last executing test programs: 9m56.732891047s ago: executing program 1 (id=3854): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000080)=@ethtool_eeprom={0xb, 0xbe87, 0x4}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)={0x24, 0x2, 0x2, 0x401, 0x0, 0x0, {0x2, 0x0, 0x3}, [@CTA_EXPECT_HELP_NAME={0xe, 0x6, 'snmp_trap\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x40840}, 0x4010) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000001c0)={0x1, 0x0, [{0x1, 0x2, 0x80, 0xfffffff9, 0xeaa}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x490, 0xec000000, 0x32}]}) 9m54.673175492s ago: executing program 1 (id=3858): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008200122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000040)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000880)={0x2c, &(0x7f0000000440)={0x20, 0x7, 0x6, "739d25a9c9b4"}, 0x0, 0x0, 0x0, 0x0}) 9m49.285452232s ago: executing program 1 (id=3869): fsopen(0x0, 0x0) r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8801, 0x0) write$UHID_INPUT(r0, &(0x7f0000001c40)={0x8, {"45707fe6c13ec0bd03e5ecc69c764fabe1f326e479445fcb5b205f8c3b622124e794bd8e155f4d904619803fd30c7c202046abd5cd2a26aeb32d246533b18dbb112bba54737fa3db4899cfbf40d3f0c487e58766cf9c7b78842142fb94c1a1c94a4b98b0cf1fed922cdbea0b164200d9f958ecd17c75d4b852a384e41367b0298b005bb13c7050e0342de230db20f9a86fe5fff6fff420f03ec7bb88747480857ed08bd7b1c7d178945f1af284d8ca636101edf9c287491e9a33df027ba595b273a8ed5aa6e64d7d3b218b76dc3566398b63e3a8dd3de57079ca6118e08a919f343ead86112d5dea53d5318814f9ddf14081758874653d15a71d0a4b7b18910a03e474208e31ca08e010c28aaa46ecc7c466cb8a06ee6047ca4ae798dc67f6e612afb9aca11097fec86fd5f12ffc6d43e70d749ed8962f2c9d7e88c49cad8b6af5ffca7d38eecafe276f318fdc229937052dee824a11519c054b9716a45703baef71e935632522ac184812313296a6599384899e8015ca5812cd608882ed02e8bc602bb3fb28b7e2bf2128e9fbe97a1e27e074586c6ebb0449ae67c56a96a0b0fcddadb770e57ef7377fed2191d519f222f8a8ce060cbeaa0428c835884f62fca487cd834ad600a5f68c28840878f9f519238abac8ab71c985bd0cdfb5bb1448cb8bb34a59ae512f2deee1f404e0d0c603c615a09be57ef4b94005ee0ef906239d56fa9f310b1be21098ac02db6302c4950496fdbc249d8ffd7cd19e7e26464e712c3184182b57546ae65b77ce55edeae4ee690a0db16b5c26977d36a3369c58ee48588f0ba502f4b584ccfe2e0f60b861930f24db34307ccfb6bf8139b0f8dea88413afc00bcf5582f211348df402e4ae1556627ac3f07dcc77d44d9454ba8eed51139ffdcea61172920c3494ff0d222e6836f8de22d66b10e3875b9b89a48c4ae134e7d81049039d186ea8995b5a289584437c54eb5d03197a7b81e2339f633dbba878eef49eeb85ee34df7789295c5491584af81f8f53487b713becb9a285f674d4c72b188ba6f767ede8ffae64842ecb82b33e799e90f7e977556884664e978e9dc7686c5d1253d4328ac7d95c67258a4fbc267a29b515f09a27a87015756c825f3ce309a2d8b089f2aed4e560d2b154d40ec1fe9cd01ecbfe3b025ff4222891757b376a9cbf325820912f8027ddd963d1ccf549baa912c0cf4817bf1a639dd5b39e56a63d108d914169c72577bc45730e1a9e20529a9f6a8aee9c83da159467c2f77212c1b9eda16804490198a29c61efec362dfa448ffa56a8e120690222f8e56ee6a820feda4173637e34c1aab938637ff82aad4f4f352f12ff9c164a9a7ebaa7a17797764b2bacae18898c33e8c759298eb94db0b8e676b6cc7971e6bd80445472af014f7470656d2566d7ca656acd4135e61dd4545f2d587ea05e6161db82f298bd71d610e50a092b817789473f5da3d32716613a1b09bbda29d501eff30e9993271f20423e74a2a0a1662f99f73c27e855d32796bc68a769e92e2b5d659f2ebd132dc9bfffbf031cd225f7e83e321160b65e55ff38462e8a36a4c533d30302d8102bcb41bec2abab1984b06733d370c2f3363a8d5e30c08f0e74e9e876f72745f574bc80fbe25943896ebe04fe72cfa9de6ee8506ad70c3be65a86eaf4f1fb913821afc85cf985b841d8ca96321dc1a31724f0b599c2ad147713692ecde7238ac87f2f426169bc060281c460f0e1346a92f464ee1f794002d3187a84fc6757f735cbbf42c41a0bb5d99ca04ef3792276491a1232fbcc00f7caf321ac9951a6517eeabaedc207c6b4d9c8f4e5a458d7def6c08a508b66ed3ccae5b544f0b84c9871129c4f6efa804404852993483d06b9227a689cb37a605b43265ca46ebe674073fbca8f83a56856cd6d5cf6e018dea75ca325b2365527888321bc8686069a7dbdc8b22a32c20e07e79eca4f83902a7d02c641bbdbe66a1bc18ff132c770b67964cce6c3800c05a5f0e0253ebd85b825e1c692887e36e4b938ac97507979aa39459ea04070fb078c63c334eabbc1e6444ce1336f98a41045d2a576a049d07368e027b182f6038ad38c3359dd3de78544dc621f9acd4f0540e117162c22e753462c4be2065724c3429b75b4db74e89d84f2795aba986dfc2b1fdcbe98346260cb9748f454a65f4b35b874ac5910184ad0fece39f01cd50663ca2462729f4cfa4e756c0cb6fc397f77c8fdcd7c9e194705e522ca83c625c7fab6ea43aad89db0b6ba71eed901209fc7330e8bc671aff44e5e48502abddc2409b52ece3779d3b19c1832b30abd3f81a9ff0c68fce42ad9c1941f03ce33ed9d37dce98dbe5e1d23519d22087f307e870c82f028e96fef580c4c8c62a32c2776eed31c3d8bddeb43cc53ab8592478253b6de3095d6828bd960989b9ed9879f863d3128f708eebe99f7701823f232444f2ac9830da973b993679e1bb510b2b6939847751cd0d4642d7bb899e21a7c26938fae9f1b149ff19032b5149b4cde635fa99c2160a8cd6f7ad6a5a242b6b31e253e04ea72f1b6f60677ef87fd8e175373c24822a3794134a3124f2e109a59d9db08e48f845254d4b68c42da5b2b2f3c3c528f4281cae4f5117cd0a4658e9ed1dba09656393623fb13fad1cda4eaa602176aba55ba251817017338193512318390fed2a914739050b1a85ca3833f71aa7c4c8fb45158b530c24bd4316f72c9b432a1bd067cd6fc64d646cc06bfbbf990dacb32de9496a8d730cc07171ce548957d435b2f121ea4bb939f70785