturer: syz [ 1366.949421][ T5914] usb 5-1: SerialNumber: syz [ 1367.087357][T26365] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5982'. [ 1367.269118][ T5914] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1367.541455][ T5914] usb 5-1: USB disconnect, device number 70 [ 1367.829470][T26381] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1368.453588][T26390] FAULT_INJECTION: forcing a failure. [ 1368.453588][T26390] name failslab, interval 1, probability 0, space 0, times 0 [ 1368.468416][T26390] CPU: 1 UID: 0 PID: 26390 Comm: syz.5.5990 Tainted: G L syzkaller #0 PREEMPT(full) [ 1368.468448][T26390] Tainted: [L]=SOFTLOCKUP [ 1368.468456][T26390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1368.468467][T26390] Call Trace: [ 1368.468476][T26390] [ 1368.468485][T26390] dump_stack_lvl+0xe8/0x150 [ 1368.468520][T26390] should_fail_ex+0x412/0x560 [ 1368.468559][T26390] should_failslab+0xa8/0x100 [ 1368.468589][T26390] __kmalloc_noprof+0xe8/0x760 [ 1368.468615][T26390] ? io_cache_alloc_new+0x40/0x100 [ 1368.468644][T26390] io_cache_alloc_new+0x40/0x100 [ 1368.468667][T26390] io_arm_apoll+0x484/0x950 [ 1368.468701][T26390] ? __pfx_io_arm_apoll+0x10/0x10 [ 1368.468731][T26390] ? __io_issue_sqe+0x1f7/0x4b0 [ 1368.468754][T26390] ? io_file_get_normal+0xe9/0x310 [ 1368.468779][T26390] ? io_arm_poll_handler+0x205/0x290 [ 1368.468826][T26390] io_queue_async+0x175/0x2d0 [ 1368.468858][T26390] io_submit_sqes+0x12cc/0x24e0 [ 1368.468918][T26390] __se_sys_io_uring_enter+0x2c6/0x1960 [ 1368.468950][T26390] ? __fget_files+0x3a0/0x420 [ 1368.468975][T26390] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1368.468998][T26390] ? fput+0xa0/0xd0 [ 1368.469029][T26390] ? ksys_write+0x242/0x270 [ 1368.469055][T26390] ? __pfx_ksys_write+0x10/0x10 [ 1368.469084][T26390] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1368.469113][T26390] do_syscall_64+0x14d/0xf80 [ 1368.469141][T26390] ? trace_irq_disable+0x3b/0x150 [ 1368.469160][T26390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1368.469182][T26390] ? clear_bhb_loop+0x40/0x90 [ 1368.469209][T26390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1368.469230][T26390] RIP: 0033:0x7fec6539c819 [ 1368.469251][T26390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1368.469269][T26390] RSP: 002b:00007fec66233028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1368.469292][T26390] RAX: ffffffffffffffda RBX: 00007fec65615fa0 RCX: 00007fec6539c819 [ 1368.469307][T26390] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 1368.469320][T26390] RBP: 00007fec66233090 R08: 0000000000000000 R09: 0000000000000000 [ 1368.469333][T26390] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 1368.469346][T26390] R13: 00007fec65616038 R14: 00007fec65615fa0 R15: 00007fec6573fa48 [ 1368.469380][T26390] [ 1368.884088][T26397] QAT: failed to copy from user. [ 1369.460337][T26405] netlink: 48 bytes leftover after parsing attributes in process `syz.5.5994'. [ 1370.273592][T26421] netlink: 'syz.2.5999': attribute type 322 has an invalid length. [ 1370.626010][T26434] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6000'. [ 1370.816933][T19096] hid-generic 0000:0000:0000.0076: unknown main item tag 0x0 [ 1370.833503][ T29] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1370.878950][T19096] hid-generic 0000:0000:0000.0076: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1371.050607][ T29] usb 2-1: Using ep0 maxpacket: 8 [ 1371.081418][ T29] usb 2-1: config 0 has an invalid interface number: 187 but max is 0 [ 1371.089804][ T29] usb 2-1: config 0 has no interface number 0 [ 1371.101279][ T29] usb 2-1: config 0 interface 187 has no altsetting 0 [ 1371.150347][ T5914] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1371.259395][ T29] usb 2-1: New USB device found, idVendor=c942, idProduct=2c0f, bcdDevice=47.09 [ 1371.302603][ T5914] usb 5-1: config 0 has no interfaces? [ 1371.308679][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1371.309276][ T5914] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1371.366306][T25539] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1371.387367][ T5914] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1371.388331][ T29] usb 2-1: config 0 descriptor?? [ 1371.430619][ T5914] usb 5-1: SerialNumber: syz [ 1371.466656][ T5914] usb 5-1: config 0 descriptor?? [ 1371.693446][T26430] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1371.711001][T26430] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1371.754439][ T5914] usb 5-1: USB disconnect, device number 71 [ 1371.775366][ T29] usb 2-1: string descriptor 0 read error: -71 [ 1371.801652][ T29] usb-storage 2-1:0.187: USB Mass Storage device detected [ 1371.962045][ T29] usb 2-1: USB disconnect, device number 99 [ 1372.078810][T26441] FAULT_INJECTION: forcing a failure. [ 1372.078810][T26441] name failslab, interval 1, probability 0, space 0, times 0 [ 1372.094086][T26441] CPU: 1 UID: 0 PID: 26441 Comm: syz.5.6004 Tainted: G L syzkaller #0 PREEMPT(full) [ 1372.094119][T26441] Tainted: [L]=SOFTLOCKUP [ 1372.094127][T26441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1372.094140][T26441] Call Trace: [ 1372.094149][T26441] [ 1372.094158][T26441] dump_stack_lvl+0xe8/0x150 [ 1372.094195][T26441] should_fail_ex+0x412/0x560 [ 1372.094231][T26441] should_failslab+0xa8/0x100 [ 1372.094259][T26441] __kmalloc_noprof+0xe8/0x760 [ 1372.094282][T26441] ? __io_arm_poll_handler+0x559/0xc10 [ 1372.094309][T26441] ? io_cache_alloc_new+0x40/0x100 [ 1372.094336][T26441] io_cache_alloc_new+0x40/0x100 [ 1372.094359][T26441] __io_prep_rw+0x2bd/0xed0 [ 1372.094392][T26441] ? __pfx___io_prep_rw+0x10/0x10 [ 1372.094415][T26441] ? __io_issue_sqe+0x1f7/0x4b0 [ 1372.094438][T26441] ? io_file_get_normal+0xe9/0x310 [ 1372.094463][T26441] ? io_arm_poll_handler+0x205/0x290 [ 1372.094495][T26441] io_prep_read+0x33/0x110 [ 1372.094521][T26441] io_submit_sqes+0xbf0/0x24e0 [ 1372.094590][T26441] __se_sys_io_uring_enter+0x2c6/0x1960 [ 1372.094621][T26441] ? __fget_files+0x3a0/0x420 [ 1372.094646][T26441] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1372.094671][T26441] ? fput+0xa0/0xd0 [ 1372.094701][T26441] ? ksys_write+0x242/0x270 [ 1372.094728][T26441] ? __pfx_ksys_write+0x10/0x10 [ 1372.094758][T26441] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1372.094786][T26441] do_syscall_64+0x14d/0xf80 [ 1372.094812][T26441] ? trace_irq_disable+0x3b/0x150 [ 1372.094832][T26441] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.094853][T26441] ? clear_bhb_loop+0x40/0x90 [ 1372.094879][T26441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1372.094900][T26441] RIP: 0033:0x7fec6539c819 [ 1372.094920][T26441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1372.094938][T26441] RSP: 