last executing test programs: 6m25.951159084s ago: executing program 1 (id=4636): syz_open_dev$loop(&(0x7f0000000040), 0x8, 0x143a81) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f0000000080)=0x3, 0x4) (async) openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x189000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x100}, 0x0) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c00000001090212000100000000090401"], 0x0) (async) r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x3, 0x6000, 0x4e, &(0x7f00000001c0)="74f2f0b618c985b53cb668ea6161e5001843c87830126f22589ce4a218ee4d7526e60240cc0ab6df55b957723a966426d7b052a084bfc5cc3b332610817b458cc5dfd1f94628a781cd8eeec8d70d"}, {0x8, 0x2a19, 0x0, 0x0}], 0x2}) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) r6 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$apparmor_exec(r6, &(0x7f0000000240)=ANY=[@ANYBLOB="65786563203aa0"], 0x9d) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) (async) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys\x00\x00et/\x80\x00v4\x00\x00s/\x92ync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd1l,'}, 0x30) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r7) (async) r8 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x100) lseek(r8, 0x4, 0x0) getdents(r8, &(0x7f0000001fc0)=""/184, 0xb8) r9 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r9, &(0x7f0000000080)=ANY=[], 0x78) (async) close(r9) 6m24.375824163s ago: executing program 1 (id=4640): timer_create(0x6, &(0x7f00000000c0)={0x0, 0x26, 0x4, @thr={&(0x7f0000000140), &(0x7f0000000200)="ccadd0300996ba697ad1b59261ea654c87a75eae0c7ffdee3a5e3fed5d352cd514b49c890bd05c88061c7c34bcec4cd342e0043b860bd012338cb810459b5151dcf45d7240930002f17213a90d198a6caba4758fe1043afee5e5cd5b229d53248258b170b3e9bf6fefc9aac597a557a449d528268cae532e690fa4"}}, &(0x7f0000000280)) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0) 6m24.208531748s ago: executing program 1 (id=4641): r0 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r1 = dup(r0) write$binfmt_elf32(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="7f454c464a030103ff0700000000000002000300040000003e03000038000000d600000097700000fe03200001000700080007000000"], 0x58) r2 = fanotify_init(0x200, 0x0) r3 = pidfd_getfd(r1, r0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) pipe(&(0x7f0000000080)) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004a40)=ANY=[@ANYBLOB="d01000003f0007012dbd7000fbdbdf25047c00000400fc800c000180060006"], 0x10d0}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x4008032, 0xffffffffffffffff, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x60600, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r12, 0xc040aed5, &(0x7f00000000c0)={0x100000, 0x21d000}) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000000280)) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32=r5, @ANYBLOB="08009f000600000008002600b409"], 0x34}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)={0xfffffd96, r6, 0x200, 0x70bd23, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x20008050) fanotify_mark(r2, 0x1, 0x40001004, r1, 0x0) 6m19.497695049s ago: executing program 1 (id=4656): fsopen(&(0x7f00000000c0)='devpts\x00', 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000480)={@rxrpc=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @broadcast}}, {&(0x7f0000000200)=""/92, 0x5c}, &(0x7f00000000c0), 0x23}, 0xa0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r4 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_ENCODER_CMD(r4, 0xc028564d, &(0x7f00000003c0)={0x1, 0x1, [0x4, 0x7, 0x6, 0x6, 0x8, 0x0, 0x6, 0x5]}) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00') pivot_root(&(0x7f0000000080)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000600)='./file0/../file0/../file0/../file0\x00') r7 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r7, 0xc040565f, &(0x7f0000000280)={0xa, 0x1, 0x7, {0x8000, 0x1000, 0x4, 0x8}}) syz_emit_ethernet(0x1fc, &(0x7f0000001600)=ANY=[], 0x0) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000002c0)={0x2, @vbi={0x4, 0x5, 0x5, 0x47504a4d, [0x200, 0x7], [0x4f, 0x6], 0x1}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) read$FUSE(0xffffffffffffffff, 0x0, 0x0) 6m17.75375697s ago: executing program 1 (id=4666): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps_rollup\x00') mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x0, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000003980)=[{{&(0x7f0000000300)=@x25={0x9, @remote}, 0x80, &(0x7f0000001d00)=[{&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/202, 0xffffffb6}, {&(0x7f0000001a80)=""/81, 0x51}, {&(0x7f0000001b00)=""/197, 0xc5}, {&(0x7f0000001c00)=""/224, 0xe0}], 0x5}}, {{0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000001d80)=""/4096, 0x1000}, {&(0x7f0000002d80)=""/199, 0xc7}, {&(0x7f00000001c0)=""/34, 0x22}, {&(0x7f0000000380)=""/9, 0x9}], 0x4, &(0x7f0000002ec0)=""/165, 0xa5}, 0x7}, {{&(0x7f0000002f80)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000003340)=[{&(0x7f0000003000)=""/2, 0x2}, {&(0x7f0000003040)=""/129, 0x81}, {&(0x7f0000003100)=""/35, 0x23}, {&(0x7f0000003140)=""/45, 0x2d}, {&(0x7f0000003180)=""/188, 0xca}, {&(0x7f0000003280)=""/139, 0x8b}], 0x6}, 0xf}, {{&(0x7f00000033c0)=@ieee802154, 0x80, &(0x7f0000003900)=[{&(0x7f0000003440)=""/139, 0x8b}, {&(0x7f0000003500)=""/240, 0xf0}, {&(0x7f0000003600)=""/39, 0x27}, {&(0x7f0000003640)=""/216, 0xd8}, {&(0x7f0000003740)=""/90, 0x5a}, {&(0x7f00000037c0)=""/47, 0x2f}, {&(0x7f0000003800)=""/114, 0x72}, {&(0x7f0000003880)=""/72, 0x48}], 0x8}, 0x1}], 0x4, 0x2003, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180), 0x438001, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x4b, 0x1, 0xffffffff, 0x6, 0x0) syz_emit_ethernet(0x297, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd606410a602610000fc020000000000000000000000000000ff020000000000000000000000000001223415d5c9a46b9fa14172170a013589317d2af31ba55431762f462a5abc3f46494ee91bfca594d52f8c3785143e92da5d2d81edc09f68f122fbf741257bf1319408347a17c89212dfe27a0fc65362487e5afe673f0954f60d9d08b61276ce0b3aa520b5f30a9f52c4aa53fc003f8570383ca63530d93b78a7875338b3d7645ef2c24ab05db63cfdcde7b3cac2248c9d1c73d0d4382b3f520ad6e9be698eaa9bf5b939ce09919c9485c4725690ee2483315829a196f85a5ae552ebe19a2d6768ce2a6bf60f65e6e632f7e03f3028fa555fc9460df11e72eddebb2fc4eb6f83b16e0d65307e4210dfc209f0c68df65b57f420fd215546b798af6b6ab7bfb2fe6bd6142f8778d199c149c3ead97c4e16229ce4c08adac8e9f8111a0fc64651c21e9174dd72442a9ae2a42d9433c7b54c8dd4b59203f9a2e227e9b043eb430e606cf98f3428ac8511948dd553bc0728c0626fbda71bd2a1d734d605e27bdb0be93b7b91284689e31fccb70c15f2c39da9011c84d36fe4b4b36ff26e45a34685fc638dbdaa068a3d3d4f5d44b74afc0fc7956e5fcc3fe405ac6d292d1d90f257f18fe14a3192d28ed369956aa2f91f9fee773cf7fb5d90705347eeadc1af86de78a498fa1a20e5b3f481a0595769654d969299506d8ffbc172a7fb9453a8a3787e80b167936863f2cc16c1d03481bd40e1abcf87a292559771572136932bf30e48174012a1d4d5f138f93140af2ceb9c821c7966ea7592d762975b5b33ef141b6b91eb388c91b924945c3231d0f299adb5a36e0c95a17872e7ebf0bc0e33baf5c46f9e2087b77bad0794d519ce7bc8674a70f3545d020454ded22f164185df3b0585ab6a7f2244d32d6bf7c89e81712a592f2dc585d41010bfa670bdac342484fe58158349f9169022eb6afbff54d7c49a63e216fb4e22c710cd0397662b357f24f457d5d69c176b315076288622c8fe62424add835857fac52d99c525a7adf69b24f5de736d2ab3fcef18ce5e57e0601559849d251c52d7ab838e6867f7dcc511ef9d460de04114d904b2161e7b48b34c9b89d6e85610f88d08b367c44704c1355d7d1dafc387997bfb776d3ab06fc540af53989d6c87431e1ac85b421124ea557c628c65efbbb705659ac2190e74423b1a493e8101"], 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) r4 = openat$cgroup_ro(r3, &(0x7f00000002c0)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r3, @ANYBLOB="05", @ANYRES16=r3, @ANYRES16=r4], 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000000)=0x8, 0x4) shutdown(0xffffffffffffffff, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) fsopen(0x0, 0x0) r5 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x8) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b00100001000010000000000fedbdf25ac1414a5000000000000000000000000ac1414bb00000000000000000000000000000000000000000a00000064000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000032000000ac14142c0000000000000000000000000000007cf13db40000010000000000000000000000000000fdffffffffffff05000000000000000000000300000000000000000000000000e300000000000000fdffffffffffffff040000000000000000000008000000000000000001000000000000000000000002000000000a000004cd0000000000000048680200636263286165732900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000000001cf416000000000027bd7000000000002abd700028bd700000000000a5ff1400636d61632861657329000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000001a23f2cca40ff667f66a9bf8b2c2003dae414aecb904f6d0c956a1ab2753f42cc3f0b1cfe3dfeb492a8bf6f50da9354e5804971cbaad09202bc4b28c52fc644a03b5a8f07b05eeea256c34be7678fd0f3295242a97faecd0483cf5da7d0fe8eec5474ee9739bed822295149489a34585b193d3158669374070ad5687cd895b92630ff11fce9206"], 0x1b0}}, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000003240)=r0, 0x4) 6m17.071973155s ago: executing program 1 (id=4668): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc01000019000100fcffffff10000000ffffffff000000000000000000000000ac1414bb00000000000000000000000000000000ffff20000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000ffffff800000000000000009000000000000000800000000000000000000000000000000000000000000000000000000000000010000000000000009000000000000008000000000000000000000000000000000000000000000000101000300000000440105007f000001000000000000000000000000000004d43200000000000000ac14143b00000000000000000000000000000000000002000000000000000000000000007f000001000000000000000000000000000000002b00000000000000fe800000000000000000000000000000000000000000000000080000000000000000000020010000000000000000000000000001000004d43200000000000000fe8000000000000000000000000000aa0000800003000000000000000000000000000000ff010000000000000000000000000001000000000a010101000000000000000000000000043500000200010000000000bf"], 0x1fc}}, 0x0) 6m16.479252268s ago: executing program 32 (id=4668): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc01000019000100fcffffff10000000ffffffff000000000000000000000000ac1414bb00000000000000000000000000000000ffff20000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000ffffff800000000000000009000000000000000800000000000000000000000000000000000000000000000000000000000000010000000000000009000000000000008000000000000000000000000000000000000000000000000101000300000000440105007f000001000000000000000000000000000004d43200000000000000ac14143b00000000000000000000000000000000000002000000000000000000000000007f000001000000000000000000000000000000002b00000000000000fe800000000000000000000000000000000000000000000000080000000000000000000020010000000000000000000000000001000004d43200000000000000fe8000000000000000000000000000aa0000800003000000000000000000000000000000ff010000000000000000000000000001000000000a010101000000000000000000000000043500000200010000000000bf"], 0x1fc}}, 0x0) 16.199940391s ago: executing program 2 (id=5866): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) unshare(0x22020400) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff020000bfa3000000000000070300c034ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000c0ff00001d440000000000007a0a00fe00ffffffc3030000a1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0, r2, 0x0, 0xffffffffffffffff}, 0x18) syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r3, 0x0, 0x13, &(0x7f0000000240)=0x800, 0x4) 13.399157032s ago: executing program 2 (id=5877): syz_emit_ethernet(0x3e, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0xc95e}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r3 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r3, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) mlock2(&(0x7f00004e4000/0x1000)=nil, 0x1000, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r6 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x400, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r6, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c633774262eb5ab2c7b9c5cff6ce78185d8c4dc064744e042", 0xffffffffffffffff}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000006400)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x17, @local, 0x5}, 0x1c, &(0x7f0000005b80)=[{&(0x7f0000005880)='e', 0x1}], 0x1}}], 0x1, 0x931766f6319eed44) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000003140)={0x0, 0x7fff, 0x8, 0x7fff}, &(0x7f00000031c0)=0x10) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r7, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e681cdb9e581a38ebb0ddd5f307e56", r8, 0xffffffffffffffff}) close_range(r5, r6, 0x0) ioctl$SYNC_IOC_FILE_INFO(r9, 0x40103e05, &(0x7f0000000180)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) sendto$inet6(r4, &(0x7f0000000280)='g', 0x1, 0x4008891, &(0x7f000005ffe4)={0xa, 0x0, 0x1000000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xffffffff}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000040)={0xb, 0x4, 0xfe, 0x2, 0x5, 0x0, 0x5, 0x0, 0x0, 0x5, 0x3, 0x0, 0x0, 0x5}, 0xe) setsockopt$sock_int(r4, 0x1, 0x28, &(0x7f0000000000)=0xf66, 0x4) shutdown(r4, 0x1) recvmmsg(r4, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x12002, 0x0) 11.60686891s ago: executing program 2 (id=5886): openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000), 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') io_setup(0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) shutdown(r3, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) unshare(0x400) setsockopt$inet6_opts(r4, 0x29, 0x40, 0x0, 0xd0060) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "ffffffffffffffe2", "acd40800000000000084000000000005", "6a3afbb9", "1277f8eb62db00"}, 0x28) shutdown(r2, 0x1) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000000), 0xffffff6a) sendfile(r2, r5, 0x0, 0xffffffff004) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) r7 = syz_clone(0x23802400, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r7, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 11.567400581s ago: executing program 5 (id=5887): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020400) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff020000bfa3000000000000070300c034ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000c0ff00001d440000000000007a0a00fe00ffffffc3030000a1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0, r2, 0x0, 0xffffffffffffffff}, 0x18) syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r3, 0x0, 0x13, &(0x7f0000000240)=0x800, 0x4) 10.612944609s ago: executing program 4 (id=5890): r0 = socket$inet6(0xa, 0x3, 0x5) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e24, 0x0, @empty}, 0x1c) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) add_key(0x0, 0x0, &(0x7f00000002c0), 0x0, 0xfffffffffffffffe) r4 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r4, &(0x7f0000000a40)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0x1061, 0x80, 0x4, 0x1ab}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)) socket$inet6_tcp(0xa, 0x1, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r5, 0x47f8, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="14000000100001000000bbf2c59700000200000a14000000090a050000000000000000000200000214000000110001fd00000000000000000700000a"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) setpriority(0x2, 0x0, 0x6) r7 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x3f73, 0x100, 0x0, 0x1a}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r7, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0xffffffffffffff3a, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000000c0)={'wg0\x00'}) sendmsg$nl_route_sched(r10, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r11, 0x0, 0x0, 0x0, 0x262, 0x1, {0x1}}) io_uring_enter(r7, 0x3516, 0x0, 0x0, 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000100)={0x3c0, 0x300, 0x3c00, 0x1000, 0xbb3a, 0x2, 0x0, 0x100, {0x0, 0x40002000}, {0x0, 0x2, 0x1}, {0x4000000, 0x7}, {0xfe, 0x8, 0x40000}, 0x0, 0x3f0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}) 10.147959463s ago: executing program 2 (id=5891): syz_io_uring_setup(0x10c, &(0x7f00000000c0)={0x0, 0x3eac, 0x400, 0x2, 0x105}, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x583, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="6400000010000304000000200000000000000000", @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 9.830516806s ago: executing program 5 (id=5892): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0x42, 0x4, 0x328, 0xffffffff, 0xf0, 0x0, 0xf0, 0xffffffff, 0xffffffff, 0x290, 0x290, 0x290, 0xffffffff, 0x4, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'vlan0\x00', {0xff}, {0xff}, 0x8, 0x0, 0x17}, 0x0, 0xc8, 0xf0, 0x0, {0x100000000000000}, [@common=@inet=@tos={{0x28}, {0x1, 0xb, 0x1}}, @common=@unspec=@connmark={{0x30}}]}, @REJECT={0x28}}, {{@ip={@loopback, @rand_addr=0x64010101, 0xffffff00, 0xff000000, 'geneve0\x00', 'macvlan0\x00', {0xff}, {}, 0x2, 0x0, 0x17}, 0x0, 0x70, 0xd0, 0x0, {0x0, 0xb203000000000000}}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @multicast, 0x1, 0x3, [0x24, 0x2c, 0x4, 0x2, 0x12, 0x22, 0x16, 0x10, 0x35, 0x1a, 0x31, 0x3e, 0x9, 0x0, 0x24, 0x39], 0x1, 0x6, 0x7}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x3a}, @loopback, 0xff, 0xffffff00, 'bond0\x00', 'dvmrp0\x00', {}, {}, 0x2f, 0x2, 0x21}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @empty, 0xd, 0x8, [0xa, 0x26, 0x2a, 0xa, 0x13, 0xe, 0x29, 0x21, 0x2d, 0x32, 0x40, 0x20, 0x28, 0x18, 0x22, 0x1e], 0x1, 0x0, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x388) 9.504683142s ago: executing program 5 (id=5893): connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x4, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x20004000) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0xc, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) write$cgroup_int(r0, &(0x7f0000000240)=0x8fd, 0x12) add_key(&(0x7f00000000c0)='pkcs7_test\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000dc0)={0x8, 'vlan1\x00', {'ip6_vti0\x00'}}) write$apparmor_current(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="706572866d70726f66696c64203a273a02"], 0x10) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000140)={"3c24f54d321bc81157f8000000000000002800200000000000000000000800"}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000200)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x40094}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CLEAR_HALT(r3, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) open(&(0x7f0000000240)='./file0\x00', 0x40000, 0x122) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r4 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r4, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x190, 0x1, 0x0, 0xdd9f83, 0x1, 0x9, 0x1, 0x2, 0x5, 0x722, 0xed, 0x7, 0x7f, 0x3f, 0xb763599953cb091d, {0x10000, 0x6fd8e84b}, 0x3, 0xed}}) mkdir(&(0x7f0000000180)='./file0\x00', 0x153) 9.307788618s ago: executing program 2 (id=5894): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b"], 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x101001a, &(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB, @ANYRESDEC=0x0, @ANYRES16=r1, @ANYRESDEC=0x0, @ANYBLOB=',allow_othe'], 0xfb, 0x0, 0x0) r2 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f00000000c0)="ff02040000ffffffffecffffff1f2be82db1af0000000000", 0x18) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x18) connect$inet6(r2, &(0x7f0000000240)={0xa, 0x6e23, 0xfffffdff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000001840), 0x3b, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') socket$inet(0x2, 0x3, 0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0xfffffffc) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r7, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) 8.823932089s ago: executing program 5 (id=5897): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f00000000c0)={0x12}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x0, 0x0}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x7, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r2, 0x0, 0x94) r3 = socket$netlink(0x10, 0x3, 0xa) dup(r3) socket$alg(0x26, 0x5, 0x0) socket(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x40000000000015b, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) 8.689138883s ago: executing program 0 (id=5898): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/binder0\x00', 0x1000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r2 = dup3(r1, r1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a88000000060a0b040000000080000000020000005c000480240001800b000100736f636b657400001400028008000240000000030800014000000002240001800b0001007470726f787900001400028008000140000000020800024000000003100001800a00010072616e67650000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000a00000a"], 0xb0}}, 0x40880) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) r5 = fanotify_init(0x1200, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3c) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001180)=ANY=[@ANYBLOB="00000099", @ANYRES16=0x0, @ANYRESOCT, @ANYRESDEC=r5, @ANYBLOB="a80102803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB="c1a61f0b243890b05f1d524dccb4b0643bea04eb14acf962828ceef67875db1e7850f0bbad735b1f0a07f3b7950a7bc5c250f1a6241c7e469242f8836d22c74bc9f0b5d886ee776527525ef42fdcf5c184d5d07c02a6a91b4a369a282d61fb9672bd5d945d7fa683827bb0afdc9a2772ef2f83cd1e1b3f214cc5a092b38a11677bfa041ea3d4dddf622f2b4efc88dc76950ef18ca84da468cfe00a", @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="380001006e6f746966795f70656572735f696e74657276616c000000000000000000000005000300030000b90800040005000000400001002400010071756575655f696400000000000000000000000000000000000000000000001c0500030003000000080004000b0400000800060000000000", @ANYRES32, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000f000400726f756e64726f62696e00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES64=r2, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400ff03000008000100", @ANYRES32=0x0, @ANYBLOB="400002803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB], 0x20c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000940)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6654050000082c00fe8000000000000000000000000000aafe8000000000000000000000000000aa3b000007000000000c5054764c69d18dde526481b305645c3fe1a170ff1db4dd93d4436ef678358d808d69638c642470d01a5bacbc016a6f83df00c9050e4935961f426d411a4ac4bbea010e71b178dac6e049ec8cc32704722deb2d79e54e3e7f171e0d1603d52aff789b365ab65660efab25d00f7db469f14aa0daac553a9e0e0e035551cd713fc6c82ce4350705d1e7785e4c3e49b3d5a82b2dc830e933d3d27298b0fa160131e6db2eaded0591431eb266463cf3ee3f15450c450c1cf4b556d1f0c280f32e0c9fce15ba242d452bdfc8d34e8b859f822218dc2c8ac7163333ca3cd335251daabf2c774016"], 0x0) 7.569515111s ago: executing program 0 (id=5899): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)={0x2c, 0x24, 0xc8fe83ee7f0e7fd5, 0x0, 0x0, "", [@typed={0x14, 0x31, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @nested={0x8, 0x0, 0x0, 0x0, [@typed={0x4}]}]}, 0x2c}], 0x1}, 0x4000) r1 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000005c0)={'#! ', './file1/../file0', [{0x20, '\x00.