ebce86f0ad6d89bb71cdc1d0897284ac5d09b95a76ddbfc787a98193b9cbdb1d3ffd89d5f10b9bbb5d41a2a33f73385df351db85c83786db3da558d890f414b21615160dfcb3b46f0958d492bd6d056550c48e5f0c26dd10c1c6ab3b4c6b7d911db5ac463f8e37a8bbcc2295fe79fa109f491a126fff6a1ffe161c7787f746fc8ddea5f19bd20fabca63aa81ae2d725e0b250f27fd7c8431ef6b2827904f62b5ffefc9bfdfb7d55ef6d9883c6ab43c5214b4af237d0df67afcb3d62e80041720952e837e65a22351cb3bf8a9e271568597f79f12144495d31ef72fc36a86e9eb4359790aee88c00b05473ac1a90b8bbe0c0db99570dd9bda506469c258e145841d9c26c9f32722a678cf25657acd124831cfc6a1809e341989b46b6df9db72b18f8be39cd845669bad697bc6bd9bec531047d5fa9e201e1a525c372367f8495280c5d93a62f9fb6f890c59959dcbac7de68e3a417befcd11c722067aac4726e2fdcabce2321ea64d9fbda04ab25dedbcb441faaef2d7bf024fe765591fd0354b2bcaa243a6d741272d4458e433118568944047eeec85d3b0f5b98cbdad0f77371be15af9c1bf928eceb652c581fa638e2131c22d901e6f047a5649ffab5324054389ebeb47ff283e0f0ffe074382e520c632bc440cbeaa68770877516e101709489bcb643b187cb2715e58479074cd32d53077331453fc537d34f87a7ec5e5da686c2f304116394e2bd1e480f5da74a6b725d526b71dc869df8dda3feb44f5463f4c678b6a8be34994ecb0902b3cf269de1adf0da8b8ad340b63a6d0237df7e812b94572adbc196784dfcf33e3e97a17b71a2dad7015fb2d59d4c5838ca551984c7d8ee7bf05ab3edf89029ffd20e373fcb72523bff1e63df721416a068d7b2daa3e17fbba8e831c53e29a94dc483e289cf7406a7b2da28ecc761cf9d847d39b7daa5e34a2a0e4dd19ca5c4a1ab274c7fb9a3057109ec0644579f1af210f8b8133dd87f1abd7c71ac09cfc38699573b35e6d9c5bdaa21f16442b87860e9a7f62ff7c2458160c6a64dc218a258ee06e222e47b3b8e0cf5a5c2d9985f886f32abd129ee056fae9b2e32d0571532eab27fa8f079f9c3e378125f2020064850cfb19c53aa44ad8da6f83a5d827bcb131da9d4dde6e8bd0005ef240c4a02b17051845c35725bd8668c3b27b46355febbf2bf3e5dc5ec650499669cbfe921815396d87b3ede410d492cc73ec7f3a40409eed9358131f1f75e31f24e34af6fc7b6fe2730fd043fd69269d939772e7fef5f2e08b657038a61bc8a8d5688b16029d15aacefe6631a364769d3b9b261bbac584c5ba29b7fbda146fc2ac0f1044f89141a57292b87c7275c6ec6011e5b4b40d1ebc4fc32e7c7ac96aea170225e60c189ed09f8df0a143232bd93c6a9d0fba9783f303b3375b10dde9cd501e68df3734f6278a0389418578834e1912806f07e2fa715bfed4bc707559ee3d4966f51cb652b06b747ae2d79b56759035f01953e76a2dc14c817eb0f97332e68c1d3995dcd84b2329194299944cb2c050991c409fe447ed764a9a3a1182bc30f773b0b415c1898460150c9fec8987c24ba07f87f299d014bd89049b3e9d0c9bf1c6bf159545e52cdfcf9e799b593cb411a3db12396dc9c09ddeddfcb6165a99074e531b7ceddaf344baf2e65225203da537cf09fc073d61d92c13a1c95f93e70050b99850272d0227a89faadfbfae923501b0321984b59229b7dc3c646bf4e381534fcb31783c568deb1a36f95c873df99ccab25446c77d96de6b2c70d5baa5b27786e8027b2f70be117bfdc1b2c6d72a6ab2f9e9a9ce231443d0621448e78393142f90177e7bb52976c668583c64beca45af5ea23a060ec910c6cd89ba7cb9cbbd7627ee56dd2d4d60d994cd63e81f181642b8864afa797aecc22358eea8d059d681a333caa15a8c56918523d465e94668d6ef5f3dcc089bffb13ad76dbf79c44c14f494fda3a55f61c3ed659e20a274297360576fd3230b3e4b7e79ea5b7d78c1def22741a38d17b39c646579d8d5df4cae4eca98d1c0df9371532fe89efc2c375fe433699ee14fcd4cf84495d380663aa10a374dba851536b8159deee491ed2c0e2b920bf7c5627db54562f1ff9c56795245be220391d6b681360fa221efc91faf57d80f15b5e3d881cfa30e1145dbde325c6cc8254938a9eb906d846ec5f76f63443b8f2c50db90b6563900a8f97947c82caec3ce4ee3a5e19fc3324376e4b041b7ed82d9940f7a63f9f962f6d746cb781dbbe16a90649881a77e8ac40677e74d87beadc50df2bc624aa6a707cb50c8ee749db526903f38d706df0201bf503b759d320fa940838ec74c914d0de569ed9ffc6eb2cee026ce22cd50a884bccfadbf503892930c4c4dd7efcb3caaac1695027ed66f3f29c7a1edade721bac0599ff0c400542d31d5dc235ddca7bada9cabcf427e038e5c6a54687b955131c547155036401c7a9a44b3b0437edaa30635b84e37996bcc8594307a6b6bbd8b06daa994cf238925485cd9ace35b3fdfd72788199b6f0570eed2078a4b2f36f511a68566927389ca5ce1c854cb500c2693d7a7917cc8f1215608b7dd2ab22de43a5cc91309a4db2a4c29fdeceaec4a604d13af72a60ea50070626aa6d4cfa418b95edda37a88db5218a1e096436a3551ee712ae137217cd0e941c31e86839e3a9aef8058f5f3196a5006f5a13f3343c0cbf50f9a27c7481e62614a4c51071df6c9a2e0058e534be00c510052e03148c79cc31256359b330c0de91e6130ce741d0472a838463987b9cb80693701825d0af139207f4ff1dc5cb92187170acb8c217f26b1a0544021a8ddce3e31de19b603a5eeca75a7a6234f75d890322a2dca481bc814ba65893cf8e4492094dfe534936a4378e85f680559f4ebce2cccdbea2c0c1e776c4cf50df6b0bc2effcee0f2c76b5c478f9dd02e0eef9399ddf2ba449e03cfd5d33388b0b683c3ce0d301ca1ba4ab", 0x1000}}, 0x1006) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00'}) 9m44.813555662s ago: executing program 1 (id=3876): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000000), 0x26, 