002b:00007fec66233028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1372.094961][T26441] RAX: ffffffffffffffda RBX: 00007fec65615fa0 RCX: 00007fec6539c819 [ 1372.094976][T26441] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 1372.094990][T26441] RBP: 00007fec66233090 R08: 0000000000000000 R09: 0000000000000000 [ 1372.095004][T26441] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 1372.095017][T26441] R13: 00007fec65616038 R14: 00007fec65615fa0 R15: 00007fec6573fa48 [ 1372.095052][T26441] [ 1372.575492][ T30] audit: type=1326 audit(1776092160.538:2979): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1372.578427][T26460] netlink: 'syz.2.6008': attribute type 1 has an invalid length. [ 1372.598480][ T30] audit: type=1326 audit(1776092160.538:2980): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1372.628868][ T30] audit: type=1326 audit(1776092160.538:2981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1372.666909][ T30] audit: type=1326 audit(1776092160.568:2982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1372.729625][T26460] bond0: entered promiscuous mode [ 1372.736121][ T30] audit: type=1326 audit(1776092160.568:2983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1372.763415][T26460] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1372.800035][ T30] audit: type=1326 audit(1776092160.568:2984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1372.800941][T26460] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6008'. [ 1372.850722][ T5828] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1372.914711][ T30] audit: type=1326 audit(1776092160.568:2985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1372.990706][ T30] audit: type=1326 audit(1776092160.568:2986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1373.038867][ T5828] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1373.058679][ T5828] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1373.074745][ T5828] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.086226][ T30] audit: type=1326 audit(1776092160.568:2987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1373.097064][ T5828] usb 5-1: Product: syz [ 1373.136068][ T5828] usb 5-1: Manufacturer: syz [ 1373.142166][T26468] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6012'. [ 1373.185414][ T5828] usb 5-1: SerialNumber: syz [ 1373.209819][ T30] audit: type=1326 audit(1776092160.568:2988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26459 comm="syz.4.6009" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1373.482808][T26477] netlink: 2028 bytes leftover after parsing attributes in process `syz.3.6014'. [ 1373.500609][T26477] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6014'. [ 1373.790611][ T29] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1373.922721][ T5828] usb 6-1: new full-speed USB device number 21 using dummy_hcd [ 1373.931168][ T29] usb 2-1: device descriptor read/64, error -71 [ 1374.082650][ T5828] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1374.091490][ T5828] usb 6-1: config 0 has no interface number 0 [ 1374.106063][ T5828] usb 6-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 1374.120323][ T5828] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1374.134105][ T5828] usb 6-1: Product: syz [ 1374.140961][ T5828] usb 6-1: Manufacturer: syz [ 1374.148414][ T5828] usb 6-1: SerialNumber: syz [ 1374.166739][ T5828] usb 6-1: config 0 descriptor?? [ 1374.177690][ T5828] usb 6-1: selecting invalid altsetting 1 [ 1374.192943][ T5828] dvb_ttusb_budget: ttusb_init_controller: error [ 1374.200960][ T29] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 1374.214457][ T5828] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 1374.288268][ T5828] DVB: Unable to find symbol stv0299_attach() [ 1374.335939][ T5828] DVB: Unable to find symbol tda8083_attach() [ 1374.342213][ T5828] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 1374.350779][ T29] usb 2-1: device descriptor read/64, error -71 [ 1374.401039][T26491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1374.445253][T26491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1374.471315][ T29] usb usb2-port1: attempt power cycle [ 1374.638201][T26501] FAULT_INJECTION: forcing a failure. [ 1374.638201][T26501] name failslab, interval 1, probability 0, space 0, times 0 [ 1374.670610][T26501] CPU: 0 UID: 0 PID: 26501 Comm: syz.3.6021 Tainted: G L syzkaller #0 PREEMPT(full) [ 1374.670633][T26501] Tainted: [L]=SOFTLOCKUP [ 1374.670638][T26501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1374.670646][T26501] Call Trace: [ 1374.670651][T26501] [ 1374.670657][T26501] dump_stack_lvl+0xe8/0x150 [ 1374.670680][T26501] should_fail_ex+0x412/0x560 [ 1374.670702][T26501] should_failslab+0xa8/0x100 [ 1374.670720][T26501] __kmalloc_noprof+0xe8/0x760 [ 1374.670735][T26501] ? io_cache_alloc_new+0x40/0x100 [ 1374.670751][T26501] io_cache_alloc_new+0x40/0x100 [ 1374.670764][T26501] io_arm_apoll+0x484/0x950 [ 1374.670783][T26501] ? __pfx_io_arm_apoll+0x10/0x10 [ 1374.670800][T26501] ? __io_issue_sqe+0x1f7/0x4b0 [ 1374.670817][T26501] ? io_file_get_normal+0xe9/0x310 [ 1374.670831][T26501] ? io_arm_poll_handler+0x205/0x290 [ 1374.670849][T26501] io_queue_async+0x175/0x2d0 [ 1374.670868][T26501] io_submit_sqes+0x12cc/0x24e0 [ 1374.670899][T26501] __se_sys_io_uring_enter+0x2c6/0x1960 [ 1374.670917][T26501] ? __fget_files+0x3a0/0x420 [ 1374.670930][T26501] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1374.670945][T26501] ? fput+0xa0/0xd0 [ 1374.670964][T26501] ? ksys_write+0x242/0x270 [ 1374.670979][T26501] ? __pfx_ksys_write+0x10/0x10 [ 1374.670996][T26501] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1374.671012][T26501] do_syscall_64+0x14d/0xf80 [ 1374.671029][T26501] ? trace_irq_disable+0x3b/0x150 [ 1374.671039][T26501] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1374.671052][T26501] ? clear_bhb_loop+0x40/0x90 [ 1374.671068][T26501] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1374.671080][T26501] RIP: 0033:0x7ffa43f9c819 [ 1374.671092][T26501] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1374.671103][T26501] RSP: 002b:00007ffa44f0a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1374.671119][T26501] RAX: ffffffffffffffda RBX: 00007ffa44215fa0 RCX: 00007ffa43f9c819 [ 1374.671128][T26501] RDX: 0000000000007721 RSI: 0000000000002219 RDI: 0000000000000000 [ 1374.671136][T26501] RBP: 00007ffa44f0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1374.671144][T26501] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000001 [ 1374.671151][T26501] R13: 00007ffa44216038 R14: 00007ffa44215fa0 R15: 00007ffa4433fa48 [ 