\x11U!\xac\xb2\x80\x9f4Lg\x1d\xbek\xefL !\t\xa8\x81\x1a\x84O\xcb\x9b5\x0e^\xe8\xd72L\xba\x06\xef7m\xb6z\xa2\xfev 2\x12X\xbb\xe3-1\xac\xdc\xeaX\xb8\xdb\x88\x80;\xd2\xf7\x11\xcd\xc1\x81\x144\x96tJ&\xaa\x8e\x111HX\xc2Z\xdc\xa5\xe1\xc2p/\xc1\xa7\x82*\v\xbfk\x12S\x92\xa3\x87\xa8v\xa0\x01\xca\xab\xa1\x19\'j\x8a\xbdf \xf5@\xb1\x8aE <\xa7K\xe3\xedG\xffM\xd2e\xadfi\xba\x121\x175\x1a\xee+X*\x8a\x82\x8aNm9\x96\x11\x15\xe9\xb5;3\t\x06-\xe6\xf2\xdf%[C6,\x91\xe6\xfb\xef\xcd\xd3\x0fg\x8e;p\xa7_\x98\xcen\xb2\a\xfb7y\xec\xd1\xdb\xd3\x1e\xd1\xcc\xc7e\x82\xf6\xe0\xbb\xeftD\x7f\x89\xb7\xf8\xc1\x1f\xfbz9\xa8\xc9\x87\x0f\xb8!\xb5\x93\xf6\xe9m\xb4\x13M\xf9E\x06\x85\x1f]\xd7\n3\x0e\x1f\x1aT\x05\xc7\x81\xdfs\'UJ\x92\xc3\x9a\xfe\xa8\xa7\xa9G\xd3'}], 0xa, "0002783348b29e7bcaf3e29c2593b929f38db16e33ea96f57d49c226f35df5a073e47a165b0074fbf80de701b0728381f07c35183b8242af6ed8d42a819bf58c54c07408000c6cfa4ae3c32d"}, 0x161) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x1e, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea8a1d91bec8d4b5a6d80b8785d9600010000000000000094d75396dccd0ff600000000a81b00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x1]}}) 7.260833548s ago: executing program 0 (id=5901): openat$nullb(0xffffff9c, &(0x7f0000000080), 0x100, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.idle_time\x00', 0x26e1, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000080)=0x8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0xa, 0x3, 0x87) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000000)={@loopback, 0x78, r4}) ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x8936, &(0x7f0000000000)) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000640)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r2) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000000c0)={0x30, r6, 0x1, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x14, 0x11d, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xac}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4c080}, 0x20000040) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5393, &(0x7f0000000000)) 6.960078996s ago: executing program 4 (id=5902): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020400) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff020000bfa3000000000000070300c034ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000c0ff00001d440000000000007a0a00fe00ffffffc3030000a1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0, r2, 0x0, 0xffffffffffffffff}, 0x18) syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r3, 0x0, 0x13, &(0x7f0000000240)=0x800, 0x4) 5.407998152s ago: executing program 2 (id=5906): r0 = socket$unix(0x1, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x4c, &(0x7f0000000000), 0x4) bind$unix(r0, &(0x7f0000000040)=@abs={0x1}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), &(0x7f0000000880)="22cff5", 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0x10, 0x80000, 0x3) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x8, 0x3}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x94, 0x24, 0xf0b, 0x70bd2d, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x64, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe], 0x0, [0x8, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}]}}]}, 0x94}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c0800014000000002080001400000003008000240000000030800014000000012080003"], 0x122}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x50) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000000c0)={r6, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0xce024d}, 0x9c) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000b50000008200000018110000", @ANYRES32=r4, @ANYBLOB, @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000003f00002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) r8 = socket$kcm(0x11, 0x2, 0x300) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000000)=r7, 0x4) r9 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r9, &(0x7f0000000380)={&(0x7f0000000080)={0x2, 0x4e1f, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @multicast2}}}], 0x20}, 0x0) unshare(0x42000000) 5.355179486s ago: executing program 3 (id=5907): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'netdevsim0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001340)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32=r1], 0x54}, 0x1, 0x0, 0x0, 0xfffe}, 0x800) 5.276003767s ago: executing program 0 (id=5908): r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) close(0xffffffffffffffff) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r5, &(0x7f0000000a00)=ANY=[@ANYBLOB="7f454c4604070003070000000000000002000300030000000903000038000000fcffffff0e000000000020000100050000000000000000000300000008000000f30000007f00000004"], 0x58) close(r5) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) fchdir(r4) r6 = open(&(0x7f0000000000)='./file1\x00', 0x80242, 0x8) write$FUSE_CREATE_OPEN(r6, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r6, r6, &(0x7f0000000080), 0x4d9b6eaf) write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) cachestat(r0, &(0x7f00000000c0)={0x9, 0x8}, &(0x7f0000000140), 0x0) 5.231291161s ago: executing program 4 (id=5909): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/binder0\x00', 0x1000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r2 = dup3(r1, r1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a88000000060a0b040000000080000000020000005c000480240001800b000100736f636b657400001400028008000240000000030800014000000002240001800b0001007470726f787900001400028008000140000000020800024000000003100001800a00010072616e67650000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000a00000a"], 0xb0}}, 0x40880) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) r5 = fanotify_init(0x1200, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3c) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001180)=ANY=[@ANYBLOB="00000099", @ANYRES16=0x0, @ANYRESOCT, @ANYRESDEC=r5, @ANYBLOB="a80102803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB="c1a61f0b243890b05f1d524dccb4b0643bea04eb14acf962828ceef67875db1e7850f0bbad735b1f0a07f3b7950a7bc5c250f1a6241c7e469242f8836d22c74bc9f0b5d886ee776527525ef42fdcf5c184d5d07c02a6a91b4a369a282d61fb9672bd5d945d7fa683827bb0afdc9a2772ef2f83cd1e1b3f214cc5a092b38a11677bfa041ea3d4dddf622f2b4efc88dc76950ef18ca84da468cfe00a", @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="380001006e6f746966795f70656572735f696e74657276616c000000000000000000000005000300030000b90800040005000000400001002400010071756575655f696400000000000000000000000000000000000000000000001c0500030003000000080004000b0400000800060000000000", @ANYRES32, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000f000400726f756e64726f62696e00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES64=r2, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400ff03000008000100", @ANYRES32=0x0, @ANYBLOB="400002803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB], 0x20c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000940)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6654050000082c00fe8000000000000000000000000000aafe8000000000000000000000000000aa3b000007000000000c5054764c69d18dde526481b305645c3fe1a170ff1db4dd93d4436ef678358d808d69638c642470d01a5bacbc016a6f83df00c9050e4935961f426d411a4ac4bbea010e71b178dac6e049ec8cc32704722deb2d79e54e3e7f171e0d1603d52aff789b365ab65660efab25d00f7db469f14aa0daac553a9e0e0e035551cd713fc6c82ce4350705d1e7785e4c3e49b3d5a82b2dc830e933d3d27298b0fa160131e6db2eaded0591431eb266463cf3ee3f15450c450c1cf4b556d1f0c280f32e0c9fce15ba242d452bdfc8d34e8b859f822218dc2c8ac7163333ca3cd335251daabf2c774016"], 0x0) 5.215841076s ago: executing program 5 (id=5910): socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = fsopen(&(0x7f00000001c0)='devpts\x00', 0x0) r3 = socket$inet(0xa, 0x801, 0x84) connect$inet(r3, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r3, 0x8) r4 = accept4(r3, 0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xf, &(0x7f0000000300)=ANY=[@ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000030000008500000083000000bf0900000000000055090100000000009500000000000000bf980000000000005608000002000000c500000007000000b70000000100000095"], &(0x7f00000002c0)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendto$inet(r4, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000000)={0x2, 0x0, 0x6, 0xffffffff}, 0x10) sendto$inet6(r4, 0x0, 0x0, 0x4000050, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000400)={0x0, 0x4}, 0x8) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsmount(r2, 0x0, 0xf) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYRES8, @ANYRES32=0x0, @ANYBLOB="20000100", @ANYRES32=0x0, @ANYBLOB="0000fe0f000000000000000000000000800000006a"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000002000008004500001c00000000004f907800000000ffffffff00004e2000089078"], 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) 4.489237154s ago: executing program 3 (id=5911): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)={0x2c, 0x24, 0xc8fe83ee7f0e7fd5, 0x0, 0x0, "", [@typed={0x14, 0x31, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @nested={0x8, 0x0, 0x0, 0x0, [@typed={0x4}]}]}, 0x2c}], 0x1}, 0x4000) r1 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_INPUT(r2, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e42794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423b38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f826c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e4", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x1e, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea8a1d91bec8d4b5a6d80b8785d9600010000000000000094d75396dccd0ff600000000a81b00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x1]}}) 4.322585826s ago: executing program 4 (id=5912): sigaltstack(&(0x7f0000000000)={0xffffffffffffffff, 0x0, 0xfffffffffffffefa}, &(0x7f0000000080)={&(0x7f0000000040)}) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (rerun: 32) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async, rerun: 32) syz_usb_connect$cdc_ncm(0x3, 0x72, &(0x7f00000000c0)=ANY=[@ANYRES32=r0, @ANYRESDEC=r0, @ANYRESOCT], 0x0) (async, rerun: 32) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async, rerun: 64) syz_io_uring_setup(0x809e, &(0x7f0000000640)={0x0, 0x934, 0x0, 0x0, 0x111}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)) (rerun: 64) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0x403, 0x0, 0x4) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) close(r1) (async, rerun: 64) r3 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), r1) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) (async, rerun: 64) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (rerun: 64) r6 = accept$alg(r5, 0x0, 0x0) sendmmsg$alg(r6, &(0x7f0000000340), 0x0, 0x24048010) (async) r7 = io_uring_setup(0x3fac, &(0x7f0000000380)={0x0, 0xc84c, 0x4000, 0x0, 0x2020000}) close_range(r7, 0xffffffffffffffff, 0x0) (async) recvmmsg(r6, &(0x7f0000000180), 0x1, 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0) close(r8) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r9, 0x84, 0xc, &(0x7f0000000000), 0x4) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r9, 0x84, 0x6b, &(0x7f00000002c0)=[@in={0x2, 0x4e21, @remote}], 0x10) 4.118082969s ago: executing program 3 (id=5913): openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000), 0x2) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') syz_open_procfs$namespace(0x0, 0x0) io_setup(0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "ffffffffffffffe2", "acd40800000000000084000000000005", "6a3afbb9", "1277f8eb62db00"}, 0x28) shutdown(r2, 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) sendfile(r2, r3, 0x0, 0xffffffff004) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) r5 = syz_clone(0x23802400, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r5, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x10) 3.279913418s ago: executing program 4 (id=5914): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x22, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f00000000c0)=0x100000001, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r2 = syz_io_uring_setup(0xa1, &(0x7f0000000640)={0x0, 0xe8ce, 0x0, 0x20, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000020c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x6007, @fd=r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001800)=""/211, 0xd3}], 0x1}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000002800)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000000)="1eb3bf65654102f4af4d221c8bd458d1e7cbdaf3657d0f34e790c85bdba7931791f6d15c3e681411f7a496c0dace6a3c242f5b016f64b4ef8a9cedaf6bec340dee49474360b24cb8", 0x0, 0x48) 2.841857587s ago: executing program 5 (id=5915): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd604dd308001c0600fe8000000000000000000000000000aafe8000000000000000000000000000aa00004001", @ANYRES32=0x41424344, @ANYBLOB="7002000090780001fe08f989fe2e80ee28e4a7d626c36a8a5fd7a71916dc29d1c1ea9c2e8f53b1971ce5b1fd343ae33083e49fd334d3cd5b9378c9ef39ed4fffdc5ae1"], 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) readv(r2, &(0x7f00000003c0)=[{&(0x7f0000000140)=""/209, 0xd1}, {&(0x7f0000000240)=""/162, 0xa2}, {&(0x7f0000000040)=""/23, 0x17}, {&(0x7f0000000300)=""/47, 0x2f}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000000380)=""/37, 0x25}], 0x6) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc53a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x80, [{{0x9, 0x4, 0x0, 0x8, 0xff, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x81, 0x20, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xfe, 0x0, 0x4}}}}}]}}]}}, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f00000002c0)={0x2, 'veth1_virt_wifi\x00'}, 0x18) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8cf1b7cf57bd4d32}, 0x20000000) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="2000000069000b00020000a30d00000000f5ffffff0000000800010002000000"], 0x20}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a000000000000000400040030db918bc8ccf0be2dd96793159ba6a59ac3d6bdbeea02dc4f60f807c9b1f96d01fd76e189f2aad75bddc1cb9f51a262dd6585b4d25b"], 0x1c}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, 0x0, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x2, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x8, "db19ff47"}]}}, 0x0}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x2, &(0x7f0000000600)=[{0x6, 0x3, 0x0, 0x7fff0006}, {0x1, 0x4, 0x3, 0x1}]}) 2.653327707s ago: executing program 3 (id=5916): r0 = socket$inet_sctp(0x2, 0x1, 0x84) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$vbi(&(0x7f00000001c0), 0x3, 0x2) add_key(&(0x7f0000000000)='ceph\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r3, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r3, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) shutdown(r3, 0x1) pselect6(0x40, &(0x7f0000000140)={0x1, 0x4, 0x3, 0xff, 0x4, 0xea2b, 0x7, 0x2300000000000}, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x3938700}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@deltaction={0x48, 0x18, 0x1, 0x70bd2a, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x34, 0x1, [{0x10, 0x8f, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x20000, 0x0) ioctl$SNDCTL_TMR_TEMPO(r5, 0xc0045405, &(0x7f0000000280)=0x13f) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @broadcast}], 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000140)=[{0x6, 0x8, 0x8, 0xa}]}, 0x10) r6 = dup(r0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111, 0x6}}, 0x20) 2.385921694s ago: executing program 4 (id=5918): r0 = memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) r1 = dup(r0) write$binfmt_elf32(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="7f454c464a030103ff0700000000000002000300040000003e03000038000000d600000097700000fe03200001000700080007000000000003"], 0x58) r2 = fanotify_init(0x200, 0x0) r3 = pidfd_getfd(r1, r0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) pipe(0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004a40)=ANY=[@ANYBLOB="d01000003f0007012dbd7000fbdbdf25047c00000400fc800c000180060006"], 0x10d0}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x4008032, 0xffffffffffffffff, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x60600, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r11, 0xc040aed5, &(0x7f00000000c0)={0x100000, 0x21d000}) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000000280)) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32, @ANYBLOB="08009f000600000008002600b409"], 0x34}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)={0xfffffd96, r5, 0x200, 0x70bd23, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x20008050) fanotify_mark(r2, 0x1, 0x40001004, r1, 0x0) 2.330541054s ago: executing program 0 (id=5919): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020400) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff020000bfa3000000000000070300c034ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000c0ff00001d440000000000007a0a00fe00ffffffc3030000a1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={0x0, r2, 0x0, 0xffffffffffffffff}, 0x18) syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r3, 0x0, 