0x756, &(0x7f00000002c0)="$eJzs3M1rXOUaAPDnnGaafuTeyYUL9+pChBZaKD1Jmk27aty4KxQKbmtITkLISSZkJrUTC7auhdpsFARR1y7dCqX+Ae6koOBeEK1xIW5GzuSjNGam0ybpSPr7wcl53vP1vE/m8GYO5D0BvLReL38kEUMRcTUiqpvb04g42o6ORdzeOG790a2pckmi1br2S1KeFuut6va1ks31yWifEv+PiAeViHPv/z1vvbk6P1kU+fJme6SxsDRSb66en1uYnM1n88Wx8UujF8fHL46OP7WG//VY6+m3Lh2/9+2ba2vffdW4+9rA+SQm2nXHZm09XuaZbPxOKjGxY/viQSTro6TfHQAAoCfl9/wjETHQ/pZajSPtCAAAADhMWoMtAAAA4NBLot89AAAAAA7W1v8BbM3tPah5sJ38/EZEDO+Wf6A9hzjiWFQi4sR68sTMhGTjNNiT23ci4v7Ezvvvi/IOu73Ha4/uaD85R/roHq/Ofrhfjj8Tu40/6fb4E7uMPwNb707Yo87j3+P8RzqMf1d7zPH1p69UOua/E/HqwG75k+38SYf8b/eY/+7aB/c67Wt9HnFm178/yRO5urwfYmJmruj6+oEHf5592K3+E53yJ93rX+qx/nfXf5vvNJaU+c+e6v7575a/vCc+3OxHGhH3Ntdle21HjlML33/Trf7piNbzfP6f9Vj/j18O3uzxUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhLI2IokjTbjtM0yyJORsR/40Ra1OqNczO1lcXpcl/EcFTSmbkiH42I6kY7Kdtj7fhx+8KO9nhE/OeH4xtJ54o8m6oV0/0uHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgG0nI2IokjSLiDQifq+maZZFDPRw7uAL6B8AAACwT4b73QEAAADgwHn+BwAAgMPveZ//k33uBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCoXb1ypVxa649uTZXt6RvNlfnajfPTeX0+W1iZyqZqy0vZbK02W+TZVG3hadcrarWlsUuxcnOkkdcbI/Xm6vWF2spi4/rcwuRsfj2vvJCqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeFZD7SVJs4hI23GaZlnEvyJiOCrJzFyRj0bEvyPiYbUyWLbH+t1pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9l29uTo/WRT5skAgeGHBexHxD+hGl6DfIxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qb67OTxZFvlzvd08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/SnJCLK5Uz19NDOvUeTP6rtdUS888m1j25ONhrLY+X2X7e3Nz7e3H6hH/0HAACAl8LlZzl46zl96zkeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgV/Xm6vxkUeTLewsuR3O1lXQ4pt81AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz+evAAAA//8KQsc4") seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000040)={0x4, &(0x7f0000000240)=[{0x1, 0xfc, 0x0, 0x8804}, {0xfff, 0x9, 0xb, 0x80000001}, {0x7, 0x3, 0x56, 0x4}, {0x4, 0x8, 0x7, 0xa44}]}) syz_open_procfs(0x0, &(0x7f0000000a40)='net/ip_mr_vif\x00') ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x14, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000071000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @lirc_mode2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x0, 0x8, 0x8, &(0x7f00000002c0)="fbfffeffffffa000", &(0x7f0000000300)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fffff}, 0x50) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000002100010000000000000000000200000000000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8050}, 0x8000) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)) msgctl$IPC_RMID(0x0, 0x0) msgctl$IPC_RMID(0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = msgget(0x2, 0x200) msgctl$IPC_RMID(r4, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 9m43.080640477s ago: executing program 1 (id=3882): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f00000003c0)='pstore\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x1) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) 9m42.68840126s ago: executing program 1 (id=3883): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0xfffffffffffffcfd) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) syz_emit_vhci(0x0, 0x1d) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102384, 0x18ff0) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) r4 = dup(r3) write$UHID_INPUT(r4, &(0x7f0000001040)={0x18, {"a2e3ad21ed6b52f99cfbf4c087f70c9b3e6ee7ff7fc6e5539b9b3b0e8b9b411b5d30091b080d29428f0e1ac6e7049b3468959b4c9a242a9b67f3988f7ef319520200ffe8d178708c523c921b1b25380a169b63d336cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c6000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x100d}}, 0xfffffdef) 9m27.592138245s ago: executing program 32 (id=3883): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0xfffffffffffffcfd) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) syz_emit_vhci(0x0, 0x1d) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102384, 0x18ff0) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) r4 = dup(r3) write$UHID_INPUT(r4, &(0x7f0000001040)={0x18, {"a2e3ad21ed6b52f99cfbf4c087f70c9b3e6ee7ff7fc6e5539b9b3b0e8b9b411b5d30091b080d29428f0e1ac6e7049b3468959b4c9a242a9b67f3988f7ef319520200ffe8d178708c523c921b1b25380a169b63d336cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c6000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x100d}}, 0xfffffdef) 14.612896896s ago: executing program 0 (id=5165): sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="54000000020601040000000100000000000000000d000300686173683a6d61630000000005000500000000000c00078008001200000008000900020073797a32000000000500010007000000050004"], 0x54}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) setuid(0xee01) ioctl$IOC_PR_REGISTER(r2, 0x401870c8, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) r3 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) sendmmsg$inet(r3, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xe0}, 0xe000}], 0x68000, 0xe000) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0xefe, &(0x7f0000000340)={0x0, 0xc19a, 0x1, 0x0, 0x126}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000140)) syz_io_uring_modify_offsets$generic(r5, r6, 0x2c, 0x10000) io_uring_enter(r4, 0x2883, 0xf1bd, 0x0, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0), 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) clock_gettime(0xffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x0, 0x200008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x4c) io_uring_enter(r4, 0x7fffffe, 0x5, 0x5, 0x0, 0x0) 11.252373501s ago: executing program 2 (id=5175): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB, @ANYRES32=r3], 