1374.671170][T26501] [ 1374.880859][ T29] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1374.981298][ T29] usb 2-1: device descriptor read/8, error -71 [ 1375.250751][ T29] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1375.297732][ T29] usb 2-1: device descriptor read/8, error -71 [ 1375.410793][ T29] usb usb2-port1: unable to enumerate USB device [ 1375.530618][ T5887] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1375.594911][ T5914] usb 5-1: USB disconnect, device number 72 [ 1375.699401][T26515] syzkaller1: entered promiscuous mode [ 1375.703047][ T5887] usb 3-1: config index 0 descriptor too short (expected 65183, got 72) [ 1375.709706][T26515] syzkaller1: entered allmulticast mode [ 1375.722605][ T5887] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1375.732173][ T5887] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1375.740218][ T5887] usb 3-1: Product: syz [ 1375.750495][ T5887] usb 3-1: Manufacturer: syz [ 1375.757950][ T5887] usb 3-1: SerialNumber: syz [ 1375.793321][ T5887] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1375.822064][T18650] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1376.055309][T26509] netlink: 'syz.2.6023': attribute type 33 has an invalid length. [ 1376.063252][T26509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6023'. [ 1376.072620][T26509] bond0: option broadcast_neighbor: mode dependency failed, not supported in mode active-backup(1) [ 1376.090927][ T5914] usb 3-1: USB disconnect, device number 94 [ 1376.104968][T26520] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6027'. [ 1376.880729][T18650] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1376.931808][T26542] xt_l2tp: missing protocol rule (udp|l2tpip) [ 1376.999890][T26542] netlink: 'syz.4.6032': attribute type 11 has an invalid length. [ 1377.056194][T19096] usb 6-1: USB disconnect, device number 21 [ 1377.307150][T26545] netlink: 'syz.4.6032': attribute type 11 has an invalid length. [ 1377.307348][T18650] ath9k_htc: Failed to initialize the device [ 1377.333903][ T5914] usb 3-1: ath9k_htc: USB layer deinitialized [ 1377.810559][ T5914] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1377.962430][ T5914] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 1377.992630][ T5914] usb 3-1: config 1 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 1378.153811][ T5914] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1378.171026][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1378.192864][ T5914] usb 3-1: Product: syz [ 1378.202657][ T5914] usb 3-1: Manufacturer: syz [ 1378.360237][ T5914] usb 3-1: SerialNumber: syz [ 1378.387783][ T5914] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1378.405026][ T5828] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1378.570760][ T29] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1378.615309][T18650] usb 3-1: USB disconnect, device number 95 [ 1378.720883][ T29] usb 6-1: Using ep0 maxpacket: 16 [ 1378.729944][ T29] usb 6-1: config 0 has no interfaces? [ 1378.746923][ T29] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1378.781744][ T29] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1378.796606][ T29] usb 6-1: Manufacturer: syz [ 1378.838195][ T29] usb 6-1: config 0 descriptor?? [ 1378.930931][T26574] program syz.1.6044 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1378.942333][T26574] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1379.140196][T26564] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1379.310948][ T29] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1379.440623][ T5828] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1379.464859][ T5828] ath9k_htc: Failed to initialize the device [ 1379.482731][ T29] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1379.492260][T18650] usb 3-1: ath9k_htc: USB layer deinitialized [ 1379.498459][ T29] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1379.539164][ T29] usb 4-1: config 0 descriptor?? [ 1379.571368][T26583] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1379.597330][ T29] cp210x 4-1:0.0: cp210x converter detected [ 1379.859904][T18650] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1380.001095][ T29] cp210x 4-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 1380.062685][ T29] usb 4-1: cp210x converter now attached to ttyUSB0 [ 1380.229232][ T5914] usb 4-1: USB disconnect, device number 80 [ 1380.242174][ T5914] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1380.286445][ T5914] cp210x 4-1:0.0: device disconnected [ 1380.776256][T21477] usb 6-1: USB disconnect, device number 22 [ 1380.945141][ T30] kauditd_printk_skb: 50 callbacks suppressed [ 1380.945162][ T30] audit: type=1326 audit(1776092168.878:3039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.100175][ T30] audit: type=1326 audit(1776092168.888:3040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=17 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.137711][ T30] audit: type=1326 audit(1776092168.888:3041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.168401][ T30] audit: type=1326 audit(1776092168.888:3042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.202197][T26600] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6051'. [ 1381.249097][ T30] audit: type=1326 audit(1776092168.888:3043): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.380621][T21477] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 1381.380680][ T5828] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1381.402650][ T30] audit: type=1326 audit(1776092168.888:3044): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.439881][ T30] audit: type=1326 audit(1776092168.888:3045): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.523306][ T30] audit: type=1326 audit(1776092168.888:3046): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.546124][T21477] usb 3-1: device descriptor read/64, error -71 [ 1381.546148][ T5828] usb 6-1: Using ep0 maxpacket: 32 [ 1381.563772][ T5828] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1381.583415][ T5828] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1381.621676][ T5828] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1381.634978][ T30] audit: type=1326 audit(1776092168.888:3047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.669672][ T5828] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1381.699702][ T5828] usb 6-1: config 0 descriptor?? [ 1381.721081][ T5828] hub 6-1:0.0: USB hub found [ 1381.745695][ T30] audit: type=1326 audit(1776092168.888:3048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26589 comm="syz.4.6049" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fa576f9c819 code=0x7ffc0000 [ 1381.850553][T21477] usb 