0x13, &(0x7f0000000240)=0x800, 0x4) 563.383402ms ago: executing program 3 (id=5920): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r2 = socket(0x2b, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) connect$rds(r1, &(0x7f00000001c0)={0x2, 0x4e23, @empty}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) msgctl$IPC_INFO(0x0, 0x3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r3}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000140)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x73, r3}) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='pim6reg\x00', 0x10) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newlink={0x88, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x60, 0x12, 0x0, 0x1, @gre={{0x8}, {0x54, 0x2, 0x0, 0x1, [@IFLA_GRE_PMTUDISC={0x5}, @IFLA_GRE_REMOTE={0x8, 0x7, @empty}, @IFLA_GRE_IGNORE_DF={0x5}, @IFLA_GRE_PMTUDISC={0x5, 0xa, 0x1}, @IFLA_GRE_LOCAL={0x8, 0x6, @remote}, @IFLA_GRE_IKEY={0x8, 0x4, 0x9}, @IFLA_GRE_PMTUDISC={0x5, 0xa, 0x1}, @IFLA_GRE_ENCAP_TYPE={0x6}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e21}, @IFLA_GRE_PMTUDISC={0x5, 0xa, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x88}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 153.77743ms ago: executing program 0 (id=5921): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'macvlan0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000004c0)={r2, 0x3, 0x6, @link_local}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000040), 0x76, 0x141201) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000080)=@urb_type_control={0x2, {}, 0x0, 0x81, &(0x7f0000000240)={0x40, 0x18}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}, [0x8, 0x0, 0x77c0, 0xfffffffffffffffc, 0xffff, 0x8, 0x40, 0xcdff, 0x0, 0x4, 0x5, 0x586fdb6e, 0xf8ae, 0x7fff, 0x7]}, &(0x7f0000000100)=0x100) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000140)={r4, 0x3}, &(0x7f0000000180)=0x8) 0s ago: executing program 3 (id=5922): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs2/binder0\x00', 0x1000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r2 = dup3(r1, r1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a88000000060a0b040000000080000000020000005c000480240001800b000100736f636b657400001400028008000240000000030800014000000002240001800b0001007470726f787900001400028008000140000000020800024000000003100001800a00010072616e67650000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000a00000a"], 0xb0}}, 0x40880) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) r5 = fanotify_init(0x1200, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3c) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001180)=ANY=[@ANYBLOB="00000099", @ANYRES16=0x0, @ANYRESOCT, @ANYRESDEC=r5, @ANYBLOB="a80102803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB="c1a61f0b243890b05f1d524dccb4b0643bea04eb14acf962828ceef67875db1e7850f0bbad735b1f0a07f3b7950a7bc5c250f1a6241c7e469242f8836d22c74bc9f0b5d886ee776527525ef42fdcf5c184d5d07c02a6a91b4a369a282d61fb9672bd5d945d7fa683827bb0afdc9a2772ef2f83cd1e1b3f214cc5a092b38a11677bfa041ea3d4dddf622f2b4efc88dc76950ef18ca84da468cfe00a", @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="380001006e6f746966795f70656572735f696e74657276616c000000000000000000000005000300030000b90800040005000000400001002400010071756575655f696400000000000000000000000000000000000000000000001c0500030003000000080004000b0400000800060000000000", @ANYRES32, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000f000400726f756e64726f62696e00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES64=r2, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400ff03000008000100", @ANYRES32=0x0, @ANYBLOB="400002803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYBLOB], 0x20c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000940)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6654050000082c00fe8000000000000000000000000000aafe8000000000000000000000000000aa3b000007000000000c5054764c69d18dde526481b305645c3fe1a170ff1db4dd93d4436ef678358d808d69638c642470d01a5bacbc016a6f83df00c9050e4935961f426d411a4ac4bbea010e71b178dac6e049ec8cc32704722deb2d79e54e3e7f171e0d1603d52aff789b365ab65660efab25d00f7db469f14aa0daac553a9e0e0e035551cd713fc6c82ce4350705d1e7785e4c3e49b3d5a82b2dc830e933d3d27298b0fa160131e6db2eaded0591431eb266463cf3ee3f15450c450c1cf4b556d1f0c280f32e0c9fce15ba242d452bdfc8d34e8b859f822218dc2c8ac7163333ca3cd335251daabf2c774016"], 0x0) kernel console output (not intermixed with test programs): ed from ttyUSB0 [ 1305.121752][T24419] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1305.151203][T20588] cp210x 4-1:0.0: device disconnected [ 1305.287356][T24436] netlink: 2 bytes leftover after parsing attributes in process `syz.2.5250'. [ 1305.391270][ T5921] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 1305.557857][ T5921] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1305.616348][ T5921] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1305.632918][ T5921] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1305.671246][ T5921] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1305.684490][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1305.701173][ T5921] usb 5-1: Product: syz [ 1305.716326][ T5921] usb 5-1: Manufacturer: syz [ 1305.740596][ T5921] usb 5-1: SerialNumber: syz [ 1305.768166][ T5921] hub 5-1:1.0: bad descriptor, ignoring hub [ 1305.780567][ T5921] hub 5-1:1.0: probe with driver hub failed with error -5 [ 1305.977178][ T5921] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 38 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1306.252696][T24444] FAULT_INJECTION: forcing a failure. [ 1306.252696][T24444] name failslab, interval 1, probability 0, space 0, times 0 [ 1306.272762][T24444] CPU: 0 UID: 0 PID: 24444 Comm: syz.0.5253 Not tainted syzkaller #0 PREEMPT(full) [ 1306.272788][T24444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1306.272799][T24444] Call Trace: [ 1306.272808][T24444] [ 1306.272817][T24444] dump_stack_lvl+0x189/0x250 [ 1306.272842][T24444] ? __pfx____ratelimit+0x10/0x10 [ 1306.272868][T24444] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1306.272888][T24444] ? __pfx__printk+0x10/0x10 [ 1306.272913][T24444] ? __lock_acquire+0xab9/0xd20 [ 1306.272943][T24444] should_fail_ex+0x414/0x560 [ 1306.272975][T24444] should_failslab+0xa8/0x100 [ 1306.273000][T24444] kmem_cache_alloc_noprof+0x74/0x6e0 [ 1306.273021][T24444] ? skb_clone+0x212/0x3a0 [ 1306.273046][T24444] skb_clone+0x212/0x3a0 [ 1306.273068][T24444] __netlink_deliver_tap+0x404/0x850 [ 1306.273105][T24444] ? netlink_deliver_tap+0x2e/0x1b0 [ 1306.273131][T24444] netlink_deliver_tap+0x19c/0x1b0 [ 1306.273157][T24444] netlink_unicast+0x7fa/0x9e0 [ 1306.273193][T24444] ? __pfx_netlink_unicast+0x10/0x10 [ 1306.273217][T24444] ? netlink_sendmsg+0x642/0xb30 [ 1306.273247][T24444] ? skb_put+0x11b/0x210 [ 1306.273276][T24444] netlink_sendmsg+0x805/0xb30 [ 1306.273310][T24444] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1306.273337][T24444] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1306.273360][T24444] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1306.273382][T24444] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1306.273408][T24444] __sock_sendmsg+0x21c/0x270 [ 1306.273434][T24444] ____sys_sendmsg+0x505/0x830 [ 1306.273458][T24444] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1306.273492][T24444] ? import_iovec+0x74/0xa0 [ 1306.273519][T24444] ___sys_sendmsg+0x21f/0x2a0 [ 1306.273539][T24444] ? __pfx____sys_sendmsg+0x10/0x10 [ 1306.273590][T24444] ? __fget_files+0x2a/0x420 [ 1306.273610][T24444] ? __fget_files+0x3a0/0x420 [ 1306.273642][T24444] __x64_sys_sendmsg+0x19b/0x260 [ 1306.273663][T24444] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1306.273691][T24444] ? __pfx_ksys_write+0x10/0x10 [ 1306.273715][T24444] ? do_syscall_64+0xbe/0xfa0 [ 1306.273737][T24444] do_syscall_64+0xfa/0xfa0 [ 1306.273754][T24444] ? lockdep_hardirqs_on+0x9c/0x150 [ 1306.273772][T24444] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1306.273790][T24444] ? clear_bhb_loop+0x60/0xb0 [ 1306.273812][T24444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1306.273831][T24444] RIP: 0033:0x7f7f4ff8efc9 [ 1306.273847][T24444] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1306.273863][T24444] RSP: 002b:00007f7f4e1f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1306.273883][T24444] RAX: ffffffffffffffda RBX: 00007f7f501e5fa0 RCX: 00007f7f4ff8efc9 [ 1306.273897][T24444] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1306.273909][T24444] RBP: 00007f7f4e1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1306.273921][T24444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1306.273932][T24444] R13: 00007f7f501e6038 R14: 00007f7f501e5fa0 R15: 00007f7f5030fa28 [ 1306.273964][T24444] [ 1307.083465][ T30] audit: type=1326 audit(1760766138.997:1545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24441 comm="syz.5.5254" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x0 [ 1307.180284][T24465] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5258'. [ 1307.299970][T24470] tipc: Enabling of bearer rejected, already enabled [ 1307.389625][ T5921] usb 5-1: USB disconnect, device number 38 [ 1307.407353][ T5921] usblp0: removed [ 1307.552141][T24476] ipvlan1: entered promiscuous mode [ 1307.584245][T24476] ipvlan1: entered allmulticast mode [ 1307.590019][T24476] veth0_vlan: entered allmulticast mode [ 1307.666221][ T5897] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 1307.700630][T24481] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1307.835503][ T5897] usb 5-1: config 0 has no interfaces? [ 1307.851726][ T5897] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1307.861480][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1307.899664][ T5897] usb 5-1: Product: syz [ 1307.904011][ T5897] usb 5-1: Manufacturer: syz [ 1307.967757][ T5897] usb 5-1: SerialNumber: syz [ 1308.116930][ T5897] usb 5-1: config 0 descriptor?? [ 1308.516549][T24490] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5265'. [ 1308.529651][T24490] vlan2: entered promiscuous mode [ 1309.575590][T24504] FAULT_INJECTION: forcing a failure. [ 1309.575590][T24504] name failslab, interval 1, probability 0, space 0, times 0 [ 1309.705925][T24504] CPU: 0 UID: 0 PID: 24504 Comm: syz.2.5269 Not tainted syzkaller #0 PREEMPT(full) [ 1309.705954][T24504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1309.705965][T24504] Call Trace: [ 1309.705972][T24504] [ 1309.705980][T24504] dump_stack_lvl+0x189/0x250 [ 1309.706004][T24504] ? __pfx____ratelimit+0x10/0x10 [ 1309.706028][T24504] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1309.706046][T24504] ? __pfx__printk+0x10/0x10 [ 1309.706068][T24504] ? __pfx___might_resched+0x10/0x10 [ 1309.706094][T24504] should_fail_ex+0x414/0x560 [ 1309.706125][T24504] should_failslab+0xa8/0x100 [ 1309.706148][T24504] __kmalloc_cache_noprof+0x6f/0x6f0 [ 1309.706168][T24504] ? hash_netiface_create+0x2fe/0xfe0 [ 1309.706197][T24504] hash_netiface_create+0x2fe/0xfe0 [ 1309.706227][T24504] ? __nla_parse+0x40/0x60 [ 1309.706247][T24504] ? __pfx_hash_netiface_create+0x10/0x10 [ 1309.706271][T24504] ip_set_create+0xa97/0x1940 [ 1309.706301][T24504] ? ip_set_create+0x4a2/0x1940 [ 1309.706335][T24504] ? __pfx_ip_set_create+0x10/0x10 [ 1309.706394][T24504] nfnetlink_rcv_msg+0xb4d/0x1130 [ 1309.706418][T24504] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 1309.706459][T24504] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1309.706506][T24504] ? rcu_preempt_deferred_qs_irqrestore+0x89c/0xce0 [ 1309.706550][T24504] netlink_rcv_skb+0x208/0x470 [ 1309.706576][T24504] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1309.706600][T24504] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1309.706636][T24504] ? bpf_lsm_capable+0x9/0x20 [ 1309.706653][T24504] ? security_capable+0x7e/0x2e0 [ 1309.706680][T24504] nfnetlink_rcv+0x282/0x2590 [ 1309.706706][T24504] ? is_bpf_text_address+0x26/0x2b0 [ 1309.706737][T24504] ? __kernel_text_address+0xd/0x40 [ 1309.706763][T24504] ? unwind_get_return_address+0x4d/0x90 [ 1309.706788][T24504] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1309.706807][T24504] ? arch_stack_walk+0xfc/0x150 [ 1309.706843][T24504] ? stack_trace_save+0x9c/0xe0 [ 1309.706861][T24504] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1309.706883][T24504] ? stack_depot_save_flags+0x40/0x860 [ 1309.706909][T24504] ? __lock_acquire+0xab9/0xd20 [ 1309.706957][T24504] ? __lock_acquire+0xab9/0xd20 [ 1309.706990][T24504] ? netlink_deliver_tap+0x2e/0x1b0 [ 1309.707021][T24504] ? netlink_deliver_tap+0x2e/0x1b0 [ 1309.707054][T24504] netlink_unicast+0x82f/0x9e0 [ 1309.707086][T24504] ? __pfx_netlink_unicast+0x10/0x10 [ 1309.707111][T24504] ? netlink_sendmsg+0x642/0xb30 [ 1309.707133][T24504] ? skb_put+0x11b/0x210 [ 1309.707161][T24504] netlink_sendmsg+0x805/0xb30 [ 1309.707195][T24504] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1309.707222][T24504] ? rcu_is_watching+0x15/0xb0 [ 1309.707246][T24504] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1309.707270][T24504] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1309.707299][T24504] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1309.707326][T24504] __sock_sendmsg+0x21c/0x270 [ 1309.707352][T24504] ____sys_sendmsg+0x505/0x830 [ 1309.707376][T24504] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1309.707413][T24504] ? import_iovec+0x74/0xa0 [ 1309.707441][T24504] ___sys_sendmsg+0x21f/0x2a0 [ 1309.707461][T24504] ? __pfx____sys_sendmsg+0x10/0x10 [ 1309.707514][T24504] ? __fget_files+0x2a/0x420 [ 1309.707536][T24504] ? __fget_files+0x3a0/0x420 [ 1309.707568][T24504] __x64_sys_sendmsg+0x19b/0x260 [ 1309.707589][T24504] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1309.707618][T24504] ? __pfx_ksys_write+0x10/0x10 [ 1309.707642][T24504] ? do_syscall_64+0xbe/0xfa0 [ 1309.707664][T24504] do_syscall_64+0xfa/0xfa0 [ 1309.707682][T24504] ? lockdep_hardirqs_on+0x9c/0x150 [ 1309.707700][T24504] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1309.707718][T24504] ? clear_bhb_loop+0x60/0xb0 [ 1309.707741][T24504] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1309.707759][T24504] RIP: 0033:0x7f0138f8efc9 [ 1309.707776][T24504] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1309.707792][T24504] RSP: 002b:00007f0139e93038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1309.707813][T24504] RAX: ffffffffffffffda RBX: 00007f01391e5fa0 RCX: 00007f0138f8efc9 [ 1309.707826][T24504] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1309.707838][T24504] RBP: 00007f0139e93090 R08: 0000000000000000 R09: 0000000000000000 [ 1309.707850][T24504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1309.707861][T24504] R13: 00007f01391e6038 R14: 00007f01391e5fa0 R15: 00007f013930fa28 [ 1309.707893][T24504] [ 1310.448970][ T982] usb 5-1: USB disconnect, device number 39 [ 1310.706139][T24515] netlink: 596 bytes leftover after parsing attributes in process `syz.2.5274'. [ 1311.106764][T24529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5278'. [ 1311.313485][ T30] audit: type=1326 audit(1760766143.227:1546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24519 comm="syz.0.5276" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x0 [ 1311.550457][ T30] audit: type=1326 audit(1760766143.377:1547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24534 comm="syz.2.5280" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0138f8efc9 code=0x0 [ 1311.580102][T24542] usb usb1: usbfs: interface 0 claimed by hub while 'syz.3.5281' sets config #1 [ 1312.037307][T24550] netlink: 2 bytes leftover after parsing attributes in process `syz.5.5282'. [ 1313.451553][T24577] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5288'. [ 1313.468198][T24577] vlan2: entered promiscuous mode [ 1314.749914][T24601] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1314.779781][T24598] usb usb8: check_ctrlrecip: process 24598 (syz.3.5296) requesting ep 01 but needs 81 [ 1314.789991][T24598] usb usb8: usbfs: process 24598 (syz.3.5296) did not claim interface 0 before use [ 1315.096102][ T5921] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1315.166508][T24609] netlink: 'syz.5.5301': attribute type 6 has an invalid length. [ 1315.300271][ T5921] usb 3-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1315.309767][ T5921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1315.328126][ T5921] usb 3-1: Product: syz [ 1315.836050][ T5921] usb 3-1: Manufacturer: syz [ 1315.956161][ T5921] usb 3-1: SerialNumber: syz [ 1315.967998][ T5921] usb 3-1: config 0 descriptor?? [ 1316.181200][ T5921] usb 3-1: USB disconnect, device number 40 [ 1316.384994][T24623] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5306'. [ 1316.446256][T24623] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5306'. [ 1316.498619][T24623] bridge5: port 1(bond4) entered blocking state [ 1316.505146][T24623] bridge5: port 1(bond4) entered disabled state [ 1316.511950][T24623] bond4: entered allmulticast mode [ 1316.522841][T24623] bond4: entered promiscuous mode [ 1316.826258][T20588] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1316.978072][T20588] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1316.989360][T20588] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1316.999621][T20588] usb 4-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1317.305108][T20588] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1317.316628][T20588] usb 4-1: config 0 descriptor?? [ 1317.391697][T24642] xt_l2tp: v2 tid > 0xffff: 1114244 [ 1317.530691][T24627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1317.570111][T24627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1317.600371][T24627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1317.620606][T24627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1317.644742][T24627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1317.696298][T24627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1317.722216][T24627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1317.731681][T24649] sctp: [Deprecated]: syz.5.5314 (pid 24649) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1317.731681][T24649] Use struct sctp_sack_info instead [ 1317.757742][T24627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1317.816320][T24627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1317.845378][T24627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1318.283690][ T5897] usb 4-1: USB disconnect, device number 24 [ 1318.444705][T20587] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 1318.726449][T20587] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1318.840489][T20587] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1319.094878][T20587] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 1319.158574][ T30] audit: type=1326 audit(1760766151.077:1548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24680 comm="syz.3.5324" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x0 [ 1319.176077][T20587] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 1319.661353][T20587] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1319.679432][T20587] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1319.716661][T20587] usb 6-1: Product: syz [ 1319.755367][T20587] usb 6-1: Manufacturer: syz [ 1319.894755][T20587] usb 6-1: SerialNumber: syz [ 1319.921320][T24662] raw-gadget.6 gadget.5: fail, usb_ep_enable returned -22 [ 1319.948532][T20587] cdc_mbim 6-1:1.0: skipping garbage [ 1320.670249][T24662] raw-gadget.6 gadget.5: fail, usb_ep_enable returned -22 [ 1320.678009][T24662] raw-gadget.6 gadget.5: fail, usb_ep_enable returned -22 [ 1320.889518][T24662] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1320.906556][T24662] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1320.933054][T20587] cdc_mbim 6-1:1.0: bind() failure [ 1320.963735][T24695] FAULT_INJECTION: forcing a failure. [ 1320.963735][T24695] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1320.973972][T20587] cdc_ncm 6-1:1.1: probe with driver cdc_ncm failed with error -71 [ 1320.977196][T24695] CPU: 0 UID: 0 PID: 24695 Comm: syz.3.5326 Not tainted syzkaller #0 PREEMPT(full) [ 1320.977220][T24695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1320.977231][T24695] Call