0x1c}}, 0x840) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff61a4f0ff000000002d040000000000003d400300000000006504000001ed000079130000000000006c44000000000000"], 0x0}, 0x94) syz_emit_ethernet(0x5a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaac7533137cd4e1eaaaaaaaaaaaa0008004e00004c00000000000690780a010102ac1414aa070f04a976bc4b4c9e3e260cbfad990444140b01e000000100", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0xc014) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) 10.933884191s ago: executing program 3 (id=5177): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x20100, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x1, 0x106) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x1, r2}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x10000006, @remote}}}, 0x108) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xffff, 0xfff1}, {0x5, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad48b6c5820fc7beefff5d0e4c90c2000000000000000000", 0x18) 10.865233373s ago: executing program 2 (id=5178): setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x5, &(0x7f0000000000)=0x6, 0x4) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @pix={0x434c, 0x8, 0x584e4f53, 0x4, 0xc, 0x7, 0x0, 0x40000005, 0x1, 0x4, 0x2, 0x7}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$kcm(0x2, 0x200000000000001, 0x106) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0xb00) 10.825001494s ago: executing program 4 (id=5179): setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x5, &(0x7f0000000000)=0x6, 0x4) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @pix={0x434c, 0x8, 0x584e4f53, 0x4, 0xc, 0x7, 0x0, 0x40000005, 0x1, 0x4, 0x2, 0x7}}) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socket(0x10, 0x80002, 0x0) r2 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0xb00) pipe(0x0) 9.03585827s ago: executing program 0 (id=5181): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r0, &(0x7f0000004d00), 0x0, 0xf00) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x4, 0x0, 0x0) 8.980393691s ago: executing program 4 (id=5182): sendmsg$NL80211_CMD_STOP_NAN(0xffffffffffffffff, 0x0, 0x1040) socket(0x29, 0x800, 0x4) socket$inet6(0xa, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, 0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x121c00, 0xfb) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x42, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, 0x0) r2 = dup2(r1, r1) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f00000001c0)=0x2) read$FUSE(r2, &(0x7f0000002780)={0x2020}, 0x2020) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81e8943c, &(0x7f0000000300)) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000800)={0x0, 0x7, 0x1, [0x5, 0x7fffffff, 0x9, 0x10, 0x552], [0x0, 0x4, 0x3, 0x8383, 0x7f, 0x6, 0x94a, 0x0, 0x3, 0xfffffffffffffffb, 0x4, 0x2, 0xb5a, 0x1, 0x5, 0x2, 0x0, 0x4, 0xe, 0xfffffffffffffca2, 0x1, 0x8000000000000000, 0xfd75, 0x5, 0x2, 0x8, 0x2, 0x7, 0x2, 0x3, 0x5, 0xfffffffffffffff7, 0x2119, 0x4, 0x77ff, 0x6, 0x86, 0x5, 0xc1, 0x100, 0x8000, 0x9, 0x5, 0xffffffffffffffff, 0x6f, 0x7, 0xba, 0x3, 0x5, 0x53d, 0x8001, 0x1, 0x0, 0xb265, 0x6, 0x1, 0x8, 0x0, 0x4, 0xf, 0x6, 0x30000000, 0x9, 0x5, 0x6, 0x5, 0x3, 0x51a, 0xfffffffffffff801, 0xffffffff, 0xfd75, 0x3, 0xb, 0x0, 0x1, 0xd, 0x9, 0x401, 0x5, 0x7ff, 0x66d, 0x2, 0x3ff, 0xd, 0xfff, 0x2da, 0x11980266, 0x7, 0x3, 0xffe000, 0x1, 0x4, 0x20000, 0x400, 0x0, 0x8, 0xd0f, 0x2, 0x60b7, 0x9, 0xc3, 0x7, 0xb8f, 0x8, 0x1, 0x1e00000000, 0x6, 0x401, 0x6, 0x5, 0x9, 0x80000000, 0x7fffffff, 0xce, 0x4, 0x0, 0xfffffffffffffe00, 0x6, 0x400, 0x0, 0x6]}) r4 = openat$sw_sync_info(0xffffff9c, &(0x7f00000007c0), 0x800, 0x0) getsockopt$inet6_udp_int(r4, 0x11, 0x6f, 0x0, 0x0) 8.902201854s ago: executing program 3 (id=5183): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2, 0xf5ff}, 0x10) sendmsg$tipc(r0, &(0x7f0000000540)={&(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x4}}, 0x10, 0x0}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) 8.773605028s ago: executing program 0 (id=5184): bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00') ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32=r0, @ANYBLOB="0c009900010000005100000008009f0006c8c365b5d480"], 0x30}, 0x1, 0x0, 0x0, 0x4c854}, 0x20040880) add_key$fscrypt_provisioning(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffe) mount$fuse(0x0, 0x0, 0x0, 0x1000430, &(0x7f0000000780)=ANY=[@ANYRESDEC=0x0, @ANYBLOB=',', @ANYBLOB="58e1a192964f91b2b2b082e5b2d36bfb79aa692b33c0fe4f45accc6a979fe95b1d5b4e"]) r1 = socket$alg(0x26, 0x5, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000640)=ANY=[@ANYBLOB="736563757216ae2c69747900000000000000000000000000000000000000000000000004"], 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="2c235aa9c5", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) r3 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r3, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xc38, &(0x7f0000000dc0)=ANY=[]) 7.74554962s ago: executing program 