3-1: new full-speed USB device number 98 using dummy_hcd [ 1381.913958][ T5828] hub 6-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 1381.964781][T26604] netlink: 'syz.1.6053': attribute type 4 has an invalid length. [ 1382.020679][T26604] netlink: 'syz.1.6053': attribute type 4 has an invalid length. [ 1382.039336][T21477] usb 3-1: device descriptor read/64, error -71 [ 1382.151191][T21477] usb usb3-port1: attempt power cycle [ 1382.356096][ T5828] hid-generic 0003:046D:C31C.0077: collection stack underflow [ 1382.367040][ T5828] hid-generic 0003:046D:C31C.0077: item 0 0 0 12 parsing failed [ 1382.442151][ T5828] hid-generic 0003:046D:C31C.0077: probe with driver hid-generic failed with error -22 [ 1382.459719][T26609] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6055'. [ 1382.548453][T21477] usb 3-1: new full-speed USB device number 99 using dummy_hcd [ 1382.555773][T26596] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1382.596406][T26596] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1382.638347][T21477] usb 3-1: device descriptor read/8, error -71 [ 1382.892804][T21477] usb 3-1: new full-speed USB device number 100 using dummy_hcd [ 1382.932760][T13342] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1382.943211][T13342] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1382.952169][T21477] usb 3-1: device descriptor read/8, error -71 [ 1382.958469][T13342] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1382.969484][T13342] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1382.977148][T13342] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1383.062030][T21477] usb usb3-port1: unable to enumerate USB device [ 1383.270844][T19096] usb 6-1: USB disconnect, device number 23 [ 1383.553590][T26612] chnl_net:caif_netlink_parms(): no params data found [ 1383.759043][T26612] bridge0: port 1(bridge_slave_0) entered blocking state [ 1383.770882][T26612] bridge0: port 1(bridge_slave_0) entered disabled state [ 1383.781163][T26612] bridge_slave_0: entered allmulticast mode [ 1383.797011][T26612] bridge_slave_0: entered promiscuous mode [ 1383.812837][T26612] bridge0: port 2(bridge_slave_1) entered blocking state [ 1383.821015][T26612] bridge0: port 2(bridge_slave_1) entered disabled state [ 1383.831238][T26612] bridge_slave_1: entered allmulticast mode [ 1383.875510][T26612] bridge_slave_1: entered promiscuous mode [ 1383.938781][T26612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1383.955444][T26612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1383.987131][T26612] team0: Port device team_slave_0 added [ 1383.995191][T26612] team0: Port device team_slave_1 added [ 1384.038126][T26612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1384.045408][T26612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1384.071536][T26612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1384.086216][T26612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1384.093316][T26612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1384.132450][T26612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1384.182255][ T5828] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1384.239828][T26612] hsr_slave_0: entered promiscuous mode [ 1384.247155][T26612] hsr_slave_1: entered promiscuous mode [ 1384.258892][T26612] debugfs: 'hsr0' already exists in 'hsr' [ 1384.264979][T26612] Cannot create hsr debugfs directory [ 1384.311768][T26634] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1384.354296][ T5828] usb 5-1: config index 0 descriptor too short (expected 65183, got 72) [ 1384.373152][ T5828] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1384.388562][ T5828] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1384.399518][ T5828] usb 5-1: Product: syz [ 1384.404182][ T5828] usb 5-1: Manufacturer: syz [ 1384.408880][ T5828] usb 5-1: SerialNumber: syz [ 1384.434408][ T5828] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1384.458434][T19096] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1384.579201][T26639] tipc: Enabled bearer , priority 0 [ 1384.610095][T26639] syzkaller0: entered promiscuous mode [ 1384.615834][T26639] syzkaller0: entered allmulticast mode [ 1384.659438][T26638] tipc: Resetting bearer [ 1384.690308][T26638] tipc: Disabling bearer [ 1384.703490][T26626] netlink: 'syz.4.6060': attribute type 33 has an invalid length. [ 1384.715017][T26626] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6060'. [ 1384.757199][T26626] bond0: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 1384.835233][ T29] usb 5-1: USB disconnect, device number 73 [ 1385.042662][ T5826] Bluetooth: hci1: command tx timeout [ 1385.099450][T26612] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1385.113040][T26612] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1385.160575][ T5828] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1385.172988][T26612] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1385.218233][T26612] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1385.255329][T26649] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6067'. [ 1385.265441][T26649] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1385.323348][T26653] input: syz0 as /devices/virtual/input/input119 [ 1385.385153][T26653] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6067'. [ 1385.396624][ T5828] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1385.406412][ T5828] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1385.421074][ T5828] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1385.475674][T26649] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1385.485233][ T5828] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1385.527048][T19096] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1385.544963][T19096] ath9k_htc: Failed to initialize the device [ 1385.559445][ T5828] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1385.560623][ T29] usb 5-1: ath9k_htc: USB layer deinitialized [ 1385.579035][ T5828] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1385.587428][ T5828] usb 2-1: Product: syz [ 1385.601142][ T5828] usb 2-1: Manufacturer: syz [ 1385.607945][ T5828] usb 2-1: SerialNumber: syz [ 1385.734702][T26667] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6070'. [ 1386.663327][T26612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1386.765368][T26612] 8021q: adding VLAN 0 to HW filter on device team0 [ 1386.832938][ T86] bridge0: port 1(bridge_slave_0) entered blocking state [ 1386.840156][ T86] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1386.875552][T25539] bridge0: port 2(bridge_slave_1) entered blocking state [ 