Trace: [ 1320.977240][T24695] [ 1320.977248][T24695] dump_stack_lvl+0x189/0x250 [ 1320.977273][T24695] ? __pfx____ratelimit+0x10/0x10 [ 1320.977299][T24695] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1320.977318][T24695] ? __pfx__printk+0x10/0x10 [ 1320.977337][T24695] ? __might_fault+0xb0/0x130 [ 1320.977367][T24695] should_fail_ex+0x414/0x560 [ 1320.977398][T24695] _copy_from_user+0x2d/0xb0 [ 1320.977421][T24695] input_event_from_user+0xb2/0x280 [ 1320.977444][T24695] ? __pfx_input_event_from_user+0x10/0x10 [ 1320.977471][T24695] ? input_inject_event+0xb6/0x340 [ 1320.977498][T24695] evdev_write+0x2a6/0x480 [ 1320.977524][T24695] ? __pfx_evdev_write+0x10/0x10 [ 1320.977546][T24695] ? bpf_lsm_file_permission+0x9/0x20 [ 1320.977569][T24695] ? security_file_permission+0x75/0x290 [ 1320.977594][T24695] ? rw_verify_area+0x255/0x4d0 [ 1320.977612][T24695] ? __lock_acquire+0xab9/0xd20 [ 1320.977632][T24695] ? __pfx_evdev_write+0x10/0x10 [ 1320.977653][T24695] vfs_write+0x27e/0xb30 [ 1320.977680][T24695] ? __pfx_vfs_write+0x10/0x10 [ 1320.977700][T24695] ? __fget_files+0x2a/0x420 [ 1320.977725][T24695] ? __fget_files+0x2a/0x420 [ 1320.977744][T24695] ? __fget_files+0x3a0/0x420 [ 1320.977763][T24695] ? __fget_files+0x2a/0x420 [ 1320.977792][T24695] ksys_write+0x145/0x250 [ 1320.977813][T24695] ? __pfx_ksys_write+0x10/0x10 [ 1320.977836][T24695] ? do_syscall_64+0xbe/0xfa0 [ 1320.977858][T24695] do_syscall_64+0xfa/0xfa0 [ 1320.977874][T24695] ? lockdep_hardirqs_on+0x9c/0x150 [ 1320.977891][T24695] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1320.977909][T24695] ? clear_bhb_loop+0x60/0xb0 [ 1320.977930][T24695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1320.977947][T24695] RIP: 0033:0x7f3e9a98efc9 [ 1320.977964][T24695] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1320.977981][T24695] RSP: 002b:00007f3e98bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1320.978000][T24695] RAX: ffffffffffffffda RBX: 00007f3e9abe5fa0 RCX: 00007f3e9a98efc9 [ 1320.978014][T24695] RDX: 0000000000000918 RSI: 0000200000000040 RDI: 000000000000000a [ 1320.978026][T24695] RBP: 00007f3e98bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1320.978037][T24695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1320.978048][T24695] R13: 00007f3e9abe6038 R14: 00007f3e9abe5fa0 R15: 00007f3e9ad0fa28 [ 1320.978079][T24695] [ 1321.427111][T24699] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5327'. [ 1321.438975][T20587] cdc_mbim 6-1:1.1: probe with driver cdc_mbim failed with error -71 [ 1321.527660][T20587] usbtest 6-1:1.1: probe with driver usbtest failed with error -71 [ 1321.582505][T24704] tipc: Enabling of bearer rejected, already enabled [ 1321.591789][T20587] usb 6-1: USB disconnect, device number 20 [ 1322.160727][T24725] FAULT_INJECTION: forcing a failure. [ 1322.160727][T24725] name failslab, interval 1, probability 0, space 0, times 0 [ 1322.210169][T24725] CPU: 1 UID: 0 PID: 24725 Comm: syz.3.5336 Not tainted syzkaller #0 PREEMPT(full) [ 1322.210200][T24725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1322.210212][T24725] Call Trace: [ 1322.210220][T24725] [ 1322.210229][T24725] dump_stack_lvl+0x189/0x250 [ 1322.210254][T24725] ? __pfx____ratelimit+0x10/0x10 [ 1322.210282][T24725] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1322.210301][T24725] ? __pfx__printk+0x10/0x10 [ 1322.210317][T24725] ? netlink_sendmsg+0x805/0xb30 [ 1322.210343][T24725] ? __x64_sys_sendmsg+0x19b/0x260 [ 1322.210359][T24725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1322.210384][T24725] should_fail_ex+0x414/0x560 [ 1322.210417][T24725] should_failslab+0xa8/0x100 [ 1322.210441][T24725] kmem_cache_alloc_noprof+0x74/0x6e0 [ 1322.210461][T24725] ? skb_clone+0x212/0x3a0 [ 1322.210485][T24725] skb_clone+0x212/0x3a0 [ 1322.210507][T24725] __netlink_deliver_tap+0x404/0x850 [ 1322.210544][T24725] ? netlink_deliver_tap+0x2e/0x1b0 [ 1322.210570][T24725] netlink_deliver_tap+0x19c/0x1b0 [ 1322.210596][T24725] netlink_sendskb+0x68/0x140 [ 1322.210621][T24725] netlink_unicast+0x397/0x9e0 [ 1322.210642][T24725] ? __asan_memcpy+0x40/0x70 [ 1322.210667][T24725] ? __pfx_netlink_unicast+0x10/0x10 [ 1322.210700][T24725] netlink_rcv_skb+0x28c/0x470 [ 1322.210723][T24725] ? lockdep_hardirqs_on+0x9c/0x150 [ 1322.210747][T24725] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1322.210772][T24725] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1322.210808][T24725] ? bpf_lsm_capable+0x9/0x20 [ 1322.210825][T24725] ? security_capable+0x7e/0x2e0 [ 1322.210851][T24725] nfnetlink_rcv+0x282/0x2590 [ 1322.210876][T24725] ? __dev_queue_xmit+0x27b/0x3b50 [ 1322.210898][T24725] ? __dev_queue_xmit+0x1d79/0x3b50 [ 1322.210915][T24725] ? kasan_save_track+0x3e/0x80 [ 1322.210932][T24725] ? __kasan_slab_alloc+0x6c/0x80 [ 1322.210961][T24725] ? __dev_queue_xmit+0x27b/0x3b50 [ 1322.210993][T24725] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1322.211014][T24725] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1322.211055][T24725] ? ref_tracker_free+0x63a/0x7d0 [ 1322.211076][T24725] ? __asan_memcpy+0x40/0x70 [ 1322.211093][T24725] ? __pfx_ref_tracker_free+0x10/0x10 [ 1322.211110][T24725] ? __skb_clone+0x63/0x7a0 [ 1322.211133][T24725] ? __skb_clone+0x483/0x7a0 [ 1322.211158][T24725] ? skb_clone+0x246/0x3a0 [ 1322.211179][T24725] ? __netlink_deliver_tap+0x807/0x850 [ 1322.211203][T24725] ? netlink_deliver_tap+0x2e/0x1b0 [ 1322.211234][T24725] ? netlink_deliver_tap+0x2e/0x1b0 [ 1322.211266][T24725] netlink_unicast+0x82f/0x9e0 [ 1322.211297][T24725] ? __pfx_netlink_unicast+0x10/0x10 [ 1322.211321][T24725] ? netlink_sendmsg+0x642/0xb30 [ 1322.211344][T24725] ? skb_put+0x11b/0x210 [ 1322.211371][T24725] netlink_sendmsg+0x805/0xb30 [ 1322.211406][T24725] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1322.211434][T24725] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1322.211457][T24725] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1322.211479][T24725] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1322.211505][T24725] __sock_sendmsg+0x21c/0x270 [ 1322.211531][T24725] ____sys_sendmsg+0x505/0x830 [ 1322.211554][T24725] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1322.211595][T24725] ? import_iovec+0x74/0xa0 [ 1322.211622][T24725] ___sys_sendmsg+0x21f/0x2a0 [ 1322.211643][T24725] ? __pfx____sys_sendmsg+0x10/0x10 [ 1322.211697][T24725] ? __fget_files+0x2a/0x420 [ 1322.211717][T24725] ? __fget_files+0x3a0/0x420 [ 1322.211749][T24725] __x64_sys_sendmsg+0x19b/0x260 [ 1322.211770][T24725] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1322.211798][T24725] ? __pfx_ksys_write+0x10/0x10 [ 1322.211822][T24725] ? do_syscall_64+0xbe/0xfa0 [ 1322.211848][T24725] do_syscall_64+0xfa/0xfa0 [ 1322.211866][T24725] ? lockdep_hardirqs_on+0x9c/0x150 [ 1322.211888][T24725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1322.211905][T24725] ? clear_bhb_loop+0x60/0xb0 [ 1322.211927][T24725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1322.211946][T24725] RIP: 0033:0x7f3e9a98efc9 [ 1322.211964][T24725] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1322.211979][T24725] RSP: 002b:00007f3e98bf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1322.212001][T24725] RAX: ffffffffffffffda RBX: 00007f3e9abe5fa0 RCX: 00007f3e9a98efc9 [ 1322.212014][T24725] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1322.212026][T24725] RBP: 00007f3e98bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1322.212045][T24725] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1322.212056][T24725] R13: 00007f3e9abe6038 R14: 00007f3e9abe5fa0 R15: 00007f3e9ad0fa28 [ 1322.212087][T24725] [ 1322.220737][T24729] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5335'. [ 1323.344608][T24737] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5338'. [ 1323.496150][ T5921] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1323.942982][ T5921] usb 6-1: Using ep0 maxpacket: 8 [ 1323.963832][ T5921] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1323.995124][ T5921] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1324.004700][T24740] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5340'. [ 1324.016283][ T5921] usb 6-1: can't read configurations, error -61 [ 1324.116582][T24740] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5340'. [ 1324.146096][ T5921] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1324.238956][T24740] bridge5: port 1(bond5) entered blocking state [ 1324.255542][T24740] bridge5: port 1(bond5) entered disabled state [ 1324.283881][T24740] bond5: entered allmulticast mode [ 1324.300806][T24740] bond5: entered promiscuous mode [ 1324.316109][ T5921] usb 6-1: Using ep0 maxpacket: 8 [ 1324.323586][ T5921] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1324.333300][ T5921] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1324.341082][ T5921] usb 6-1: can't read configurations, error -61 [ 1324.348056][ T5921] usb usb6-port1: attempt power cycle [ 1324.409351][T24746] netlink: 'syz.4.5341': attribute type 6 has an invalid length. [ 1324.427315][T24746] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1324.700766][T24755] netlink: 'syz.3.5342': attribute type 6 has an invalid length. [ 1324.718690][T24755] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1324.727124][ T5921] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1324.806435][ T5921] usb 6-1: Using ep0 maxpacket: 8 [ 1324.823207][ T5921] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1324.840394][ T5921] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1324.848139][ T5921] usb 6-1: can't read configurations, error -61 [ 1324.986147][ T5921] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1325.017106][ T5921] usb 6-1: Using ep0 maxpacket: 8 [ 1325.024881][ T5921] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1325.072486][ T5921] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1325.082596][ T5921] usb 6-1: can't read configurations, error -61 [ 1325.096753][ T5921] usb usb6-port1: unable to enumerate USB device [ 1326.266120][T20587] usb 3-1: new full-speed USB device number 41 using dummy_hcd [ 1326.275719][T24766] tipc: Enabling of bearer rejected, already enabled [ 1326.338272][T24768] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5347'. [ 1326.437731][T20587] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1326.469707][T20587] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 384, setting to 64 [ 1326.510059][T20587] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1326.543591][T20587] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1326.566115][T20587] usb 3-1: Product: syz [ 1326.570661][T20587] usb 3-1: Manufacturer: syz [ 1326.575566][T20587] usb 3-1: SerialNumber: syz [ 1326.584662][T20587] usb 3-1: config 0 descriptor?? [ 1326.590825][T24764] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1326.645691][T24783] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5351'. [ 1326.708766][T24783] vlan3: entered promiscuous mode [ 1326.756434][T20587] rc_core: IR keymap rc-streamzap not found [ 1326.763606][T20587] Registered IR keymap rc-empty [ 1326.773342][T20587] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1326.791765][T20587] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input48 [ 1326.827059][T20587] usb 3-1: USB disconnect, device number 41 [ 1327.526994][T24795] FAULT_INJECTION: forcing a failure. [ 1327.526994][T24795] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1327.582607][T24795] CPU: 0 UID: 0 PID: 24795 Comm: syz.3.5356 Not tainted syzkaller #0 PREEMPT(full) [ 1327.582641][T24795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1327.582652][T24795] Call Trace: [ 1327.582660][T24795] [ 1327.582669][T24795] dump_stack_lvl+0x189/0x250 [ 1327.582694][T24795] ? __pfx____ratelimit+0x10/0x10 [ 1327.582717][T24795] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1327.582735][T24795] ? __pfx__printk+0x10/0x10 [ 1327.582753][T24795] ? __might_fault+0xb0/0x130 [ 1327.582781][T24795] should_fail_ex+0x414/0x560 [ 1327.582812][T24795] _copy_from_user+0x2d/0xb0 [ 1327.582836][T24795] input_event_from_user+0xb2/0x280 [ 1327.582859][T24795] ? __pfx_input_event_from_user+0x10/0x10 [ 1327.582885][T24795] ? input_inject_event+0xb6/0x340 [ 1327.582911][T24795] evdev_write+0x2a6/0x480 [ 1327.582937][T24795] ? __pfx_evdev_write+0x10/0x10 [ 1327.582959][T24795] ? bpf_lsm_file_permission+0x9/0x20 [ 1327.582982][T24795] ? security_file_permission+0x75/0x290 [ 1327.583007][T24795] ? rw_verify_area+0x255/0x4d0 [ 1327.583024][T24795] ? __lock_acquire+0xab9/0xd20 [ 1327.583044][T24795] ? __pfx_evdev_write+0x10/0x10 [ 1327.583065][T24795] vfs_write+0x27e/0xb30 [ 1327.583097][T24795] ? __pfx_vfs_write+0x10/0x10 [ 1327.583119][T24795] ? __fget_files+0x2a/0x420 [ 1327.583142][T24795] ? __fget_files+0x2a/0x420 [ 1327.583161][T24795] ? __fget_files+0x3a0/0x420 [ 1327.583180][T24795] ? __fget_files+0x2a/0x420 [ 1327.583208][T24795] ksys_write+0x145/0x250 [ 1327.583231][T24795] ? __pfx_ksys_write+0x10/0x10 [ 1327.583253][T24795] ? do_syscall_64+0xbe/0xfa0 [ 1327.583274][T24795] do_syscall_64+0xfa/0xfa0 [ 1327.583292][T24795] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1327.583308][T24795] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1327.583326][T24795] ? clear_bhb_loop+0x60/0xb0 [ 1327.583347][T24795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1327.583365][T24795] RIP: 0033:0x7f3e9a98efc9 [ 1327.583382][T24795] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1327.583397][T24795] RSP: 002b:00007f3e98bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1327.583417][T24795] RAX: ffffffffffffffda RBX: 00007f3e9abe5fa0 RCX: 00007f3e9a98efc9 [ 1327.583431][T24795] RDX: 0000000000000918 RSI: 0000200000000040 RDI: 000000000000000a [ 1327.583443][T24795] RBP: 00007f3e98bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1327.583455][T24795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1327.583466][T24795] R13: 00007f3e9abe6038 R14: 00007f3e9abe5fa0 R15: 00007f3e9ad0fa28 [ 1327.583496][T24795] [ 1328.320623][T24816] netlink: 'syz.3.5360': attribute type 6 has an invalid length. [ 1328.332316][T24816] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1328.481454][T24818] netlink: 596 bytes leftover after parsing attributes in process `syz.2.5362'. [ 1328.750604][T24827] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5364'. [ 1330.102620][T24835] tipc: Enabling of bearer rejected, already enabled [ 1330.298603][T24845] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5370'. [ 1330.485039][T24847] fuse: Bad value for 'fd' [ 1330.833412][T24863] netlink: 'syz.3.5372': attribute type 6 has an invalid length. [ 1330.911903][T24863] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1331.546099][T20587] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1331.695919][T24873] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1331.746072][T20587] usb 3-1: Using ep0 maxpacket: 32 [ 1331.755427][T20587] usb 3-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 1331.768489][T20587] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1331.786975][T20587] usb 3-1: Product: syz [ 1331.815111][T20587] usb 3-1: Manufacturer: syz [ 1331.912161][T20587] usb 3-1: SerialNumber: syz [ 1332.003341][T20587] usb 3-1: config 0 descriptor?? [ 1332.660131][T24881] syzkaller0: entered promiscuous mode [ 1332.690730][T24881] syzkaller0: entered allmulticast mode [ 1332.722190][T20587] peak_usb 3-1:0.0 can0: unable to request usb[type=2 value=5] err=-71 [ 1332.887463][T24885] tipc: Bearer : already 2 bearers with priority 10 [ 1332.895503][T24885] tipc: Bearer : trying with adjusted priority [ 1332.963259][T24885] tipc: Enabled bearer , priority 9 [ 1333.356615][T24879] tipc: Resetting bearer [ 1333.396512][T20587] peak_usb 3-1:0.0: probe with driver peak_usb failed with error -71 [ 1333.441361][T24879] tipc: Disabling bearer [ 1333.448910][T20587] usb 3-1: USB disconnect, device number 42 [ 1333.743452][T24909] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5388'. [ 1333.898761][T24917] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5392'. [ 1333.996028][T20587] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 1334.018479][T24919] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3354154791 (6708309582 ns) > initial count (4455734788 ns). Using initial count to start timer. [ 1334.157811][T20587] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1334.168357][T20587] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1334.184419][T24921] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5394'. [ 1334.189747][T20587] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1334.202849][T20587] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1334.211512][T20587] usb 1-1: Product: syz [ 1334.215691][T20587] usb 1-1: Manufacturer: syz [ 1334.220345][T20587] usb 1-1: SerialNumber: syz [ 1334.234471][T20587] cdc_ncm 1-1:1.0: skipping garbage [ 1334.276092][T20582] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 1334.528052][T20582] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 1334.546061][T20582] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 1334.576507][T20582] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1334.596622][T20582] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1334.632250][T20582] usb 3-1: config 0 descriptor?? [ 1334.658417][T20582] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1335.770502][T20587] cdc_ncm 1-1:1.0: bind() failure [ 1335.783824][T20587] usbtest 1-1:1.1: probe with driver usbtest failed with error -71 [ 1335.799489][T20587] usb 1-1: USB disconnect, device number 60 [ 1336.048203][T24950] netlink: 596 bytes leftover after parsing attributes in process `syz.4.5402'. [ 1336.136200][ T982] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1336.230991][T24955] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1336.317397][T24961] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5404'. [ 1336.385604][ T982] usb 4-1: config 0 has no interfaces? [ 1336.476974][ T982] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1336.486836][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1336.494935][ T982] usb 4-1: Product: syz [ 1336.521397][ T982] usb 4-1: Manufacturer: syz [ 1336.529438][T24964] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5405'. [ 1336.532337][ T982] usb 4-1: SerialNumber: syz [ 1336.649649][ T982] usb 4-1: config 0 descriptor?? [ 1336.976319][ T982] usb 3-1: USB disconnect, device number 43 [ 1337.066171][T24969] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5399'. [ 1337.114600][T24969] vlan3: entered promiscuous mode [ 1337.164476][T24973] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1337.446487][T20588] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 1337.616299][T20588] usb 3-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1337.628070][T20588] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1337.639907][T20588] usb 3-1: Product: syz [ 1337.651344][T20588] usb 3-1: Manufacturer: syz [ 1337.682752][T20588] usb 3-1: SerialNumber: syz [ 1337.691891][T20588] usb 3-1: config 0 descriptor?? [ 1337.707646][T24983] tipc: Enabling of bearer rejected, already enabled [ 1337.881320][T20582] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1337.933590][ T5921] usb 3-1: USB disconnect, device number 44 [ 1338.026039][T20582] usb 6-1: device descriptor read/64, error -71 [ 1338.123957][T24987] netlink: 2 bytes leftover after parsing attributes in process `syz.4.5412'. [ 1338.286103][T20582] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1338.416188][T20582] usb 6-1: device descriptor read/64, error -71 [ 1338.528687][T20582] usb usb6-port1: attempt power cycle [ 1338.621945][T24991] program syz.2.5413 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1338.876320][T20582] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1338.910383][ T5897] usb 4-1: USB disconnect, device number 25 [ 1338.917877][T20582] usb 6-1: device descriptor read/8, error -71 [ 1338.998037][T24999] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1339.176196][T20582] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1339.200992][ T30] audit: type=1326 audit(1760766171.117:1549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24997 