3 (id=5186): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x1, &(0x7f0000000180)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) r0 = socket$kcm(0x29, 0x5, 0x0) sendmmsg$inet(r0, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f00000010c0), 0x0, 0x0, 0x0, 0x60ff}}, {{0x0, 0x0, &(0x7f0000001800)}}], 0x2, 0x24000010) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$inet6(0xffffffffffffffff, 0x0, 0xc044) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r2, &(0x7f0000000400)=[{&(0x7f0000033a80)=""/102386, 0x18ff2}], 0x1, 0x0, 0x0) 7.479354398s ago: executing program 4 (id=5187): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f0000000000)=""/40, 0x0, 0xc000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000002c0)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) 7.478895298s ago: executing program 5 (id=5188): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB, @ANYRES32=r3], 0x1c}}, 0x840) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff61a4f0ff000000002d040000000000003d400300000000006504000001ed000079130000000000006c44000000000000"], 0x0}, 0x94) syz_emit_ethernet(0x5a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaac7533137cd4e1eaaaaaaaaaaaa0008004e00004c00000000000690780a010102ac1414aa070f04a976bc4b4c9e3e260cbfad990444140b01e000000100", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0xc014) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) 7.046031902s ago: executing program 2 (id=5189): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0xb4, 0x0, &(0x7f00000005c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0xb, 0x2}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @clear_death={0x400c630f, 0x2}, @free_buffer={0x40086303, r4}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/127, 0x7f, 0x2, 0x8}, @fda={0x66646185, 0x7, 0x1, 0x22}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/19, 0x13, 0x2, 0x3e}}, &(0x7f0000000580)={0x0, 0x28, 0x48}}, 0x400}], 0x0, 0x0, 0x0}) 6.988059293s ago: executing program 3 (id=5190): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x20100, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x1, 0x106) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x1, r2}) socket$unix(0x1, 0x1, 0x0) r3 = inotify_init() r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x108) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) close_range(r3, 0xffffffffffffffff, 0x0) 6.804841129s ago: executing program 2 (id=5191): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) setreuid(0x0, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x2000000) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'veth1_to_bridge\x00', 0x20}, 0x18) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000300)}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') write$cgroup_subtree(r4, &(0x7f00000003c0)={[{0x2d, 'net'}, {0x2d, 'hugetlb'}, {0x2d, 'hugetlb'}, {0x2b, 'freezer'}, {0x2d, 'cpuacct'}]}, 0x29) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r6, 0xfffffffffffffffe, r6, 0x0) accept4$inet6(r5, 0x0, 0x0, 0x100000) r7 = creat(&(0x7f00000002c0)='./file0\x00', 0xecf86c37d53049c4) close(r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r5, 0x8982, &(0x7f0000000000)={0x0, 'caif0\x00', {}, 0x8}) read$FUSE(r5, &(0x7f0000000640)={0x2020}, 0x2020) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4024587b, &(0x7f0000000440)={{r0, &(0x7f00000000c0)='!\x00', 0x40200, &(0x7f0000000100)={@align=0x8, {0x101, 0x7, 0xa94, 0x9}}, 0xdb00000, &(0x7f0000000140), &(0x7f0000000180)=0x945}, 0x2, &(0x7f0000000400)=[{0x2, 0x8000, &(0x7f00000001c0)='--+\'\xd6]$]:%\'^]$\x00', &(0x7f0000000200)="ddffd3ab9f4b2ee225ddd8fb30b52990e393567dec007d75fb0b787f5f8f799bc6ab85e26ec5267725a7afdccbb38da0078428a7e22e7e28082fa43641450250f82db6fa9ea2eb0904d735d77af77281442e8ab4bc49f4ac3059d5c8b73050dc09d65ccbbda787e0c8e6c8e5c506c108004f2452e3cb654be01f983992865e69f95c3c6d106f4a1ba6631a760d4d2739197daf7b8e56a3908bba1da4ed69fbc9f475a52a33d22915ffbc72666beeae764375", 0xb2, 0x8}, {0x1, 0x9, &(0x7f00000002c0)='![)&\x00', &(0x7f0000000300)="b0bf2b386e33174213634fb80e2263ae4fb25a10f1e76a67d7ce315ff5eb9a8722e96e66b54b6c9e26ce4b0bd23a813e47b5665d96556a0f7b3075e091090456f22db6300895cd66f40d02ef36db648494c92f74b72a9912758efd91f3e99444082c9c9268b910f739dd71fa57819351f5e8284aa4f19577a0ae3f66a276d38aeb29c4bf0df3cea2be760be6e5d8b6b09d42e0fe9761636e24c99f3cd119b8a510b5f20d191fcf2e3e0b628159b13fec81a900bbc77f891a6cf9a5f75611f46bbfa224746523730172e09d86f02ff08404149f43c1c89127028ba51e0dc83dccfe8a0702211be24b633fce70f8a9b6280d70dfc94f3b171117", 0xf9, 0x10}]}) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000080)=0x30) 6.604936495s ago: executing program 5 (id=5192): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r0 = socket(0x10, 0x80002, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f610500020100000005fe060c10880008000f00fff3", 0x22}], 0x1}, 0x4080) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=@ipv4_newrule={0x1c, 0x20, 0x301, 0x70bd2a, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) 