1386.882793][T25539] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1387.116282][T26612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1387.125055][ T5826] Bluetooth: hci1: command tx timeout [ 1387.210632][ T5914] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1387.243722][T26612] veth0_vlan: entered promiscuous mode [ 1387.258101][T26612] veth1_vlan: entered promiscuous mode [ 1387.313849][T26612] veth0_macvtap: entered promiscuous mode [ 1387.325666][T26612] veth1_macvtap: entered promiscuous mode [ 1387.341373][ T5914] usb 5-1: device descriptor read/64, error -71 [ 1387.356371][T26612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1387.386640][T26612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1387.414165][ T86] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1387.449482][ T86] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1387.461144][ T86] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1387.491855][ T86] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1387.581104][ T5914] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1387.589673][T25535] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1387.636419][T25535] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1387.677477][T25539] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1387.691440][T25539] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1387.731337][ T5914] usb 5-1: device descriptor read/64, error -71 [ 1387.788079][T26681] fuse: Bad value for 'fd' [ 1387.841196][ T5914] usb usb5-port1: attempt power cycle [ 1387.925047][ T5828] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 1387.936693][ T5828] cdc_ncm 2-1:1.0: bind() failure [ 1387.958680][ T5828] usb 2-1: USB disconnect, device number 104 [ 1388.200586][ T5914] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1388.221771][ T5914] usb 5-1: device descriptor read/8, error -71 [ 1388.370562][ T5887] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1388.526385][ T5887] usb 3-1: device descriptor read/64, error -71 [ 1388.554848][T26701] FAULT_INJECTION: forcing a failure. [ 1388.554848][T26701] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1388.572844][T26701] CPU: 0 UID: 0 PID: 26701 Comm: syz.6.6082 Tainted: G L syzkaller #0 PREEMPT(full) [ 1388.572877][T26701] Tainted: [L]=SOFTLOCKUP [ 1388.572885][T26701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1388.572897][T26701] Call Trace: [ 1388.572907][T26701] [ 1388.572916][T26701] dump_stack_lvl+0xe8/0x150 [ 1388.572951][T26701] should_fail_ex+0x412/0x560 [ 1388.572988][T26701] _copy_from_user+0x2d/0xb0 [ 1388.573015][T26701] memdup_user+0x5e/0xd0 [ 1388.573045][T26701] strndup_user+0x68/0xd0 [ 1388.573074][T26701] __se_sys_mount+0x9d/0x420 [ 1388.573107][T26701] ? ksys_write+0x242/0x270 [ 1388.573135][T26701] ? __pfx___se_sys_mount+0x10/0x10 [ 1388.573172][T26701] ? __x64_sys_mount+0x20/0xc0 [ 1388.573205][T26701] do_syscall_64+0x14d/0xf80 [ 1388.573232][T26701] ? trace_irq_disable+0x3b/0x150 [ 1388.573251][T26701] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1388.573273][T26701] ? clear_bhb_loop+0x40/0x90 [ 1388.573307][T26701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1388.573328][T26701] RIP: 0033:0x7f2803d9c819 [ 1388.573348][T26701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1388.573367][T26701] RSP: 002b:00007f2804c18028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1388.573391][T26701] RAX: ffffffffffffffda RBX: 00007f2804015fa0 RCX: 00007f2803d9c819 [ 1388.573406][T26701] RDX: 0000200000000000 RSI: 00002000000020c0 RDI: 0000000000000000 [ 1388.573421][T26701] RBP: 00007f2804c18090 R08: 0000000000000000 R09: 0000000000000000 [ 1388.573434][T26701] R10: 0000000000400400 R11: 0000000000000246 R12: 0000000000000001 [ 1388.573447][T26701] R13: 00007f2804016038 R14: 00007f2804015fa0 R15: 00007f280413fa48 [ 1388.573480][T26701] [ 1388.756607][ T5914] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1388.805207][ T5914] usb 5-1: device descriptor read/8, error -71 [ 1388.860940][ T5887] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 1388.920854][ T5914] usb usb5-port1: unable to enumerate USB device [ 1389.010709][ T5887] usb 3-1: device descriptor read/64, error -71 [ 1389.140808][ T5887] usb usb3-port1: attempt power cycle [ 1389.201717][ T5826] Bluetooth: hci1: command tx timeout [ 1389.510689][ T5887] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1389.562484][ T5887] usb 3-1: device descriptor read/8, error -71 [ 1389.765996][T26719] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 1389.820619][ T5887] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 1389.851816][ T5887] usb 3-1: device descriptor read/8, error -71 [ 1389.973548][ T5887] usb usb3-port1: unable to enumerate USB device [ 1390.610617][T26111] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1390.702010][T26730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6090'. [ 1390.872366][T26111] usb 7-1: Using ep0 maxpacket: 8 [ 1390.889124][T26111] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 1390.902871][T26111] usb 7-1: config 179 has no interface number 0 [ 1390.929650][T26111] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1390.955772][T26111] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1391.067643][T26111] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1391.286264][ T5826] Bluetooth: hci1: command tx timeout [ 1391.340543][T26111] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1391.360574][T26111] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1391.374125][T26111] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1391.394301][T26111] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1391.427598][T26724] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1391.667178][T26724] tipc: Enabling of bearer rejected, failed to enable media [ 1391.893221][T26111] usb 7-1: USB disconnect, device number 2 [ 1391.893289][ C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1391.907443][ C1] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1392.010184][T26745] vlan2: entered allmulticast mode [ 1392.095605][T26745] bond0: entered allmulticast mode [ 1392.115091][T26749] binder: 26744:26749 ioctl 8008743f 200000000280 returned -22 [ 1392.130807][T26745] bond_slave_0: entered allmulticast mode [ 1392.141313][T26745] bond_slave_1: entered allmulticast mode [ 1392.150883][T26749] netlink: 14 bytes leftover after parsing attributes in process `syz.4.6094'. [ 1392.430753][ T29] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1392.537145][T26749] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1392.641728][ T29] usb 6-1: Using ep0 maxpacket: 16 [ 1392.723140][ T29] usb 6-1: config 0 has no interfaces? [ 1392.733043][ T29] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1392.742788][ T29] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1392.985730][ T29] usb 6-1: Manufacturer: syz [ 1393.007030][T26749] bond_slave_0: left allmulticast mode [ 1393.023570][ T29] usb 6-1: config 0 descriptor?? [ 1393.061530][T26749] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1393.250728][T26749] bond_slave_1: left allmulticast mode [ 1393.286760][T26751] netlink: 'syz.5.6093': attribute type 1 has an invalid length. [ 1393.295802][T26749] bond0 (unregistering): Released all slaves [ 1393.430121][T26751] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1393.462134][T26760] syzkaller0: entered promiscuous mode [ 1393.467653][T26760] syzkaller0: entered allmulticast mode [ 1393.486338][T26760] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6097'. [ 1393.510167][T26760] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1393.517470][T26760] IPv6: NLM_F_CREATE should be set when creating new route [ 1393.524764][T26760] IPv6: NLM_F_CREATE should be set when creating new route [ 1393.909511][T26767] x_tables: duplicate underflow at hook 3 [ 1394.250958][T26111] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 1394.290579][ T796] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 1394.387479][T26775] tipc: Started in network mode [ 1394.396956][T26775] tipc: Node identity e27e4b3e0804, cluster identity 4711 [ 1394.418249][T26775] tipc: Enabled bearer , priority 0 [ 1394.430627][T26111] usb 3-1: Using ep0 maxpacket: 8 [ 1394.440560][ T796] usb 2-1: Using ep0 maxpacket: 32 [ 1394.441648][T26111] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 1394.456665][T26111] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.460986][ T796] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 1394.469882][T26111] usb 3-1: Product: syz [ 1394.477418][T26111] usb 3-1: Manufacturer: syz [ 1394.477439][ T796] usb 2-1: config 0 has no interface number 0 [ 1394.477498][ T796] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1394.484494][T26111] usb 3-1: SerialNumber: syz [ 1394.491647][T26776] syzkaller0: entered promiscuous mode [ 1394.523679][ T796] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1394.533344][ T796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.534412][T26111] usb 3-1: config 0 descriptor?? [ 1394.555945][T26776] syzkaller0: entered allmulticast mode [ 1394.563758][ T796] usb 2-1: Product: syz [ 1394.573235][ T796] usb 2-1: Manufacturer: syz [ 1394.573601][T26111] radio-usb-si4713 3-1:0.0: Si4713 development board discovered: (10C4:8244) [ 1394.623591][ T796] usb 2-1: SerialNumber: syz [ 1394.650746][T26774] tipc: Resetting bearer [ 1394.657330][ T796] usb 2-1: config 0 descriptor?? [ 1394.676281][ T796] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1394.712107][ T796] em28xx 2-1:0.132: Video interface 132 found: [ 1394.754206][T26774] tipc: Disabling bearer [ 1394.982667][T26769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1394.991751][T26769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1395.007469][ T5914] usb 6-1: USB disconnect, device number 24 [ 1395.150258][ T796] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 1395.226656][T26111] radio-usb-si4713 3-1:0.0: probe with driver radio-usb-si4713 failed with error -71 [ 1395.239594][T26111] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1395.276978][T26111] usb 3-1: USB disconnect, device number 105 [ 1395.430599][ T5914] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1395.592556][ T5914] usb 6-1: Using ep0 maxpacket: 16 [ 1395.624793][ T5914] usb 6-1: config index 0 descriptor too short (expected 52, got 36) [ 1395.642053][ T5914] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1395.660750][ T796] em28xx 2-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 1395.689622][ T5914] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1395.700854][ T796] em28xx 2-1:0.132: board has no eeprom [ 1395.715185][ T5914] usb 6-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 25 [ 1395.728497][ T5914] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1395.742232][ T5914] usb 6-1: New USB device found, idVendor=6666, idProduct=8801, bcdDevice= 0.00 [ 1395.752446][ T5914] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1395.780546][ T796] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1395.802427][ T796] em28xx 2-1:0.132: analog set to bulk mode. [ 1395.810157][ T5828] em28xx 2-1:0.132: Registering V4L2 extension [ 1395.818668][ T5914] usb 6-1: config 0 descriptor?? [ 1395.884839][ T796] usb 2-1: USB disconnect, device number 105 [ 1395.900579][T21477] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1396.059287][ T796] em28xx 2-1:0.132: Disconnecting em28xx [ 1396.085553][T21477] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1396.121007][T21477] usb 7-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 1396.140348][T21477] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1396.161144][T21477] usb 7-1: config 0 descriptor?? [ 1396.203708][T21477] smsusb:smsusb_probe: board id=8, interface number 0 [ 1396.238137][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.248629][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.249812][T21477] smsusb:smsusb_probe: Device initialized with return code -19 [ 1396.270690][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.278222][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.321012][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.362557][ T5828] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 1396.369640][ T5828] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 1396.390644][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.427771][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.448719][ T5828] em28xx 2-1:0.132: No AC97 audio processor [ 1396.616888][T26809] tipc: Enabling of bearer rejected, failed to enable media [ 1396.637227][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 1396.637247][ T30] audit: type=1326 audit(1776092184.558:3065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2803d9c819 code=0x7ffc0000 [ 1396.705932][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.791086][ T5828] usb 2-1: Decoder not found [ 1396.801052][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.812183][ T5828] em28xx 2-1:0.132: failed to create media graph [ 1396.942789][ T5828] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 1396.953947][ T5914] smartjoyplus 0003:6666:8801.0078: unknown main item tag 0x0 [ 1396.970211][ T30] audit: type=1326 audit(1776092184.558:3066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2803d9c819 code=0x7ffc0000 [ 1397.021864][ T5828] em28xx 2-1:0.132: Remote