comm="syz.3.5416" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x0 [ 1339.228800][T20582] usb 6-1: device descriptor read/8, error -71 [ 1339.347003][T20582] usb usb6-port1: unable to enumerate USB device [ 1339.560090][T25007] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5417'. [ 1339.594688][T25007] vlan0: entered promiscuous mode [ 1339.654976][T25009] gretap0: entered promiscuous mode [ 1339.678529][T25009] gretap0: left promiscuous mode [ 1340.588398][ T30] audit: type=1326 audit(1760766172.507:1550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1340.693915][ T30] audit: type=1326 audit(1760766172.507:1551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1340.839744][ T30] audit: type=1326 audit(1760766172.507:1552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1340.878832][ T30] audit: type=1326 audit(1760766172.507:1553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1340.909504][T25038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5428'. [ 1340.918926][ T30] audit: type=1326 audit(1760766172.507:1554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1340.946091][ T30] audit: type=1326 audit(1760766172.507:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1341.276437][ T30] audit: type=1326 audit(1760766172.517:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1341.321998][ T30] audit: type=1326 audit(1760766172.517:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1341.362264][ T30] audit: type=1326 audit(1760766172.517:1558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25032 comm="syz.0.5427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1342.564274][T25058] syzkaller0: entered promiscuous mode [ 1342.569984][T25058] syzkaller0: entered allmulticast mode [ 1342.690152][T25058] tipc: Enabled bearer , priority 10 [ 1342.698655][T25057] tipc: Resetting bearer [ 1342.838166][T25057] tipc: Disabling bearer [ 1342.858214][T25067] netlink: 'syz.5.5435': attribute type 6 has an invalid length. [ 1342.903152][T25067] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1343.195444][T25075] netlink: 2 bytes leftover after parsing attributes in process `syz.3.5437'. [ 1344.509455][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 1344.509476][ T30] audit: type=1326 audit(1760766176.407:1567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1344.665218][ T30] audit: type=1326 audit(1760766176.407:1568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1344.768648][ T30] audit: type=1326 audit(1760766176.407:1569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1344.823577][ T30] audit: type=1326 audit(1760766176.407:1570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1344.973518][ T30] audit: type=1326 audit(1760766176.407:1571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1345.113263][ T30] audit: type=1326 audit(1760766176.407:1572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1345.166071][ T30] audit: type=1326 audit(1760766176.407:1573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1345.246561][ T30] audit: type=1326 audit(1760766176.407:1574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1345.356417][ T30] audit: type=1326 audit(1760766176.407:1575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1345.456078][ T30] audit: type=1326 audit(1760766176.407:1576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25086 comm="syz.5.5441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1345.489787][T25102] netlink: 'syz.5.5443': attribute type 6 has an invalid length. [ 1345.505554][T25102] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1345.601079][T25106] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5445'. [ 1345.634498][T25104] tipc: Enabled bearer , priority 10 [ 1345.876817][T20582] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1345.891463][T25113] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5447'. [ 1345.906562][T25113] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1346.083107][T20582] usb 4-1: Using ep0 maxpacket: 16 [ 1346.096585][T20582] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x92, changing to 0x82 [ 1346.118302][T20582] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1346.176089][ T5921] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 1346.258170][T20582] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1346.272174][T20582] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.280505][T20582] usb 4-1: Product: syz [ 1346.308290][T20582] usb 4-1: Manufacturer: syz [ 1346.321819][T20582] usb 4-1: SerialNumber: syz [ 1346.339127][T20582] usb 4-1: config 0 descriptor?? [ 1346.386171][T20582] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1346.433103][ T5921] usb 1-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 1346.466012][T20582] em28xx 4-1:0.0: Video interface 0 found: [ 1346.487484][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.529572][ T5921] usb 1-1: Product: syz [ 1346.542762][ T5921] usb 1-1: Manufacturer: syz [ 1346.582973][ T5921] usb 1-1: SerialNumber: syz [ 1346.607585][T20582] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1346.614996][ T5921] usb 1-1: config 0 descriptor?? [ 1346.626191][T17275] tipc: Node number set to 2765072203 [ 1346.637025][ T5921] i2c-tiny-usb 1-1:0.0: version 6d.cc found at bus 001 address 061 [ 1346.680330][T20582] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1346.688423][T20582] em28xx 4-1:0.0: board has no eeprom [ 1346.777583][T20582] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1346.803834][T20582] em28xx 4-1:0.0: Currently, V4L2 is not supported on this model [ 1346.817068][T20584] em28xx 4-1:0.0: Binding DVB extension [ 1346.823501][T20584] em28xx 4-1:0.0: no endpoint for DVB mode and transfer type 0 [ 1346.839783][T20582] usb 4-1: USB disconnect, device number 26 [ 1346.852172][T20582] em28xx 4-1:0.0: Disconnecting em28xx [ 1346.860135][T20584] em28xx 4-1:0.0: failed to pre-allocate USB transfer buffers for DVB. [ 1346.881435][T20584] em28xx 4-1:0.0: Registering input extension [ 1346.911623][T25124] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1346.922922][T20582] em28xx 4-1:0.0: Closing input extension [ 1346.950053][T20582] em28xx 4-1:0.0: Freeing device [ 1347.236033][T17275] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1347.408832][T17275] usb 6-1: config 0 has no interfaces? [ 1347.417212][T17275] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1347.445994][T17275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1347.470248][T17275] usb 6-1: Product: syz [ 1347.479037][T17275] usb 6-1: Manufacturer: syz [ 1347.504672][T17275] usb 6-1: SerialNumber: syz [ 1347.522838][T17275] usb 6-1: config 0 descriptor?? [ 1347.682471][T25136] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5455'. [ 1347.729013][ T5921] i2c i2c-4: failure reading functionality [ 1347.738031][ T5921] i2c i2c-4: connected i2c-tiny-usb device [ 1347.763663][ T5921] usb 1-1: USB disconnect, device number 61 [ 1347.843623][T25137] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5452'. [ 1347.888384][T25137] vlan3: entered promiscuous mode [ 1347.893523][T25137] batadv0: entered promiscuous mode [ 1348.007419][T25141] netlink: 2 bytes leftover after parsing attributes in process `syz.4.5456'. [ 1349.134368][T25159] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5461'. [ 1349.426572][ T5897] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 1349.793055][ T5897] usb 1-1: config 0 has no interfaces? [ 1349.846225][ T5921] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 1349.866209][ T5897] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1349.885559][ T5897] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1349.905976][ T5897] usb 1-1: Product: syz [ 1349.920196][ T5897] usb 1-1: Manufacturer: syz [ 1349.940561][T20584] usb 6-1: USB disconnect, device number 29 [ 1349.987787][ T5897] usb 1-1: SerialNumber: syz [ 1349.997829][ T5921] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1350.018909][ T5921] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1350.042528][ T5897] usb 1-1: config 0 descriptor?? [ 1350.050763][ T5921] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1350.067458][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1350.082797][ T5921] usb 5-1: Product: syz [ 1350.096131][ T5921] usb 5-1: Manufacturer: syz [ 1350.106638][ T5921] usb 5-1: SerialNumber: syz [ 1350.124325][ T5921] usb 5-1: config 0 descriptor?? [ 1350.152312][ T5921] usb 5-1: selecting invalid altsetting 0 [ 1350.494018][T25176] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1350.556933][T25160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1350.566594][T25160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1350.736853][T20588] usb 5-1: USB disconnect, device number 40 [ 1350.807367][T25179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1351.011970][T25179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1351.852636][T25189] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5471'. [ 1352.445664][ T5921] usb 1-1: USB disconnect, device number 62 [ 1353.766141][T20588] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1353.957709][T20588] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1353.976485][T20588] usb 4-1: config 1 interface 0 has no altsetting 1 [ 1353.988341][T20588] usb 4-1: New USB device found, idVendor=0536, idProduct=a4a8, bcdDevice= 0.40 [ 1353.999149][T20588] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1354.021636][T20588] usb 4-1: Product: syz [ 1354.026297][T20588] usb 4-1: Manufacturer: syz [ 1354.030912][T20588] usb 4-1: SerialNumber: syz [ 1354.251786][T25209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1354.262033][T25209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1354.272087][T20588] usb 4-1: USB disconnect, device number 27 [ 1361.662700][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.669150][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.101416][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.107955][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1429.157148][T25221] netlink: 'syz.5.5479': attribute type 10 has an invalid length. [ 1429.181135][T25221] team0: Device netdevsim0 failed to register rx_handler [ 1429.247095][T25222] C: renamed from team_slave_0 (while UP) [ 1429.260125][T25221] netlink: 'syz.5.5479': attribute type 10 has an invalid length. [ 1429.301732][T25222] netlink: 'syz.4.5482': attribute type 1 has an invalid length. [ 1429.309233][T25230] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5483'. [ 1429.321048][T25222] netlink: 152 bytes leftover after parsing attributes in process `syz.4.5482'. [ 1429.330494][T25222] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1429.353705][T25230] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5483'. [ 1429.496732][ T982] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1429.534628][T25232] bridge6: port 1(bond6) entered blocking state [ 1429.550168][T25232] bridge6: port 1(bond6) entered disabled state [ 1429.578371][T25232] bond6: entered allmulticast mode [ 1429.656039][ T982] usb 4-1: Using ep0 maxpacket: 32 [ 1429.657387][T25232] bond6: entered promiscuous mode [ 1429.670469][ T982] usb 4-1: config index 0 descriptor too short (expected 7707, got 27) [ 1429.685764][ T982] usb 4-1: config 0 has too many interfaces: 42, using maximum allowed: 32 [ 1429.716929][ T982] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1429.750649][ T982] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 42 [ 1429.794213][ T982] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1429.838529][ T982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1429.873646][ T982] usb 4-1: Product: syz [ 1429.886274][ T982] usb 4-1: Manufacturer: syz [ 1429.900593][ T982] usb 4-1: SerialNumber: syz [ 1430.095905][T25247] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5488'. [ 1430.160938][ T982] usb 4-1: config 0 descriptor?? [ 1430.241489][T25249] ptrace attach of "./syz-executor exec"[22202] was attempted by "./syz-executor exec"[25249] [ 1430.255450][T25246] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1431.409517][T25262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1431.423377][T25262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1431.468256][T25262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1431.481449][T25262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1431.495291][T25262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1431.508812][T25262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1431.523454][T25262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1431.535356][T25262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1431.550848][T25262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1431.580729][T25262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1431.636050][T20582] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 1431.786321][T20582] usb 1-1: Using ep0 maxpacket: 8 [ 1432.068641][T25280] fuse: Bad value for 'fd' [ 1432.083712][ T982] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 1432.139164][T25280] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5496'. [ 1432.149269][T25280] bridge0: port 2(bridge_slave_1) entered disabled state [ 1432.156693][T25280] bridge0: port 1(bridge_slave_0) entered disabled state [ 1432.266374][ T982] usb 3-1: Using ep0 maxpacket: 16 [ 1432.277982][ T982] usb 3-1: config 0 has no interfaces? [ 1432.289342][ T982] usb 3-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice= 0.88 [ 1432.312621][ T982] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1432.374879][T20587] usb 4-1: USB disconnect, device number 28 [ 1432.504414][ T982] usb 3-1: Product: syz [ 1432.555096][T25285] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5498'. [ 1432.568241][T25285] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5498'. [ 1432.577815][ T982] usb 3-1: SerialNumber: syz [ 1432.627850][ T982] usb 3-1: config 0 descriptor?? [ 1432.876924][T25285] bridge1: port 1(bond1) entered blocking state [ 1432.883578][T25285] bridge1: port 1(bond1) entered disabled state [ 1432.905243][T25285] bond1: entered allmulticast mode [ 1432.976314][T25285] bond1: entered promiscuous mode [ 1433.208964][T25275] wireguard0: entered promiscuous mode [ 1433.214800][T25275] wireguard0: entered allmulticast mode [ 1433.577432][T25297] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5500'. [ 1434.416183][T20582] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1434.426442][T20582] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1434.437935][T20582] usb 1-1: can't read configurations, error -71 [ 1435.037638][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 1435.037654][ T30] audit: type=1326 audit(1760766266.907:1608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25302 comm="syz.0.5502" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x0 [ 1435.848076][T25313] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5503'. [ 1435.891855][T20588] usb 3-1: USB disconnect, device number 45 [ 1436.337393][T25320] fuse: Bad value for 'fd' [ 1436.342596][T25320] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5506'. [ 1436.353726][T25320] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5506'. [ 1436.410083][T25322] netlink: 596 bytes leftover after parsing attributes in process `syz.5.5507'. [ 1437.207240][T25336] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5510'. [ 1438.124374][T25357] fuse: Unexpected value for 'default_permissions' [ 1438.757296][T20582] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 1438.916125][T20582] usb 5-1: Using ep0 maxpacket: 16 [ 1438.924806][T20582] usb 5-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1438.935233][T20582] usb 5-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 1438.946420][T20582] usb 5-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1439.154777][T20582] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1439.255665][T20582] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1439.265354][T20582] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1439.284316][T20582] usb 5-1: Product: syz [ 1439.291224][T20582] usb 5-1: Manufacturer: syz [ 1439.295848][T20582] usb 5-1: SerialNumber: syz [ 1439.539153][T20582] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 41 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 1439.732643][T25378] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5525'. [ 1439.776850][T25378] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5525'. [ 1439.833291][T25379] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1439.842185][T25379] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1439.859578][T20582] usb 5-1: USB disconnect, device number 41 [ 1439.999476][T25383] bridge4: port 1(bond5) entered blocking state [ 1440.036307][T25383] bridge4: port 1(bond5) entered disabled state [ 1440.057945][T25383] bond5: entered allmulticast mode [ 1440.064129][T25362] usblp0: removed [ 1440.102218][T25383] bond5: entered promiscuous mode [ 1440.418402][T20582] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 1440.845607][T20582] usb 1-1: config 0 has no interfaces? [ 1440.882369][T20582] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1440.894714][T20582] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1440.909008][T20582] usb 1-1: Product: syz [ 1440.920931][T20582] usb 1-1: Manufacturer: syz [ 1440.959948][T20582] usb 1-1: SerialNumber: syz [ 1440.984421][T20582] usb 1-1: config 0 descriptor?? [ 1440.986509][T25416] IPv6: addrconf: prefix option has invalid lifetime [ 1441.265907][T25389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1441.275728][T25389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1441.365356][T25419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1441.374208][T25419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1443.017775][ T982] usb 1-1: USB disconnect, device number 65 [ 1443.297652][T25436] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1445.329245][T25458] fuse: Bad value for 'fd' [ 1445.403486][T25458] ip6erspan0: entered promiscuous mode [ 1445.456351][T25459] IPv6: addrconf: prefix option has invalid lifetime [ 1447.026217][T20588] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 1447.211051][ T30] audit: type=1326 audit(1760766279.027:1609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25471 comm="syz.5.5550" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x0 [ 1447.266123][T20588] usb 1-1: Using ep0 maxpacket: 8 [ 1447.316115][T20588] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1447.328843][T20588] usb 1-1: can't read configurations, error -61 [ 1447.573256][T20588] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 1447.796637][T20588] usb 1-1: Using ep0 maxpacket: 8 [ 1447.811811][T20588] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1447.824990][T20588] usb 1-1: can't read configurations, error -61 [ 1447.840725][T20588] usb usb1-port1: attempt power cycle [ 1447.856334][T17275] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 1448.027046][T17275] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1448.040852][T17275] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1448.065546][T17275] usb 5-1: config 1 interface 1 altsetting 17 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1448.158698][T17275] usb 5-1: config 1 interface 1 has no altsetting 1 [ 1448.178286][T17275] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1448.206056][T17275] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1448.216517][T20588] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 1448.243654][T17275] usb 5-1: Product: syz [ 1448.284331][T20588] usb 1-1: Using ep0 maxpacket: 8 [ 1448.291941][T17275] usb 5-1: Manufacturer: syz [ 1448.300712][T17275] usb 5-1: SerialNumber: syz [ 1448.306917][T20588] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1448.343390][T20588] usb 1-1: can't read configurations, error -61 [ 1448.352286][T17275] usb 5-1: selecting invalid altsetting 1 [ 1448.516078][T20588] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 1448.537341][T20588] usb 1-1: Using ep0 maxpacket: 8 [ 1448.543325][T25481] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1448.545158][T20588] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 