4.464560702s ago: executing program 4 (id=5193): r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) ftruncate(r0, 0x8800000) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) sendfile(r1, r0, 0x0, 0x558410e9) 4.334914556s ago: executing program 0 (id=5194): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r0, &(0x7f0000004d00), 0x0, 0xf00) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x4, 0x0, 0x0) 4.117772012s ago: executing program 0 (id=5195): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x20100, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x1, 0x106) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x1, r2}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x10000006, @remote}}}, 0x108) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xffff, 0xfff1}, {0x5, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad48b6c5820fc7beefff5d0e4c90c2000000000000000000", 0x18) 4.117250552s ago: executing program 3 (id=5196): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x0, 0x800, 0xfff}, {0x0, 0x0, 0xe6}, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in=@remote, 0x404d3, 0x2b}, 0x0, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) close(0x4) syz_usb_connect(0x3, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010222d1bf200304a4bc070600000001090212000121027002090403"], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x1) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000100)=0x3) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) write$dsp(r3, &(0x7f0000000280), 0x0) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(0xffffffffffffffff, 0xc0884113, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) socket$inet(0xa, 0x801, 0x84) r6 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000700)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r8, 0x0, 0x0, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0xc004) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, 0x0, &(0x7f0000004000)) syz_usb_connect(0x0, 0x335, &(0x7f00000007c0)={{0x12, 0x1, 0x201, 0x92, 0xf6, 0xbb, 0x20, 0x4dd, 0x9102, 0x55ba, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x323, 0x2, 0x7d, 0x8, 0xc0, 0x8, "", [{{0x9, 0x4, 0xda, 0x28, 0xa, 0x34, 0x82, 0xe5, 0xd4, [@generic={0x101, 0x7, "bcd78ffd95037144db2d3e82d57af312dfa71cc8e0bf19fb25b9b7f3fbee1008073c83f803476de868894eb09fd9670b65a6f5c8bcd2abd8dcc07e26dd5a79ce47c2d0fa283b9b54bd09dbf2330b768207577ea3eedb81bfa1ddb2bab9d61015b379755046dd202de633aea1954d80879c32ad727d9baff319ab8c106de19bcb4c0b53532314e23dd85d900f0a704d659b19bf3cd26102f3207898326a8e3fe7e60f7888b3d6d94417b794c6a730ce07e8098b859ee2df92afd1d77b319dcb07c76df1d05f9873fec0d484c2ff63dea8bb7ec51e3ab8fba7f153b3f38c33380c03074a13675e6e78b9ebd7c134c8f69142fd842b1ccebd3257acc6394ee3cd"}, @cdc_ncm={{0x6, 0x24, 0x6, 0x0, 0x1, 'X'}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0x0, 0x7, 0x5}, {0x6, 0x24, 0x1a, 0x4, 0x22}, [@mbim={0xc, 0x24, 0x1b, 0x9, 0x2, 0x6, 0x5, 0xb, 0x3}]}], [{{0x9, 0x5, 0x2, 0x10, 0x400, 0x5, 0xff, 0x81, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x8, 0x3}]}}, {{0x9, 0x5, 0x3, 0x10, 0x200, 0xac, 0x68, 0x9}}, {{0x9, 0x5, 0xc, 0x0, 0x400, 0x7, 0x4, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x6}]}}, {{0x9, 0x5, 0x9, 0x10, 0x8, 0xf, 0x7, 0x4}}, {{0x9, 0x5, 0x9, 0x3, 0x200, 0x5, 0x8, 0x5, [@generic={0xe5, 0x9, "8b1590d54ea935a30e71433437ca288f36390ee739c142e27dd4079781bf100ccb88ca96cc74a914d2e2a0dc6d6367bcdf533a2d336861ac6c835c5e44c1b1dda5640d7b9ffc542f13a4bcd775680cce704d5f0bc6bbb145dcc0e215aad9699afdf80a1e040c70e07b29ff4918239fdded03cbc0fa05515e93e0cf275073dbd5b9453c2f07102ee3a24e25f96a2006ab2686059b78d71e5886783e84f07fab2d625418adea092a037d2f7155b1128ac09af997f5a1ee6284fe97bd024807cf67ef30256b0394f1c6c92d7d148b0227c07343f08d121b3e18331ccec67f92657f54a8d8"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x4, 0x7}]}}, {{0x9, 0x5, 0x2, 0x0, 0x40, 0xd, 0xff, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x2, 0x2}]}}, {{0x9, 0x5, 0x7, 0x10, 0x10, 0x77, 0x9, 0x9}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x2, 0xa, 0x2, [@generic={0x44, 0x3, "643450b4f4c132ceaec9bf087de46ab94de38fc2f88da6c996846a824d2acbb2e11c1d1c465c54a3a9e77f58762deedcc1226f74c2c76410e0542b9af809eb20ed72"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x81, 0x7b}]}}, {{0x9, 0x5, 0x3, 0x8, 0x20, 0x10, 0x0, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x3a, 0x56}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x81, 0xfff9}]}}, {{0x9, 0x5, 0x5, 0x1, 0x0, 0x40, 0x1, 0x4d, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x7, 0x6}]}}]}}, {{0x9, 0x4, 0x26, 0x9, 0x0, 0x41, 0x33, 0x9f, 0xe8, [@uac_control={{0xa, 0x24, 0x1, 0x40, 0x12}, [@mixer_unit={0x8, 0x24, 0x4, 0x2, 0x76, "12e208"}]}, @hid_hid={0x9, 0x21, 0x7fff, 0x75, 0x1, {0x22, 0x301}}]}}]}}]}}, &(0x7f0000001280)={0xa, &(0x7f0000000c00)={0xa, 0x6, 0x200, 0xa, 0x6, 0x6, 0x20, 0xe}, 0xd1, &(0x7f0000000c40)={0x5, 0xf, 0xd1, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "aa546ca347af2b45dea372511b96663e"}, @generic={0x49, 