control support is not available for this card. [ 1397.048632][ T796] em28xx 2-1:0.132: Closing input extension [ 1397.058738][ T5914] smartjoyplus 0003:6666:8801.0078: hidraw0: USB HID v0.08 Device [HID 6666:8801] on usb-dummy_hcd.5-1/input0 [ 1397.086331][ T5914] smartjoyplus 0003:6666:8801.0078: no output reports found [ 1397.090980][T26814] ================================================================== [ 1397.101724][T26814] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 1397.109115][T26814] Read of size 8 at addr ffff88805bbc0790 by task v4l_id/26814 [ 1397.116657][T26814] [ 1397.118996][T26814] CPU: 1 UID: 0 PID: 26814 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 1397.119021][T26814] Tainted: [L]=SOFTLOCKUP [ 1397.119027][T26814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1397.119038][T26814] Call Trace: [ 1397.119045][T26814] [ 1397.119051][T26814] dump_stack_lvl+0xe8/0x150 [ 1397.119076][T26814] print_report+0xba/0x230 [ 1397.119094][T26814] ? v4l2_fh_open+0xac/0x420 [ 1397.119116][T26814] kasan_report+0x117/0x150 [ 1397.119137][T26814] ? v4l2_fh_open+0xac/0x420 [ 1397.119161][T26814] v4l2_fh_open+0xac/0x420 [ 1397.119183][T26814] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1397.119208][T26814] em28xx_v4l2_open+0x157/0x9a0 [ 1397.119227][T26814] ? do_raw_spin_lock+0x12b/0x2f0 [ 1397.119246][T26814] v4l2_open+0x1bf/0x3a0 [ 1397.119271][T26814] chrdev_open+0x4cd/0x5e0 [ 1397.119291][T26814] ? __pfx_chrdev_open+0x10/0x10 [ 1397.119311][T26814] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 1397.119330][T26814] ? __pfx_chrdev_open+0x10/0x10 [ 1397.119349][T26814] do_dentry_open+0x785/0x14e0 [ 1397.119375][T26814] vfs_open+0x3b/0x340 [ 1397.119396][T26814] ? path_openat+0x2df0/0x3860 [ 1397.119414][T26814] path_openat+0x2e08/0x3860 [ 1397.119441][T26814] ? __pfx_stack_trace_save+0x10/0x10 [ 1397.119460][T26814] ? stack_depot_save_flags+0x33/0x810 [ 1397.119487][T26814] ? __pfx_path_openat+0x10/0x10 [ 1397.119504][T26814] ? __x64_sys_openat+0x138/0x170 [ 1397.119526][T26814] ? do_syscall_64+0x14d/0xf80 [ 1397.119546][T26814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.119565][T26814] ? __lock_acquire+0x6b5/0x2cf0 [ 1397.119587][T26814] do_file_open+0x23e/0x4a0 [ 1397.119606][T26814] ? __pfx_do_file_open+0x10/0x10 [ 1397.119629][T26814] ? _raw_spin_unlock+0x28/0x50 [ 1397.119647][T26814] ? alloc_fd+0x64b/0x6c0 [ 1397.119672][T26814] do_sys_openat2+0x113/0x200 [ 1397.119695][T26814] ? __pfx_do_sys_openat2+0x10/0x10 [ 1397.119718][T26814] ? exc_page_fault+0x6a/0xc0 [ 1397.119739][T26814] ? do_user_addr_fault+0xc6f/0x1340 [ 1397.119760][T26814] __x64_sys_openat+0x138/0x170 [ 1397.119784][T26814] do_syscall_64+0x14d/0xf80 [ 1397.119804][T26814] ? trace_irq_disable+0x3b/0x150 [ 1397.119818][T26814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.119833][T26814] ? clear_bhb_loop+0x40/0x90 [ 1397.119851][T26814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.119866][T26814] RIP: 0033:0x7fb055ca7407 [ 1397.119880][T26814] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1397.119895][T26814] RSP: 002b:00007ffc9674fee0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1397.119913][T26814] RAX: ffffffffffffffda RBX: 00007fb05638b880 RCX: 00007fb055ca7407 [ 1397.119925][T26814] RDX: 0000000000000000 RSI: 00007ffc96751f1a RDI: ffffffffffffff9c [ 1397.119937][T26814] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1397.119946][T26814] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1397.119956][T26814] R13: 00007ffc96750130 R14: 00007fb056490000 R15: 000055ed4e22f4d8 [ 1397.119973][T26814] [ 1397.119979][T26814] [ 1397.420252][T26814] Allocated by task 5828: [ 1397.424583][T26814] kasan_save_track+0x3e/0x80 [ 1397.429272][T26814] __kasan_kmalloc+0x93/0xb0 [ 1397.433868][T26814] __kmalloc_cache_noprof+0x31c/0x660 [ 1397.439247][T26814] em28xx_v4l2_init+0x10b/0x2e70 [ 1397.444186][T26814] em28xx_init_extension+0x120/0x1c0 [ 1397.449480][T26814] process_scheduled_works+0xb6e/0x18c0 [ 1397.455033][T26814] worker_thread+0xa53/0xfc0 [ 1397.459632][T26814] kthread+0x388/0x470 [ 1397.463700][T26814] ret_from_fork+0x51e/0xb90 [ 1397.468298][T26814] ret_from_fork_asm+0x1a/0x30 [ 1397.473067][T26814] [ 1397.475392][T26814] Freed by task 5828: [ 1397.479368][T26814] kasan_save_track+0x3e/0x80 [ 1397.484050][T26814] kasan_save_free_info+0x46/0x50 [ 1397.489081][T26814] __kasan_slab_free+0x5c/0x80 [ 1397.493850][T26814] kfree+0x1c1/0x630 [ 1397.497747][T26814] em28xx_v4l2_init+0x1683/0x2e70 [ 1397.502776][T26814] em28xx_init_extension+0x120/0x1c0 [ 1397.508072][T26814] process_scheduled_works+0xb6e/0x18c0 [ 1397.513618][T26814] worker_thread+0xa53/0xfc0 [ 1397.518212][T26814] kthread+0x388/0x470 [ 1397.522281][T26814] ret_from_fork+0x51e/0xb90 [ 1397.526876][T26814] ret_from_fork_asm+0x1a/0x30 [ 1397.531648][T26814] [ 1397.533971][T26814] The buggy address belongs to the object at ffff88805bbc0000 [ 1397.533971][T26814] which belongs to the cache kmalloc-8k of size 8192 [ 1397.548025][T26814] The buggy address is located 1936 bytes inside of [ 1397.548025][T26814] freed 8192-byte region [ffff88805bbc0000, ffff88805bbc2000) [ 1397.561994][T26814] [ 1397.564322][T26814] The buggy address belongs to the physical page: [ 1397.570732][T26814] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bbc0 [ 1397.579488][T26814] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1397.587983][T26814] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1397.595524][T26814] page_type: f5(slab) [ 1397.599507][T26814] raw: 00fff00000000040 ffff88813fea7280 dead000000000122 0000000000000000 [ 1397.608090][T26814] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 1397.616673][T26814] head: 00fff00000000040 ffff88813fea7280 dead000000000122 0000000000000000 [ 1397.625342][T26814] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 1397.634018][T26814] head: 00fff00000000003 ffffea00016ef001 00000000ffffffff 00000000ffffffff [ 1397.642687][T26814] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1397.651372][T26814] page dumped because: kasan: bad access detected [ 1397.657787][T26814] page_owner tracks the page as allocated [ 1397.663496][T26814] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 26776, tgid 26774 (syz.6.6102), ts 1394491586826, free_ts 1394473401552 [ 1397.685040][T26814] post_alloc_hook+0x231/0x280 [ 1397.689811][T26814] get_page_from_freelist+0x24dc/0x2580 [ 1397.695390][T26814] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1397.701211][T26814] allocate_slab+0x77/0x660 [ 1397.705719][T26814] refill_objects+0x331/0x3c0 [ 1397.710397][T26814] __pcs_replace_empty_main+0x2e6/0x730 [ 1397.715961][T26814] __kvmalloc_node_noprof+0x657/0x8a0 [ 1397.721341][T26814] pfifo_fast_init+0x372/0x6c0 [ 1397.726109][T26814] qdisc_create_dflt+0x13b/0x510 [ 1397.731049][T26814] dev_activate+0x378/0x1150 [ 1397.735638][T26814] __dev_open+0x67a/0x830 [ 1397.739979][T26814] __dev_change_flags+0x1f7/0x690 [ 1397.745033][T26814] netif_change_flags+0x88/0x1a0 [ 1397.749978][T26814] dev_change_flags+0x130/0x260 [ 1397.754829][T26814] dev_ioctl+0x7b4/0x1150 [ 1397.759170][T26814] sock_do_ioctl+0x23e/0x320 [ 1397.763770][T26814] page last free pid 26776 tgid 26774 stack trace: [ 1397.770268][T26814] __free_frozen_pages+0xc2b/0xdb0 [ 1397.775386][T26814] __slab_free+0x263/0x2b0 [ 1397.779819][T26814] qlist_free_all+0x97/0x100 [ 1397.784412][T26814] kasan_quarantine_reduce+0x148/0x160 [ 1397.789879][T26814] __kasan_slab_alloc+0x22/0x80 [ 1397.794738][T26814] __kmalloc_noprof+0x316/0x760 [ 1397.799596][T26814] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1397.805149][T26814] tomoyo_path_number_perm+0x246/0x630 [ 1397.810622][T26814] security_file_ioctl+0xc3/0x2a0 [ 1397.815654][T26814] __se_sys_ioctl+0x47/0x170 [ 1397.820249][T26814] do_syscall_64+0x14d/0xf80 [ 1397.824848][T26814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.830742][T26814] [ 1397.833067][T26814] Memory state around the buggy address: [ 1397.838695][T26814] ffff88805bbc0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1397.846759][T26814] ffff88805bbc0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1397.854832][T26814] >ffff88805bbc0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1397.862900][T26814] ^ [ 1397.867493][T26814] ffff88805bbc0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1397.875552][T26814] ffff88805bbc0880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1397.883612][T26814] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1397.940574][ T30] audit: type=1326 audit(1776092184.558:3067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2803d9c819 code=0x7ffc0000 [ 1397.970569][ T30] audit: type=1326 audit(1776092184.558:3068): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2803d9c819 code=0x7ffc0000 [ 1397.994490][ T30] audit: type=1326 audit(1776092184.558:3069): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2803d9c819 code=0x7ffc0000 [ 1398.027535][ T30] audit: type=1326 audit(1776092184.568:3070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2803d9c819 code=0x7ffc0000 [ 1398.070588][ T5914] usb 6-1: USB disconnect, device number 25 [ 1398.140526][ T30] audit: type=1326 audit(1776092184.568:3071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2803d9e087 code=0x7ffc0000 [ 1398.163989][ T30] audit: type=1326 audit(1776092184.568:3072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f2803d5d04e code=0x7ffc0000 [ 1398.188142][ T30] audit: type=1326 audit(1776092184.568:3073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f2803d5d04e code=0x7ffc0000 [ 1398.220599][ T30] audit: type=1326 audit(1776092184.568:3074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26786 comm="syz.6.6105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f2803d5d04e code=0x7ffc0000 [ 1398.342174][T26814] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1398.349437][T26814] CPU: 1 UID: 0 PID: 26814 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 1398.360046][T26814] Tainted: [L]=SOFTLOCKUP [ 1398.364366][T26814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1398.374516][T26814] Call Trace: [ 1398.377812][T26814] [ 1398.380761][T26814] vpanic+0x56c/0xa60 [ 1398.384775][T26814] ? __pfx_vpanic+0x10/0x10 [ 1398.389292][T26814] panic+0xc5/0xd0 [ 1398.393022][T26814] ? __pfx_panic+0x10/0x10 [ 1398.397447][T26814] ? preempt_schedule_thunk+0x16/0x30 [ 1398.402826][T26814] ? preempt_schedule_thunk+0x16/0x30 [ 1398.408202][T26814] ? v4l2_fh_open+0xac/0x420 [ 1398.412800][T26814] check_panic_on_warn+0x89/0xb0 [ 1398.417745][T26814] ? v4l2_fh_open+0xac/0x420 [ 1398.422344][T26814] end_report+0x73/0x180 [ 1398.426601][T26814] ? v4l2_fh_open+0xac/0x420 [ 1398.431197][T26814] kasan_report+0x128/0x150 [ 1398.435707][T26814] ? v4l2_fh_open+0xac/0x420 [ 1398.440309][T26814] v4l2_fh_open+0xac/0x420 [ 1398.444736][T26814] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1398.450730][T26814] em28xx_v4l2_open+0x157/0x9a0 [ 1398.455591][T26814] ? do_raw_spin_lock+0x12b/0x2f0 [ 1398.460629][T26814] v4l2_open+0x1bf/0x3a0 [ 1398.464902][T26814] chrdev_open+0x4cd/0x5e0 [ 1398.469326][T26814] ? __pfx_chrdev_open+0x10/0x10 [ 1398.474267][T26814] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 1398.480608][T26814] ? __pfx_chrdev_open+0x10/0x10 [ 1398.485565][T26814] do_dentry_open+0x785/0x14e0 [ 1398.490342][T26814] vfs_open+0x3b/0x340 [ 1398.494422][T26814] ? path_openat+0x2df0/0x3860 [ 1398.499190][T26814] path_openat+0x2e08/0x3860 [ 1398.503793][T26814] ? __pfx_stack_trace_save+0x10/0x10 [ 1398.509172][T26814] ? stack_depot_save_flags+0x33/0x810 [ 1398.514644][T26814] ? __pfx_path_openat+0x10/0x10 [ 1398.519583][T26814] ? __x64_sys_openat+0x138/0x170 [ 1398.524615][T26814] ? do_syscall_64+0x14d/0xf80 [ 1398.529392][T26814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.535467][T26814] ? __lock_acquire+0x6b5/0x2cf0 [ 1398.540417][T26814] do_file_open+0x23e/0x4a0 [ 1398.544938][T26814] ? __pfx_do_file_open+0x10/0x10 [ 1398.549970][T26814] ? _raw_spin_unlock+0x28/0x50 [ 1398.554826][T26814] ? alloc_fd+0x64b/0x6c0 [ 1398.559170][T26814] do_sys_openat2+0x113/0x200 [ 1398.563856][T26814] ? __pfx_do_sys_openat2+0x10/0x10 [ 1398.569067][T26814] ? exc_page_fault+0x6a/0xc0 [ 1398.573755][T26814] ? do_user_addr_fault+0xc6f/0x1340 [ 1398.579053][T26814] __x64_sys_openat+0x138/0x170 [ 1398.583921][T26814] do_syscall_64+0x14d/0xf80 [ 1398.588523][T26814] ? trace_irq_disable+0x3b/0x150 [ 1398.593563][T26814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.599631][T26814] ? clear_bhb_loop+0x40/0x90 [ 1398.604311][T26814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.610205][T26814] RIP: 0033:0x7fb055ca7407 [ 1398.614622][T26814] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1398.634232][T26814] RSP: 002b:00007ffc9674fee0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1398.642655][T26814] RAX: ffffffffffffffda RBX: 00007fb05638b880 RCX: 00007fb055ca7407 [ 1398.650631][T26814] RDX: 0000000000000000 RSI: 00007ffc96751f1a RDI: ffffffffffffff9c [ 1398.658604][T26814] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1398.666580][T26814] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1398.674552][T26814] R13: 00007ffc96750130 R14: 00007fb056490000 R15: 000055ed4e22f4d8 [ 1398.682535][T26814] [ 1398.685921][T26814] Kernel Offset: disabled [ 1398.690238][T26814] Rebooting in 86400 seconds..