1448.559769][T25481] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1448.583344][T20588] usb 1-1: can't read configurations, error -61 [ 1448.612633][T25488] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1448.626426][T20588] usb usb1-port1: unable to enumerate USB device [ 1448.666497][T25488] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1448.714662][T17275] cdc_ncm 5-1:1.0: bind() failure [ 1448.762759][T17275] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 1448.783800][T17275] cdc_ncm 5-1:1.1: bind() failure [ 1448.806309][T25493] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5556'. [ 1448.826846][T17275] usb 5-1: USB disconnect, device number 42 [ 1449.153538][T25506] syzkaller0: entered promiscuous mode [ 1449.158791][T25507] netlink: 'syz.5.5557': attribute type 1 has an invalid length. [ 1449.160169][T25506] syzkaller0: entered allmulticast mode [ 1449.167291][T25507] netlink: 616 bytes leftover after parsing attributes in process `syz.5.5557'. [ 1449.188325][T25507] netlink: 'syz.5.5557': attribute type 1 has an invalid length. [ 1449.208744][T25506] tipc: Enabled bearer , priority 10 [ 1449.217287][T25505] tipc: Resetting bearer [ 1449.248455][T25505] tipc: Disabling bearer [ 1450.912165][T25533] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5567'. [ 1451.556080][T20588] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 1451.711799][T20588] usb 5-1: config 0 has no interfaces? [ 1451.720089][T20588] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1451.729934][T20588] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1451.740260][T20588] usb 5-1: Product: syz [ 1451.744624][T20588] usb 5-1: Manufacturer: syz [ 1451.750970][T20588] usb 5-1: SerialNumber: syz [ 1451.765033][T20588] usb 5-1: config 0 descriptor?? [ 1451.906187][T17275] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1451.984337][T25540] tipc: Enabled bearer , priority 0 [ 1451.993005][ T5897] usb 5-1: USB disconnect, device number 43 [ 1452.068524][T17275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1452.083912][T17275] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1452.109130][T17275] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1452.118570][T17275] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 1452.126765][T17275] usb 6-1: Manufacturer: syz [ 1452.133280][T17275] usb 6-1: config 0 descriptor?? [ 1452.207179][T25547] syzkaller0: entered promiscuous mode [ 1452.212967][T25547] syzkaller0: entered allmulticast mode [ 1452.231026][T25550] input: syz1 as /devices/virtual/input/input50 [ 1452.253689][T25550] program syz.0.5572 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1452.326911][T25540] netlink: 'syz.4.5570': attribute type 1 has an invalid length. [ 1452.338958][T25547] tipc: Enabled bearer , priority 0 [ 1452.439429][T25546] tipc: Resetting bearer [ 1452.502536][T25546] tipc: Disabling bearer [ 1452.558420][T17275] uclogic 0003:256C:006D.002C: failed retrieving string descriptor #200: -71 [ 1452.569749][T17275] uclogic 0003:256C:006D.002C: failed retrieving pen parameters: -71 [ 1452.678885][ T30] audit: type=1326 audit(1760766284.597:1610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1452.746145][T17275] uclogic 0003:256C:006D.002C: failed probing pen v2 parameters: -71 [ 1452.754403][T17275] uclogic 0003:256C:006D.002C: failed probing parameters: -71 [ 1452.763222][T17275] uclogic 0003:256C:006D.002C: probe with driver uclogic failed with error -71 [ 1452.776109][ T30] audit: type=1326 audit(1760766284.597:1611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1452.799192][T20588] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 1452.825352][T17275] usb 6-1: USB disconnect, device number 30 [ 1452.861925][ T30] audit: type=1326 audit(1760766284.597:1612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1452.926215][ T30] audit: type=1326 audit(1760766284.597:1613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1452.962080][ T30] audit: type=1326 audit(1760766284.597:1614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1452.995594][T20588] usb 5-1: Using ep0 maxpacket: 16 [ 1453.035849][ T30] audit: type=1326 audit(1760766284.597:1615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1453.060044][T20588] usb 5-1: config index 0 descriptor too short (expected 16456, got 72) [ 1453.069868][T20588] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 1453.081427][T20588] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 1453.089831][T20588] usb 5-1: config 0 has an invalid interface number: 125 but max is 1 [ 1453.098414][T20588] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1453.109595][ T30] audit: type=1326 audit(1760766284.597:1616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1453.133076][T20588] usb 5-1: config 0 has no interface number 0 [ 1453.141873][T20588] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 1453.156185][T20588] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 1453.196019][ T30] audit: type=1326 audit(1760766284.597:1617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1453.222800][T20588] usb 5-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1453.232815][T20588] usb 5-1: config 0 interface 125 has no altsetting 1 [ 1453.241766][ T30] audit: type=1326 audit(1760766284.597:1618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1453.265322][ T30] audit: type=1326 audit(1760766284.597:1619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25558 comm="syz.5.5574" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47e18efc9 code=0x7ffc0000 [ 1453.297292][T20588] usb 5-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 1453.309599][T20588] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1453.323518][T20588] usb 5-1: Product: syz [ 1453.510037][T20588] usb 5-1: Manufacturer: syz [ 1453.516352][T20588] usb 5-1: SerialNumber: syz [ 1453.524040][T20588] usb 5-1: config 0 descriptor?? [ 1453.784652][T20588] usb 5-1: USB disconnect, device number 44 [ 1453.815707][T25537] tipc: Disabling bearer [ 1453.826522][T17275] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1453.997696][T17275] usb 6-1: config 0 has no interfaces? [ 1454.005549][T17275] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1454.035290][T17275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1454.054805][T17275] usb 6-1: Product: syz [ 1454.073527][T17275] usb 6-1: Manufacturer: syz [ 1454.078652][T17275] usb 6-1: SerialNumber: syz [ 1454.097146][T17275] usb 6-1: config 0 descriptor?? [ 1454.409290][T25594] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5584'. [ 1454.477630][T25595] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5578'. [ 1454.500386][T25595] vlan3: entered promiscuous mode [ 1455.068158][T25602] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5585'. [ 1455.278567][T20588] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 1455.687568][T20588] usb 4-1: Using ep0 maxpacket: 16 [ 1455.715485][T20588] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1455.756942][T20588] usb 4-1: config 8 has an invalid interface number: 132 but max is 0 [ 1455.806475][T25607] syzkaller0: entered promiscuous mode [ 1455.812067][T25607] syzkaller0: entered allmulticast mode [ 1455.829072][T20588] usb 4-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1455.854915][T25607] tipc: Enabled bearer , priority 0 [ 1455.863176][T25606] tipc: Resetting bearer [ 1455.875645][T20588] usb 4-1: config 8 has no interface number 0 [ 1455.905689][T25606] tipc: Disabling bearer [ 1455.914130][T20588] usb 4-1: config 8 interface 132 altsetting 252 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1455.927975][T20588] usb 4-1: config 8 interface 132 has no altsetting 0 [ 1455.941361][T20588] usb 4-1: string descriptor 0 read error: -22 [ 1455.949334][T20588] usb 4-1: New USB device found, idVendor=07cf, idProduct=1001, bcdDevice=8f.8b [ 1455.960719][T20588] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1456.143260][T20588] usb-storage 4-1:8.132: USB Mass Storage device detected [ 1456.180703][T20588] usb-storage 4-1:8.132: Quirks match for vid 07cf pid 1001: a [ 1456.238104][T17275] usb 1-1: new low-speed USB device number 70 using dummy_hcd [ 1456.310086][T25618] netlink: 'syz.4.5589': attribute type 4 has an invalid length. [ 1456.421969][T17275] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1456.436597][T17275] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1456.487434][T17275] usb 1-1: config 0 descriptor?? [ 1456.593613][T25621] netlink: 'syz.4.5589': attribute type 4 has an invalid length. [ 1456.625600][T20588] usb 6-1: USB disconnect, device number 31 [ 1457.574290][T25639] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1458.249563][T20582] usb 4-1: USB disconnect, device number 29 [ 1458.429722][T17275] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 1458.440220][T17275] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 1458.451219][T17275] asix 1-1:0.0: probe with driver asix failed with error -71 [ 1458.462705][T17275] usb 1-1: USB disconnect, device number 70 [ 1459.265704][T20582] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 1459.285230][T25654] netlink: 596 bytes leftover after parsing attributes in process `syz.5.5599'. [ 1459.397759][ T30] kauditd_printk_skb: 66 callbacks suppressed [ 1459.397775][ T30] audit: type=1326 audit(1760766291.317:1686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1459.496049][T20582] usb 4-1: Using ep0 maxpacket: 8 [ 1459.546625][T20582] usb 4-1: config 0 has no interfaces? [ 1459.563231][T25647] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5597'. [ 1459.576404][T20582] usb 4-1: string descriptor 0 read error: -71 [ 1459.603784][T20582] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1459.618365][ T30] audit: type=1326 audit(1760766291.317:1687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1459.640949][T20582] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1459.691196][T20582] usb 4-1: config 0 descriptor?? [ 1459.706212][ T30] audit: type=1326 audit(1760766291.347:1688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1459.736170][T20582] usb 4-1: can't set config #0, error -71 [ 1459.763628][T20582] usb 4-1: USB disconnect, device number 30 [ 1459.829889][ T30] audit: type=1326 audit(1760766291.347:1689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1459.883955][ T30] audit: type=1326 audit(1760766291.347:1690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1460.207919][ T30] audit: type=1326 audit(1760766291.347:1691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1460.431761][ T30] audit: type=1326 audit(1760766291.377:1692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1460.482835][ T30] audit: type=1326 audit(1760766291.377:1693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1460.507715][ T30] audit: type=1326 audit(1760766291.377:1694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1460.533927][ T30] audit: type=1326 audit(1760766291.377:1695): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25655 comm="syz.0.5600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f4ff8efc9 code=0x7ffc0000 [ 1461.246732][T25694] netlink: 'syz.0.5608': attribute type 6 has an invalid length. [ 1461.269076][T25694] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1461.561118][T20582] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1461.679811][T25696] syzkaller0: entered promiscuous mode [ 1461.685377][T25696] syzkaller0: entered allmulticast mode [ 1461.829061][T25696] tipc: Enabled bearer , priority 0 [ 1461.836851][T25695] tipc: Resetting bearer [ 1462.006212][T20582] usb 6-1: device descriptor read/64, error -71 [ 1462.023455][T25695] tipc: Disabling bearer [ 1462.199117][T25698] netlink: 596 bytes leftover after parsing attributes in process `syz.4.5612'. [ 1462.246288][T20582] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1462.410084][T20582] usb 6-1: device descriptor read/64, error -71 [ 1462.528696][T20582] usb usb6-port1: attempt power cycle [ 1462.655855][ T982] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 1462.810116][T25717] bridge0: entered promiscuous mode [ 1462.820208][ T982] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1462.832844][ T982] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1462.845082][T25717] vlan3: entered promiscuous mode [ 1462.857764][ T982] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1462.904946][ T982] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1462.927626][T20582] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 1462.959319][ T982] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1462.969927][T20582] usb 6-1: device descriptor read/8, error -71 [ 1463.055393][ T982] usb 3-1: config 0 descriptor?? [ 1463.360354][T20582] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1463.386779][T20582] usb 6-1: device descriptor read/8, error -71 [ 1463.507172][T20582] usb usb6-port1: unable to enumerate USB device [ 1463.518166][ T982] plantronics 0003:047F:FFFF.002D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 1463.803109][T25731] netlink: 2 bytes leftover after parsing attributes in process `syz.4.5622'. [ 1464.261747][T25745] netlink: 596 bytes leftover after parsing attributes in process `syz.5.5627'. [ 1464.483489][ T30] kauditd_printk_skb: 68 callbacks suppressed [ 1464.483508][ T30] audit: type=1326 audit(1760766296.397:1764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1464.538154][ T30] audit: type=1326 audit(1760766296.447:1765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1464.561431][ T30] audit: type=1326 audit(1760766296.447:1766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1464.750706][ T30] audit: type=1326 audit(1760766296.447:1767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1464.759655][T25753] bridge0: entered promiscuous mode [ 1464.786496][T25753] vlan3: entered promiscuous mode [ 1464.866206][ T30] audit: type=1326 audit(1760766296.447:1768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1464.951279][ T30] audit: type=1326 audit(1760766296.457:1769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1465.339295][ T30] audit: type=1326 audit(1760766296.457:1770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1465.386785][ T30] audit: type=1326 audit(1760766296.457:1771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1465.457344][T25762] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5630'. [ 1465.466461][ T30] audit: type=1326 audit(1760766296.457:1772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1465.496123][ T30] audit: type=1326 audit(1760766296.487:1773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25749 comm="syz.3.5628" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f3e9a98efc9 code=0x7ffc0000 [ 1466.302979][T17275] usb 3-1: USB disconnect, device number 46 [ 1467.705376][T25798] netlink: 'syz.5.5639': attribute type 6 has an invalid length. [ 1467.723930][T25798] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1469.411499][T25805] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1469.609228][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 1469.609241][ T30] audit: type=1326 audit(1760766301.517:1835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25802 comm="syz.4.5641" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1aa318efc9 code=0x7ffc0000 [ 1469.688429][ T30] audit: type=1326 audit(1760766301.517:1836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25802 comm="syz.4.5641" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1aa318efc9 code=0x7ffc0000 [ 1470.446309][ T5921] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 1470.669613][ T5921] usb 5-1: config 0 has no interfaces? [ 1470.680406][ T5921] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1470.690946][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1470.710831][ T5921] usb 5-1: Product: syz [ 1470.715029][ T5921] usb 5-1: Manufacturer: syz [ 1470.808739][T25831] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5647'. [ 1470.818413][ T982] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1470.827368][ T5921] usb 5-1: SerialNumber: syz [ 1470.890645][ T5921] usb 5-1: config 0 descriptor?? [ 1471.027890][ T982] usb 6-1: Using ep0 maxpacket: 16 [ 1471.081654][ T982] usb 6-1: config 0 has no interfaces? [ 1471.116178][ T982] usb 6-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice= 0.88 [ 1471.157581][T25824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1471.167817][T25824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1471.202290][T25824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1471.217194][T25824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1471.255610][ T982] usb 6-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1471.273249][ T982] usb 6-1: Product: syz [ 1471.277690][ T982] usb 6-1: SerialNumber: syz [ 1471.284996][ T982] usb 6-1: config 0 descriptor?? [ 1471.296505][T20588] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 1471.506833][T20588] usb 1-1: config index 0 descriptor too short (expected 9, got 0) [ 1471.598993][T20588] usb 1-1: can't read configurations, error -22 [ 1471.881399][T20588] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 1471.914331][ T30] audit: type=1804 audit(1760766303.827:1837): pid=25848 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.5652" name="/newroot/476/file1" dev="fuse" ino=1 res=1 errno=0 [ 1472.059632][T20588] usb 1-1: config index 0 descriptor too short (expected 9, got 0) [ 1472.068339][T20588] usb 1-1: can't read configurations, error -22 [ 1472.077399][T20588] usb usb1-port1: attempt power cycle [ 1472.441196][ T5921] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 1472.455765][T20588] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 1472.528636][T20588] usb 1-1: config index 0 descriptor too short (expected 9, got 0) [ 1472.546210][T20588] usb 1-1: can't read configurations, error -22 [ 1472.606040][ T5921] usb 4-1: Using ep0 maxpacket: 8 [ 1472.620038][ T5921] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1472.628041][ T5921] usb 4-1: can't read configurations, error -61 [ 1472.766123][ T5921] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 1472.856154][T20588] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 1472.879471][T20588] usb 1-1: config index 0 descriptor too short (expected 9, got 0) [ 1472.889875][T20588] usb 1-1: can't read configurations, error -22 [ 1472.900077][T20588] usb usb1-port1: unable to enumerate USB device [ 1472.956052][ T5921] usb 4-1: Using ep0 maxpacket: 8 [ 1472.970020][ T5921] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1472.990910][ T5921] usb 4-1: can't read configurations, error -61 [ 1473.010534][ T5921] usb usb4-port1: attempt power cycle [ 1473.084908][ T982] usb 5-1: USB disconnect, device number 45 [ 1473.327320][T25860] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1473.489399][ T5921] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1473.526554][ T5921] usb 4-1: Using ep0 maxpacket: 8 [ 1473.540439][ T5921] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1473.556916][ T5921] usb 4-1: can't read configurations, error -61 [ 1473.663480][T20582] usb 6-1: USB disconnect, device number 36 [ 1473.746969][ T5921] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1473.767876][ T5921] usb 4-1: Using ep0 maxpacket: 8 [ 1473.775515][ T5921] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1473.799982][ T5921] usb 4-1: can't read configurations, error -61 [ 1473.846197][ T982] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 1473.878616][ T5921] usb usb4-port1: unable to enumerate USB device [ 1474.132298][ T982] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1474.144955][ T982] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1474.164332][ T982] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1474.188533][ T982] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1474.212332][ T982] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1474.418710][T25874] gretap0: entered promiscuous mode [ 1474.424651][T25861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1474.455162][T25874] gretap0: left promiscuous mode [ 