0x10, 0xb, "d74a7d9eef0c688072daa72ecf770dd97c1d50ce68b5abe9a157153b8753516a846877b67f4ad728bb847b03c32d763796ec5e485468ff17f93574a5950e512959e59562f50a"}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "88a6cc18c4275aeb9d09826f74b12195"}, @generic={0x51, 0x10, 0x1, "e5ec6a5572f75a906817ebe7eac28cc873ebf00ec9fd561091858e6f37dcc39254052099722fac48b40b9f0e63cf30e583bafb596a6f17c49c0bc30b26b8ce58784c2bcbd679ca574bf5d33e8b00"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x6, 0x9f, 0xd, 0x1000}]}, 0x8, [{0x88, &(0x7f0000000dc0)=@string={0x88, 0x3, "d992a67f0c5ff3781fef52a9ef1dcb4fcd4271038089e653248aa9130c41bc91c08bfdc4698f4ef7f53b914608ad11a076622de88f519900bb86d456eface13b3b26c384280027a32695102d8f974fea24484c0637f40ea49e35daefd7642c10993ba52f5c5bdc2888a41e16cd625e01cdd6256c994e66aaabdbcd00e2819ed32ddda10a3c1a"}}, {0xda, &(0x7f0000000e80)=@string={0xda, 0x3, "6524c3b8d4c32b3d4e41a7d2f7b3247717d4a0932b216ce410694c4d78cdcb1a978ba1bfb98b93775f493aa559bcd487a44721cb5e663acf3fd442d8eab44d366acb782da162be1021848762cf0cf90eb7a541fc28945fa21d9d3eadaa3825ce349ca2c66c14ca44967bf18a104764eff3eb4a6478a5c0385db8f45c758329cc3bb3a31055aff74e75149f62c14768e576711cba51aae8b900d4be7ce00e2517cf6f32c956775b0cbdf74d0eee7105ec9dbb62c9cf47c24a845b7bbcada8bf05984dd69fc3cd8f9ded27828fc39f929d0448707f47779abd"}}, {0x4, &(0x7f0000000f80)=@lang_id={0x4, 0x3, 0x140c}}, {0x59, &(0x7f0000000fc0)=@string={0x59, 0x3, "cd4c7a521cee29c0499e4674207ca9b9d514bb66f39ba612d9c9d09561fee36b39d518846992ed2a471e7e0b273f1f3d895b2c6ce10b75ccf21802d61de415905a30aeb034561759954330915c623a36150e2483d47f78"}}, {0xf5, &(0x7f0000001040)=@string={0xf5, 0x3, "d0e0b024e8b5d4649a263e7daaa46bcaf0fddfdfd72d7e11eed5eb3ac4d0b4f963632a9d9c8d90ac4a8a0760cb761e2315dcfd9af9d7fe9959b4ce58b41d654d8489651af7ad2db16046c1882542f83e2526a623bad5f1bbba599bcd6eba3a9393b04ceae7119c9fbcf88cd4a2350bfb118e51fda32149f2409709563939c34a38b8a75dbe0d68b56ed6615d243f4c13fb9bd026684543daee91664772e16d8eb0685315b3f04bf824a43a7568efe0187b4726d470ca11e3e16ae51efcdbe54f22311c1f1c02fc4ab78c9b6199ae20bf4243391e91fc5a4085903613c0574b0da3762a4485d5616461f0b01401cd08d93b4af4"}}, {0x94, &(0x7f0000001140)=@string={0x94, 0x3, "0c107fa0fdb45afef4ba63070c3a7abed23b2a231be69b21bb6fb3dd0289bf117e4d4a9565475e492f15c197b49b59bb5f2f7dbd3178f52b113804bdc9bdf975bcb3d655d8994138bba17dbd53846a75f9a2ee73b171f1edf1ccaa31795de7fcf134889972d98f2fa9f19ed3c51d9302dc3ee1fe9c7ab3484b39f249137b703fbd5937397fda5ad930ad311869b7ec8e88bb"}}, {0x4, &(0x7f0000001200)=@lang_id={0x4, 0x3, 0x80c}}, {0x4, &(0x7f0000001240)=@lang_id={0x4, 0x3, 0x810}}]}) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000580)=ANY=[@ANYBLOB="380000001800dd8d0000000000000000020000000000000500000000060015000400000014001680e93e08800c0003800500010001000000"], 0x38}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) 2.699150387s ago: executing program 4 (id=5197): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r0 = socket(0x10, 0x80002, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f610500020100000005fe060c10880008000f00fff3", 0x22}], 0x1}, 0x4080) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=@ipv4_newrule={0x1c, 0x20, 0x301, 0x70bd2a, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 2.543331742s ago: executing program 0 (id=5198): sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="54000000020601040000000100000000000000000d000300686173683a6d61630000000005000500000000000c00078008001200000008000900020073797a32000000000500010007000000050004"], 0x54}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) setuid(0xee01) ioctl$IOC_PR_REGISTER(r2, 0x401870c8, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) r3 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) sendmmsg$inet(r3, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xe0}, 0xe000}], 0x68000, 0xe000) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0xefe, &(0x7f0000000340)={0x0, 0xc19a, 0x1, 0x0, 0x126}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000140)) syz_io_uring_modify_offsets$generic(r5, r6, 0x2c, 0x10000) io_uring_enter(r4, 0x2883, 0xf1bd, 0x0, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0), 0x4) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) clock_gettime(0xffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x0, 0x200008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x4c) io_uring_enter(r4, 0x7fffffe, 0x5, 0x5, 0x0, 0x0) 1.586366821s ago: executing program 3 (id=5199): sendmsg$NL80211_CMD_STOP_NAN(0xffffffffffffffff, 0x0, 0x1040) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, 0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x121c00, 0xfb) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000180)=0x6f) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81e8943c, &(0x7f0000000300)={0x0, ""/256, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000800)={0x0, 0x7, 0x1, [0x5, 0x7fffffff, 0x9, 0x10, 0x552], [0x0, 0x4, 0x3, 0x8383, 0x7f, 0x6, 0x94a, 0x0, 0x3, 0xfffffffffffffffb, 0x4, 0x2, 0xb5a, 0x1, 