1474.458024][T25228] udevd[25228]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1474.513041][T25861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1474.637840][T25861] fuse: Bad value for 'user_id' [ 1474.642866][T25861] fuse: Bad value for 'user_id' [ 1475.008962][T20587] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 1475.238908][T20587] usb 1-1: Using ep0 maxpacket: 32 [ 1475.260430][T20587] usb 1-1: New USB device found, idVendor=093a, idProduct=050f, bcdDevice=56.a5 [ 1475.270127][T20587] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1475.279199][T20587] usb 1-1: Product: syz [ 1475.290100][T20587] usb 1-1: Manufacturer: syz [ 1475.294984][T20587] usb 1-1: SerialNumber: syz [ 1475.377117][T20587] usb 1-1: config 0 descriptor?? [ 1475.391888][T25887] tipc: Enabling of bearer rejected, already enabled [ 1475.441891][T20587] gspca_main: mars-2.14.0 probing 093a:050f [ 1475.760298][T20587] usb 1-1: USB disconnect, device number 75 [ 1476.146324][ T5897] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 1476.221848][ T5921] usb 5-1: USB disconnect, device number 46 [ 1476.329445][ T5897] usb 4-1: config 0 has no interfaces? [ 1476.343112][ T5897] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1476.362251][ T5897] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1476.370518][ T5897] usb 4-1: Product: syz [ 1476.374708][ T5897] usb 4-1: Manufacturer: syz [ 1476.380816][ T5897] usb 4-1: SerialNumber: syz [ 1476.397814][ T5897] usb 4-1: config 0 descriptor?? [ 1476.630070][T25892] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1476.641829][ T5831] Bluetooth: hci1: command 0x0406 tx timeout [ 1476.674555][T25892] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1476.784077][T25903] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5668'. [ 1476.850338][T25905] netlink: 2 bytes leftover after parsing attributes in process `syz.0.5669'. [ 1476.873127][T25892] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1476.886704][T25892] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1478.295886][T25914] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5671'. [ 1478.633810][T25919] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5673'. [ 1478.681842][T25919] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5673'. [ 1478.780642][T20587] usb 4-1: USB disconnect, device number 35 [ 1478.865460][T25923] fuse: Bad value for 'fd' [ 1478.882010][T25923] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5674'. [ 1478.937542][T25923] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5674'. [ 1479.014945][T25931] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5677'. [ 1480.115846][T25945] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5678'. [ 1480.159755][T25947] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5681'. [ 1480.434620][T25949] tipc: Enabling of bearer rejected, already enabled [ 1481.026206][ T5897] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1481.179837][ T5897] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 1481.189284][ T5897] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1481.246870][ T5921] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 1481.270612][ T5897] usb 6-1: config 0 descriptor?? [ 1481.306708][ T5897] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 1481.438480][ T5921] usb 4-1: config 0 has no interfaces? [ 1481.447472][ T5921] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1481.456763][ T5921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1481.475445][ T5921] usb 4-1: Product: syz [ 1481.490398][ T5921] usb 4-1: Manufacturer: syz [ 1481.533087][ T5921] usb 4-1: SerialNumber: syz [ 1481.595649][ T5921] usb 4-1: config 0 descriptor?? [ 1481.710425][T25954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1481.730161][T25954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1481.819925][T25961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1481.829003][T25961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1481.865868][T25961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1481.876440][T25961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1482.348374][ T982] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 1482.412968][T25954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1482.423428][T25954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1482.495388][T25954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1482.554751][T25954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1482.604000][ T982] usb 5-1: Using ep0 maxpacket: 32 [ 1482.938566][ T982] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1482.956070][ T982] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1483.096217][ T982] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1483.106105][ T982] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1483.115121][ T5897] gspca_stv06xx: HDCS-1020 sensor detected [ 1483.131282][ T982] usb 5-1: config 0 descriptor?? [ 1483.149014][ T982] hub 5-1:0.0: USB hub found [ 1483.345266][ T982] hub 5-1:0.0: 1 port detected [ 1483.380959][T25976] __nla_validate_parse: 1 callbacks suppressed [ 1483.380978][T25976] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5690'. [ 1483.599688][ T5897] STV06xx 6-1:0.0: probe with driver STV06xx failed with error -71 [ 1483.612047][ T5897] usb 6-1: USB disconnect, device number 37 [ 1483.816189][T20587] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 1483.941955][T20584] usb 4-1: USB disconnect, device number 36 [ 1483.951334][ T982] hub 5-1:0.0: activate --> -90 [ 1483.969751][T20587] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1483.985571][T20587] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1484.009923][T20587] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1484.022771][T20587] usb 1-1: config 0 descriptor?? [ 1484.221570][T25993] netlink: 596 bytes leftover after parsing attributes in process `syz.5.5696'. [ 1484.366978][T25968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1484.403792][T25968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1484.435888][T20587] keytouch 0003:0926:3333.002E: fixing up Keytouch IEC report descriptor [ 1484.448271][ T5897] usb 5-1: USB disconnect, device number 47 [ 1484.450235][ T982] hub 5-1:0.0: hub_ext_port_status failed (err = -71) [ 1484.477779][ T982] usb 5-1-port1: connect-debounce failed [ 1484.496416][T20587] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.002E/input/input51 [ 1484.593937][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.600366][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.768885][T25980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1484.777999][T25980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1484.910126][T20587] keytouch 0003:0926:3333.002E: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 1485.048240][T26004] netlink: 'syz.2.5698': attribute type 6 has an invalid length. [ 1485.063545][T26004] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1485.419287][ T982] usb 1-1: USB disconnect, device number 76 [ 1485.468057][T26006] tipc: Enabling of bearer rejected, already enabled [ 1485.731031][T26008] vlan0: entered promiscuous mode [ 1486.175787][T26019] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5707'. [ 1486.217153][T26019] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5707'. [ 1486.310891][T26019] bridge2: port 1(bond2) entered blocking state [ 1486.346619][T26019] bridge2: port 1(bond2) entered disabled state [ 1486.353137][T26019] bond2: entered allmulticast mode [ 1486.369303][T26019] bond2: entered promiscuous mode [ 1486.686036][T17275] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 1486.857694][ T5897] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 1486.919077][T17275] usb 1-1: config 0 has no interfaces? [ 1486.986492][T17275] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1487.026137][T20587] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1487.034268][T17275] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1487.059530][ T5897] usb 5-1: Using ep0 maxpacket: 16 [ 1487.120245][ T5897] usb 5-1: config 0 has no interfaces? [ 1487.136104][T17275] usb 1-1: Product: syz [ 1487.150569][T17275] usb 1-1: Manufacturer: syz [ 1487.155370][ T5897] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1487.189975][T20587] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1487.237540][T17275] usb 1-1: SerialNumber: syz [ 1487.249530][ T5897] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1487.296702][T17275] usb 1-1: config 0 descriptor?? [ 1487.302904][T20587] usb 6-1: config index 0 descriptor too short (expected 251, got 18) [ 1487.314197][ T5897] usb 5-1: Manufacturer: syz [ 1487.358180][T20587] usb 6-1: config 0 has an invalid descriptor of length 127, skipping remainder of the config [ 1487.403097][ T5897] usb 5-1: config 0 descriptor?? [ 1487.437527][T26044] tipc: Enabling of bearer rejected, already enabled [ 1487.452576][T20587] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1487.502533][T20587] usb 6-1: New USB device found, idVendor=1776, idProduct=501c, bcdDevice=f1.0d [ 1487.533682][T20587] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1487.564611][T26046] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5713'. [ 1487.576916][T26030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1487.585728][T26030] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1487.599184][T20587] usb 6-1: Product: syz [ 1487.637110][T26030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1487.645870][T26030] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1487.650889][T20587] usb 6-1: Manufacturer: syz [ 1487.706152][T20587] usb 6-1: SerialNumber: syz [ 1487.767591][T20587] usb 6-1: config 0 descriptor?? [ 1488.051349][T20587] usb 6-1: USB disconnect, device number 38 [ 1489.702539][ T982] usb 5-1: USB disconnect, device number 48 [ 1490.884049][T20584] usb 1-1: USB disconnect, device number 77 [ 1491.349097][T26075] bridge0: port 2(bridge_slave_1) entered disabled state [ 1491.356367][T26075] bridge0: port 1(bridge_slave_0) entered disabled state [ 1491.570637][T26091] IPv6: addrconf: prefix option has invalid lifetime [ 1491.875607][T26075] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1492.416039][ T4518] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1492.435536][ T4518] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1492.473865][ T4518] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1492.486070][ T4518] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1492.729174][T26105] tipc: Enabling of bearer rejected, already enabled [ 1492.784773][T26115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5731'. [ 1492.919448][T26117] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1493.686438][ T974] tipc: Resetting bearer [ 1493.782422][T26124] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5733'. [ 1493.798273][T26124] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5733'. [ 1494.036075][T20584] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 1494.055497][T26125] bridge7: port 1(bond7) entered blocking state [ 1494.066407][T26125] bridge7: port 1(bond7) entered disabled state [ 1494.072969][T26125] bond7: entered allmulticast mode [ 1494.082029][T26125] bond7: entered promiscuous mode [ 1494.096116][T26128] vlan3: entered promiscuous mode [ 1494.200470][T20584] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1494.242848][T20584] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1494.277392][T20584] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1494.306168][T20584] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1494.324843][T20584] usb 5-1: SerialNumber: syz [ 1494.546125][T26121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1494.555293][T26121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1494.607839][T20584] usb 5-1: 0:2 : does not exist [ 1494.641542][T20584] usb 5-1: USB disconnect, device number 49 [ 1494.819676][T26147] fuse: Bad value for 'fd' [ 1494.845635][T25228] udevd[25228]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1494.878396][T26147] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5740'. [ 1494.960010][T26147] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5740'. [ 1495.696129][T20587] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 1495.906232][T20587] usb 5-1: Using ep0 maxpacket: 32 [ 1495.915375][T20587] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1495.933391][T20587] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1495.971361][T20587] usb 5-1: config 0 descriptor?? [ 1496.220831][T20587] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1496.229902][T20587] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1496.265920][T20587] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1496.281673][T20587] usb 5-1: media controller created [ 1496.321086][T20587] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1496.510106][T26165] syzkaller1: entered promiscuous mode [ 1496.515694][T26165] syzkaller1: entered allmulticast mode [ 1496.976142][T26168] futex_wake_op: syz.2.5747 tries to shift op by -1; fix this program [ 1497.114465][T26154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1497.138554][T26154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1497.153525][T20587] az6027: usb out operation failed. (-71) [ 1497.159508][T20587] stb0899_attach: Driver disabled by Kconfig [ 1497.168981][T20587] az6027: no front-end attached [ 1497.168981][T20587] [ 1497.181440][T20587] az6027: usb out operation failed. (-71) [ 1497.188754][T20587] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1497.199867][T20587] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input52 [ 1497.213654][T20587] dvb-usb: schedule remote query interval to 400 msecs. [ 1497.220757][T20587] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1497.260928][T20587] usb 5-1: USB disconnect, device number 50 [ 1497.318216][T20587] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1497.696801][ T5897] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 1497.713320][T26181] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 1497.843887][T26184] IPv6: addrconf: prefix option has invalid lifetime [ 1497.908800][ T5897] usb 3-1: config 0 has no interfaces? [ 1497.922629][ T5897] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1497.935838][ T5897] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1497.944809][ T5897] usb 3-1: Product: syz [ 1497.950507][ T5897] usb 3-1: Manufacturer: syz [ 1497.955197][ T5897] usb 3-1: SerialNumber: syz [ 1497.969048][ T5897] usb 3-1: config 0 descriptor?? [ 1498.112474][T26187] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5754'. [ 1498.294986][T26190] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5750'. [ 1498.360430][T26190] vlan3: entered promiscuous mode [ 1499.037597][T26201] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5758'. [ 1499.468841][T26204] team_slave_1: entered promiscuous mode [ 1499.912694][T26214] syzkaller1: entered promiscuous mode [ 1499.943706][T26214] syzkaller1: entered allmulticast mode [ 1500.184092][T26219] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5762'. [ 1500.485556][T20584] usb 3-1: USB disconnect, device number 47 [ 1500.492812][T26222] netlink: 596 bytes leftover after parsing attributes in process `syz.4.5764'. [ 1501.044584][T26230] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5765'. [ 1501.176256][T20582] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 1501.337016][T20582] usb 5-1: Using ep0 maxpacket: 16 [ 1501.386916][T20582] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 1501.395216][T20582] usb 5-1: config 0 has no interface number 0 [ 1501.401589][T20582] usb 5-1: config 0 interface 8 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1501.414351][T20582] usb 5-1: config 0 interface 8 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1501.464959][T20582] usb 5-1: config 0 interface 8 has no altsetting 0 [ 1501.483205][T20582] usb 5-1: New USB device found, idVendor=5543, idProduct=0522, bcdDevice= 0.00 [ 1501.699944][T20582] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1501.714899][T20582] usb 5-1: config 0 descriptor?? [ 1502.200381][T20582] uclogic 0003:5543:0522.002F: item fetching failed at offset 2/5 [ 1502.321488][T20582] uclogic 0003:5543:0522.002F: parse failed [ 1502.329863][T20582] uclogic 0003:5543:0522.002F: probe with driver uclogic failed with error -22 [ 1502.572069][T26247] netlink: 2 bytes leftover after parsing attributes in process `syz.2.5770'. [ 1503.360214][T26261] netlink: 2 bytes leftover after parsing attributes in process `syz.0.5775'. [ 1503.729074][T26267] FAULT_INJECTION: forcing a failure. [ 1503.729074][T26267] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1503.812787][T26267] CPU: 1 UID: 0 PID: 26267 Comm: syz.5.5776 Not tainted syzkaller #0 PREEMPT(full) [ 1503.812814][T26267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1503.812827][T26267] Call Trace: [ 1503.812835][T26267] [ 1503.812845][T26267] dump_stack_lvl+0x189/0x250 [ 1503.812871][T26267] ? __pfx____ratelimit+0x10/0x10 [ 1503.812898][T26267] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1503.812915][T26267] ? __pfx__printk+0x10/0x10 [ 1503.812931][T26267] ? __might_fault+0xb0/0x130 [ 1503.812954][T26267] should_fail_ex+0x414/0x560 [ 1503.812980][T26267] _copy_from_user+0x2d/0xb0 [ 1503.813000][T26267] br_ioctl_stub+0x3a3/0xc80 [ 1503.813017][T26267] ? __mutex_lock+0x335/0x1350 [ 1503.813034][T26267] ? __pfx_br_ioctl_stub+0x10/0x10 [ 1503.813049][T26267] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1503.813065][T26267] ? sock_ioctl+0x4b4/0x790 [ 1503.813100][T26267] ? __pfx_br_ioctl_stub+0x10/0x10 [ 1503.813113][T26267] sock_ioctl+0x4d8/0x790 [ 1503.813131][T26267] ? __pfx_sock_ioctl+0x10/0x10 [ 1503.813149][T26267] ? __fget_files+0x3a0/0x420 [ 1503.813165][T26267] ? __fget_files+0x2a/0x420 [ 1503.813184][T26267] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1503.813204][T26267] ? __pfx_sock_ioctl+0x10/0x10 [ 1503.813219][T26267] __se_sys_ioctl+0xfc/0x170 [ 1503.813235][T26267] do_syscall_64+0xfa/0xfa0 [ 1503.813252][T26267] ? lockdep_hardirqs_on+0x9c/0x150 [ 1503.813267][T26267] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1503.813283][T26267] ? clear_bhb_loop+0x60/0xb0 [ 1503.813300][T26267] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1503.813314][T26267] RIP: 0033:0x7fd47e18efc9 [ 1503.813328][T26267] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1503.813341][T26267] RSP: 002b:00007fd47ef4c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1503.813358][T26267] RAX: ffffffffffffffda RBX: 00007fd47e3e6180 RCX: 00007fd47e18efc9 [ 1503.813368][T26267] RDX: 0000200000000200 RSI: 0000000000008941 RDI: 0000000000000009 [ 1503.813378][T26267] RBP: 00007fd47ef4c090 R08: 0000000000000000 R09: 0000000000000000 [ 1503.813387][T26267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1503.813395][T26267] R13: 00007fd47e3e6218 R14: 00007fd47e3e6180 R15: 00007fd47e50fa28 [ 1503.813419][T26267] [ 1504.050464][T17275] usb 5-1: USB disconnect, device number 51 [ 1504.559013][T26274] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1504.829662][T26278] binder: 26275:26278 ioctl c0306201 2000000001c0 returned -14 [ 1505.590247][T26285] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5782'. [ 1506.549163][T26302] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5785'. [ 1506.986156][ T5921] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 1507.166073][ T5921] usb 3-1: Using ep0 maxpacket: 16 [ 1507.173790][ T5921] usb 3-1: config 0 has no interfaces? [ 1507.181275][ T5921] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1507.190998][ T5921] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1507.201529][ T5921] usb 3-1: Manufacturer: syz [ 1507.224251][ T5921] usb 3-1: config 0 descriptor?? [ 1507.674928][T26311] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5789'. [ 1507.957878][T26318] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5790'. [ 1508.006800][T26318] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5790'. [ 1508.172786][T26326] syzkaller0: entered promiscuous mode [ 1508.236940][T26326] syzkaller0: entered allmulticast mode [ 1508.368105][T26323] tipc: Enabled bearer , priority 0 [ 1508.615246][T26319] tipc: Resetting bearer [ 1508.655007][T26319] tipc: Disabling bearer [ 1508.789505][T26333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5796'. [ 1508.844060][T26333] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5796'. [ 1508.930844][T26333] bridge6: port 1(bond5) entered blocking state [ 1508.946377][T26333] bridge6: port 1(bond5) entered disabled state [ 1508.956460][T26333] bond5: entered allmulticast mode [ 1508.969070][T26333] bond5: entered promiscuous mode [ 1509.436036][ T30] audit: type=1326 audit(1760766341.037:1838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26335 comm="syz.3.5797" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x0 [ 1509.457953][ C0] vkms_vblank_simulate: vblank timer overrun [ 1509.541947][T20587] usb 3-1: USB disconnect, device number 48 [ 1510.296042][T26357] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5800'. [ 1510.317137][ T5921] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 1510.475171][T26360] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5801'. [ 1510.612117][T26357] trusted_key: encrypted_key: insufficient parameters specified [ 1510.634737][ T5921] usb 1-1: Using ep0 maxpacket: 32 [ 1510.661334][ T5921] usb 1-1: config 0 has an invalid interface number: 219 but max is 0 [ 1510.679251][ T5921] usb 1-1: config 0 has no interface number 0 [ 1510.690775][ T5921] usb 1-1: config 0 interface 219 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1510.803746][ T5921] usb 1-1: config 0 interface 219 altsetting 0 endpoint 0x8B has invalid maxpacket 28739, setting to 1024 [ 1510.815845][ T5921] usb 1-1: config 0 interface 219 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1511.044989][ T5921] usb 1-1: config 0 interface 219 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 1511.173125][ T5921] usb 1-1: config 0 interface 219 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 1511.379101][ T5921] usb 1-1: New USB device found, idVendor=108c, idProduct=0169, bcdDevice=75.b9 [ 1511.386137][ T5897] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 1511.476228][ T5921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1511.557494][ T5921] usb 1-1: Product: syz [ 1511.582101][T26369] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5804'. [ 1511.626699][ T5921] usb 1-1: Manufacturer: syz [ 1511.640632][ T5897] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 132, changing to 11 [ 1511.654475][ T5897] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1511.684600][ T5897] usb 6-1: New USB device found, idVendor=12ba, idProduct=0100, bcdDevice= 0.00 [ 1511.694588][ T5897] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1511.716067][ T5921] usb 1-1: SerialNumber: syz [ 1511.748855][ T5897] usb 6-1: config 0 descriptor?? [ 1511.766417][ T5921] usb 1-1: config 0 descriptor?? [ 1511.848579][T26349] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1511.922716][T26373] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1512.191629][T17275] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 1512.549501][T17275] usb 5-1: device descriptor read/64, error -71 [ 1512.578315][ T5897] sony 0003:12BA:0100.0030: unbalanced collection at end of report description [ 1512.609445][ T5897] sony 0003:12BA:0100.0030: parse failed [ 1512.632810][ T5897] sony 0003:12BA:0100.0030: probe with driver sony failed with error -22 [ 1512.759852][ T5897] usb 6-1: USB disconnect, device number 39 [ 1512.826043][T17275] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 1512.956312][T17275] usb 5-1: device descriptor read/64, error -71 [ 1513.066527][T17275] usb usb5-port1: attempt power cycle [ 1513.949126][T17275] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1514.018553][T17275] usb 5-1: device descriptor read/8, error -71 [ 1514.112740][ T5921] etas_es58x 1-1:0.219: Starting syz syz (Serial Number syz) [ 1514.139503][ T5921] etas_es58x 1-1:0.219: could not retrieve the product info string [ 1514.416125][T17275] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1514.436838][T17275] usb 5-1: device descriptor read/8, error -71 [ 1514.496039][ T5921] usb 1-1: USB disconnect, device number 78 [ 1514.503968][ T5921] etas_es58x 1-1:0.219: Disconnecting syz syz [ 1514.605924][T17275] usb usb5-port1: unable to enumerate USB device [ 1518.121070][T26440] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5821'. [ 1518.860436][T26447] capability: warning: `syz.4.5823' uses 32-bit capabilities (legacy support in use) [ 1519.029647][T26450] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5825'. [ 1519.059935][T26450] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5825'. [ 1519.234399][T26450] bridge6: port 1(bond7) entered blocking state [ 1519.257048][T26450] bridge6: port 1(bond7) entered disabled state [ 1519.263998][T26450] bond7: entered allmulticast mode [ 1519.273398][T26450] bond7: entered promiscuous mode [ 1520.386250][T26470] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5824'. [ 1521.644374][T26489] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5835'. [ 1522.381125][T26496] netlink: 148 bytes leftover after parsing attributes in process `syz.3.5837'. [ 1523.026798][T26508] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5840'. [ 1525.076507][T20582] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 1525.438197][T26546] tipc: Resetting bearer [ 1526.057345][T26553] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1526.114318][T20582] usb 5-1: Using ep0 maxpacket: 32 [ 1526.300354][T20582] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 1526.314367][T20582] usb 5-1: config 0 has no interface number 0 [ 1526.334671][T20582] usb 5-1: config 0 interface 12 has no altsetting 0 [ 1526.356560][T20582] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1526.385341][T20582] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1526.413927][T20582] usb 5-1: Product: syz [ 1526.423211][T26559] vlan3: entered promiscuous mode [ 1526.445632][T20582] usb 5-1: Manufacturer: syz [ 1526.473649][T20582] usb 5-1: SerialNumber: syz [ 1526.537170][T20582] usb 5-1: config 0 descriptor?? [ 1527.240768][T20582] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1527.261949][T20582] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 1527.296173][T20582] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1527.326259][T20582] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 1527.342920][ T5831] Bluetooth: hci1: command 0x0406 tx timeout [ 1527.370837][T20582] usb 5-1: USB disconnect, device number 56 [ 1527.670009][T26577] syzkaller1: entered promiscuous mode [ 1527.675657][T26577] syzkaller1: entered allmulticast mode [ 1528.666497][T26590] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5864'. [ 1529.150699][T26601] fuse: Bad value for 'fd' [ 1529.209958][T26602] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5867'. [ 1529.228453][T26596] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5867'. [ 1529.868676][T26615] netlink: 2 bytes leftover after parsing attributes in process `syz.4.5870'. [ 1529.883356][T26614] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5871'. [ 1529.910872][T26614] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5871'. [ 1530.050720][T26614] bridge8: port 1(bond8) entered blocking state [ 1530.174599][T26614] bridge8: port 1(bond8) entered disabled state [ 1530.188507][T26614] bond8: entered allmulticast mode [ 1530.236527][T26614] bond8: entered promiscuous mode [ 1530.623354][T26620] IPv6: addrconf: prefix option has invalid lifetime [ 1530.775825][T26627] FAULT_INJECTION: forcing a failure. [ 1530.775825][T26627] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1530.840315][T26627] CPU: 1 UID: 0 PID: 26627 Comm: syz.0.5875 Not tainted syzkaller #0 PREEMPT(full) [ 1530.840333][T26627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1530.840340][T26627] Call Trace: [ 1530.840345][T26627] [ 1530.840351][T26627] dump_stack_lvl+0x189/0x250 [ 1530.840368][T26627] ? __pfx____ratelimit+0x10/0x10 [ 1530.840383][T26627] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1530.840394][T26627] ? __pfx__printk+0x10/0x10 [ 1530.840404][T26627] ? __might_fault+0xb0/0x130 [ 1530.840420][T26627] should_fail_ex+0x414/0x560 [ 1530.840439][T26627] _copy_from_user+0x2d/0xb0 [ 1530.840453][T26627] packet_setsockopt+0x8d0/0x12c0 [ 1530.840468][T26627] ? __pfx_packet_setsockopt+0x10/0x10 [ 1530.840489][T26627] ? __lock_acquire+0xab9/0xd20 [ 1530.840506][T26627] ? aa_sk_perm+0x81e/0x950 [ 1530.840519][T26627] ? __pfx_aa_sk_perm+0x10/0x10 [ 1530.840529][T26627] ? aa_sock_opt_perm+0xff/0x1b0 [ 1530.840543][T26627] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1530.840556][T26627] ? __pfx_packet_setsockopt+0x10/0x10 [ 1530.840567][T26627] do_sock_setsockopt+0x17c/0x1b0 [ 1530.840585][T26627] __x64_sys_setsockopt+0x13f/0x1b0 [ 1530.840602][T26627] do_syscall_64+0xfa/0xfa0 [ 1530.840612][T26627] ? lockdep_hardirqs_on+0x9c/0x150 [ 1530.840622][T26627] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1530.840632][T26627] ? clear_bhb_loop+0x60/0xb0 [ 1530.840644][T26627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1530.840654][T26627] RIP: 0033:0x7f7f4ff8efc9 [ 1530.840664][T26627] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1530.840673][T26627] RSP: 002b:00007f7f4e1f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1530.840686][T26627] RAX: ffffffffffffffda RBX: 00007f7f501e5fa0 RCX: 00007f7f4ff8efc9 [ 1530.840693][T26627] RDX: 0000000000000001 RSI: 0000000000000107 RDI: 0000000000000003 [ 1530.840700][T26627] RBP: 00007f7f4e1f6090 R08: 0000000000000010 R09: 0000000000000000 [ 1530.840706][T26627] R10: 00002000000004c0 R11: 0000000000000246 R12: 0000000000000001 [ 1530.840713][T26627] R13: 00007f7f501e6038 R14: 00007f7f501e5fa0 R15: 00007f7f5030fa28 [ 1530.840729][T26627] [ 1531.056666][ C1] vkms_vblank_simulate: vblank timer overrun [ 1533.888374][ T30] audit: type=1326 audit(1760766365.517:1839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26668 comm="syz.2.5886" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0138f8efc9 code=0x0 [ 1533.964215][T26677] netlink: 4268 bytes leftover after parsing attributes in process `syz.3.5888'. [ 1533.974661][T26677] openvswitch: netlink: EtherType 0 is less than min 600 [ 1534.456371][T20582] usb 1-1: new full-speed USB device number 79 using dummy_hcd [ 1534.659789][T20582] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1534.670397][T20582] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1534.730824][T20582] usb 1-1: New USB device found, idVendor=1d76, idProduct=0101, bcdDevice= 0.00 [ 1534.797351][T20582] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1534.830619][T20582] usb 1-1: SerialNumber: syz [ 1534.855816][T20582] usb 1-1: invalid UAC_HEADER (v1) [ 1534.956789][T20582] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1535.102885][T25228] udevd[25228]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1535.125391][ T5897] usb 1-1: USB disconnect, device number 79 [ 1535.251307][T26691] vlan3: entered promiscuous mode [ 1535.837124][T26694] usb usb8: usbfs: process 26694 (syz.5.5893) did not claim interface 0 before use [ 1536.066951][ T5921] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 1536.705652][ T5921] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1537.206094][ T5921] usb 3-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 1537.221516][ T5921] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1537.233285][ T5921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1539.341646][ T5921] usb 3-1: USB disconnect, device number 49 [ 1539.571899][T26744] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5907'. [ 1539.730911][T26752] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5906'. [ 1540.100627][T26757] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5910'. [ 1540.222664][T26752] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5906'. [ 1541.376014][ T30] audit: type=1326 audit(1760766373.247:1840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26769 comm="syz.3.5913" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e9a98efc9 code=0x0 [ 1542.604698][T26787] netlink: 4268 bytes leftover after parsing attributes in process `syz.4.5918'. [ 1542.652650][T26787] openvswitch: netlink: EtherType 0 is less than min 600 [ 1542.939967][T20588] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 1543.336118][T20588] usb 6-1: Using ep0 maxpacket: 8 [ 1543.348830][T20588] usb 6-1: too many endpoints for config 0 interface 0 altsetting 8: 255, using maximum allowed: 30 [ 1543.375539][T20588] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 254, changing to 11 [ 1543.414357][T15333] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1543.464181][T20588] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1543.477106][T15333] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1543.486053][T20588] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 1543.499455][T15333] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1543.516272][T20588] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1543.523019][T20588] usb 6-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 1543.532542][T20588] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1543.547424][T26801] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1543.555695][T20588] usb 6-1: config 0 descriptor?? [ 1543.561029][T26801] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1543.818537][T26802] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5918'. [ 1544.175856][T20588] logitech-djreceiver 0003:046D:C53A.0031: hidraw0: USB HID v0.81 Device [HID 046d:c53a] on usb-dummy_hcd.5-1/input0 [ 1544.333779][ T36] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1544.381176][T20588] usb 6-1: USB disconnect, device number 40 [ 1544.400156][T26807] netlink: 'syz.3.5920': attribute type 1 has an invalid length. [ 1544.504602][T26807] bond6: entered promiscuous mode [ 1544.510731][T26807] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1544.543979][ T36] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1544.625334][T26807] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1544.674677][T26807] bond6: (slave gre1): The slave device specified does not support setting the MAC address [ 1544.692038][T26807] bond6: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 1544.707738][T26807] bond6: (slave gre1): making interface the new active one [ 1544.714987][T26807] gre1: entered promiscuous mode [ 1544.735219][T26807] bond6: (slave gre1): Enslaving as an active interface with an up link [ 1544.788186][T26813] usb usb8: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1544.808326][ T36] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1544.848288][T26758] skbuff: skb_under_panic: text:ffffffff89dfe937 len:-1824526544 put:-1824526620 head:ffff888029de9000 data:ffff887f969ea1dc tail:0x10c end:0x6c0 dev:bond6 [ 1544.874352][T26758] ------------[ cut here ]------------ [ 1544.879968][T26758] kernel BUG at net/core/skbuff.c:212! [ 1544.890613][T26758] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1544.896888][T26758] CPU: 0 UID: 0 PID: 26758 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) [ 1544.906436][T26758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1544.916503][T26758] Workqueue: bond6 bond_resend_igmp_join_requests_delayed [ 1544.923632][T26758] RIP: 0010:skb_panic+0x157/0x160 [ 1544.928669][T26758] Code: c7 a0 15 6e 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 be 4f f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1544.948283][T26758] RSP: 0018:ffffc9000422f2d8 EFLAGS: 00010286 [ 1544.954364][T26758] RAX: 0000000000000099 RBX: dffffc0000000000 RCX: b83a4a871171de00 [ 1544.962354][T26758] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 1544.970342][T26758] RBP: 00000000000006c0 R08: ffffc9000422efe7 R09: 1ffff92000845dfc [ 1544.978328][T26758] R10: dffffc0000000000 R11: fffff52000845dfd R12: ffff8880762c1a10 [ 1544.986309][T26758] R13: ffff888029de9000 R14: ffff887f969ea1dc R15: 000000000000010c [ 1544.994293][T26758] FS: 0000000000000000(0000) GS:ffff888125d0b000(0000) knlGS:0000000000000000 [ 1545.003230][T26758] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1545.009807][T26758] CR2: 0000200000001140 CR3: 0000000041726000 CR4: 00000000003526f0 [ 1545.017772][T26758] Call Trace: [ 1545.021038][T26758] [ 1545.023951][T26758] ? ipgre_header+0x67/0x290 [ 1545.028532][T26758] ? ipgre_header+0x67/0x290 [ 1545.033106][T26758] skb_push+0xc3/0xe0 [ 1545.037077][T26758] ipgre_header+0x67/0x290 [ 1545.041484][T26758] ? __pfx_ipgre_header+0x10/0x10 [ 1545.046495][T26758] neigh_connected_output+0x286/0x460 [ 1545.051858][T26758] ip6_finish_output2+0xfb3/0x1480 [ 1545.056958][T26758] ? __pfx_ip6_finish_output2+0x10/0x10 [ 1545.062491][T26758] ? ip6_mtu+0x7d/0x490 [ 1545.066628][T26758] ? ip6_mtu+0x38c/0x490 [ 1545.070855][T26758] ? ip6_finish_output+0x2ef/0x4e0 [ 1545.075948][T26758] ? ip6_output+0x126/0x550 [ 1545.080434][T26758] ip6_output+0x340/0x550 [ 1545.084746][T26758] NF_HOOK+0x9e/0x380 [ 1545.088712][T26758] ? NF_HOOK+0x101/0x380 [ 1545.092936][T26758] ? __pfx_NF_HOOK+0x10/0x10 [ 1545.097511][T26758] ? __pfx_dst_output+0x10/0x10 [ 1545.102343][T26758] ? icmp6_dst_alloc+0x3a5/0x420 [ 1545.107265][T26758] ? icmp6_dst_alloc+0x3a5/0x420 [ 1545.112187][T26758] mld_sendpack+0x8d4/0xe60 [ 1545.116674][T26758] ? __asan_memcpy+0x40/0x70 [ 1545.121252][T26758] ? mld_sendpack+0x1e7/0xe60 [ 1545.125913][T26758] ? __pfx_mld_sendpack+0x10/0x10 [ 1545.130923][T26758] ? tls_dev_event+0x717/0xec0 [ 1545.135695][T26758] ? mld_send_report+0xe0/0x380 [ 1545.140537][T26758] ipv6_mc_netdev_event+0x1b7/0x5a0 [ 1545.145721][T26758] notifier_call_chain+0x1b6/0x3e0 [ 1545.150822][T26758] call_netdevice_notifiers+0x88/0xc0 [ 1545.156179][T26758] ? __pfx_call_netdevice_notifiers+0x10/0x10 [ 1545.162231][T26758] ? process_scheduled_works+0x9ef/0x17b0 [ 1545.167942][T26758] bond_resend_igmp_join_requests_delayed+0x61/0x170 [ 1545.174603][T26758] ? process_scheduled_works+0x9ef/0x17b0 [ 1545.180311][T26758] process_scheduled_works+0xae1/0x17b0 [ 1545.185851][T26758] ? __pfx_process_scheduled_works+0x10/0x10 [ 1545.191822][T26758] worker_thread+0x8a0/0xda0 [ 1545.196405][T26758] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1545.202727][T26758] ? __kthread_parkme+0x7b/0x200 [ 1545.207655][T26758] kthread+0x711/0x8a0 [ 1545.211706][T26758] ? __pfx_worker_thread+0x10/0x10 [ 1545.216808][T26758] ? __pfx_kthread+0x10/0x10 [ 1545.221381][T26758] ? _raw_spin_unlock_irq+0x23/0x50 [ 1545.226565][T26758] ? lockdep_hardirqs_on+0x9c/0x150 [ 1545.231745][T26758] ? __pfx_kthread+0x10/0x10 [ 1545.236317][T26758] ret_from_fork+0x4bc/0x870 [ 1545.240905][T26758] ? __pfx_ret_from_fork+0x10/0x10 [ 1545.246004][T26758] ? __switch_to_asm+0x39/0x70 [ 1545.250754][T26758] ? __switch_to_asm+0x33/0x70 [ 1545.255500][T26758] ? __pfx_kthread+0x10/0x10 [ 1545.260072][T26758] ret_from_fork_asm+0x1a/0x30 [ 1545.264827][T26758] [ 1545.267838][T26758] Modules linked in: [ 1545.272927][T26758] ---[ end trace 0000000000000000 ]--- [ 1545.304796][T26758] RIP: 0010:skb_panic+0x157/0x160 [ 1545.310275][T26758] Code: c7 a0 15 6e 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 be 4f f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1545.511018][T26758] RSP: 0018:ffffc9000422f2d8 EFLAGS: 00010286 [ 1545.536898][T26758] RAX: 0000000000000099 RBX: dffffc0000000000 RCX: b83a4a871171de00 [ 1545.556163][T26758] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 1545.583514][T26758] RBP: 00000000000006c0 R08: ffffc9000422efe7 R09: 1ffff92000845dfc [ 1545.596136][T26758] R10: dffffc0000000000 R11: fffff52000845dfd R12: ffff8880762c1a10 [ 1545.616058][T26758] R13: ffff888029de9000 R14: ffff887f969ea1dc R15: 000000000000010c [ 1545.624055][T26758] FS: 0000000000000000(0000) GS:ffff888125d0b000(0000) knlGS:0000000000000000 [ 1545.652852][T26758] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1545.663007][T26758] CR2: 0000556816697000 CR3: 0000000041726000 CR4: 00000000003526f0 [ 1545.671057][T26758] Kernel panic - not syncing: Fatal exception [ 1545.677385][T26758] Kernel Offset: disabled [ 1545.681698][T26758] Rebooting in 86400 seconds..