0x5, 0x2, 0x0, 0x4, 0xe, 0xfffffffffffffca2, 0x1, 0x8000000000000000, 0xfd75, 0x5, 0x2, 0x8, 0x2, 0x7, 0x2, 0x3, 0x5, 0xfffffffffffffff7, 0x2119, 0x4, 0x77ff, 0x6, 0x86, 0x5, 0xc1, 0x100, 0x8000, 0x9, 0x5, 0xffffffffffffffff, 0x6f, 0x7, 0xba, 0x3, 0x5, 0x53d, 0x8001, 0x1, 0x0, 0xb265, 0x6, 0x1, 0x8, 0x0, 0x4, 0xf, 0x6, 0x30000000, 0x9, 0x5, 0x6, 0x5, 0x3, 0x51a, 0xfffffffffffff801, 0xffffffff, 0xfd75, 0x3, 0xb, 0x0, 0x1, 0xd, 0x9, 0x401, 0x5, 0x7ff, 0x66d, 0x2, 0x3ff, 0xd, 0xfff, 0x2da, 0x11980266, 0x7, 0x3, 0xffe000, 0x1, 0x4, 0x20000, 0x400, 0x0, 0x8, 0xd0f, 0x2, 0x60b7, 0x9, 0xc3, 0x7, 0xb8f, 0x8, 0x1, 0x1e00000000, 0x6, 0x401, 0x6, 0x5, 0x9, 0x80000000, 0x7fffffff, 0xce, 0x4, 0x0, 0xfffffffffffffe00, 0x6, 0x400, 0x0, 0x6]}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000000c40)={{r1}, r3, 0x4, @inherit={0x60, &(0x7f0000000500)={0x1, 0x3, 0x101, 0x8, {0x22, 0xfffffffffffffff8, 0x764e, 0x6, 0x8}, [0xff, 0x9, 0xa]}}, @devid=r4}) r5 = openat$sw_sync_info(0xffffff9c, &(0x7f00000007c0), 0x800, 0x0) getsockopt$inet6_udp_int(r5, 0x11, 0x6f, 0x0, 0x0) 924.797192ms ago: executing program 5 (id=5200): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r2], 0x1c}}, 0x840) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff61a4f0ff000000002d040000000000003d400300000000006504000001ed000079130000000000006c4400000000"], 0x0}, 0x94) syz_emit_ethernet(0x5a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaac7533137cd4e1eaaaaaaaaaaaa0008004e00004c00000000000690780a010102ac1414aa070f04a976bc4b4c9e3e260cbfad990444140b01e000000100000000e000000100", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0xc014) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed88", 0x3a}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) 578.575613ms ago: executing program 5 (id=5201): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) sendto$packet(r0, 0x0, 0x0, 0x4, &(0x7f0000000180)={0x11, 0x8100, r2, 0x1, 0xe9, 0x6, @local}, 0x14) 413.440178ms ago: executing program 2 (id=5202): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB, @ANYRES32=r3], 0x1c}}, 0x840) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000030feffff720af0fff8ffffff61a4f0ff000000002d040000000000003d400300000000006504000001ed000079130000000000006c44000000000000"], 0x0}, 0x94) syz_emit_ethernet(0x5a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaac7533137cd4e1eaaaaaaaaaaaa0008004e00004c00000000000690780a010102ac1414aa070f04a976bc4b4c9e3e260cbfad990444140b01e000000100", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0xc014) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) 210.891234ms ago: executing program 5 (id=5203): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f0000000000)=""/40, 0x0, 0xc000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000002c0)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) 102.628507ms ago: executing program 4 (id=5204): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) syz_open_dev$tty20(0xc, 0x4, 0x0) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r0, 0x6068}], 0x1, 0x0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 16.56761ms ago: executing program 2 (id=5205): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newtaction={0x14, 0x30, 0x800, 0x70bd2b, 0x25dfdbfc}, 0x14}}, 0x4008800) recvmmsg$unix(r1, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000025c0)={0x9f4, 0x0, 0x8, 0x70bd2d, 0x25dfdbfd, {}, [{{0x8}, {0xc4, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1ff}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}]}}, {{0x8}, {0x100, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x74, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}]}}, {{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x54c}}, {0x8, 0x7, 0x40}}}]}}, {{0x8}, {0x254, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x9c000000}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xa}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xffffff68}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x6c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x3c, 0x4, [{0x5, 0x1, 0xff, 0x10}, {0xfe, 0x3, 0x9, 0xfee}, {0x8, 0x8, 0x6, 0x5}, {0x8, 0xe, 0x2, 0x7}, {0x0, 0x2, 0x3, 0x40}, {0x3ff, 0xe5, 0x9, 0x80}, {0x10, 0xf, 0x0, 0x2}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0xb4, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}]}}, {{0x8}, {0x258, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x159d}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7ad}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x44}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xf}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x148, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x8, 0xfe, 0x4, 0x2}, {0x7, 0x80, 0x81, 0xb446}, {0x3, 0xce, 0x9}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}]}, 0x9f4}, 0x1, 0x0, 0x0, 0x20000000}, 0x20050804) 0s ago: executing program 5 (id=5206): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x20100, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0xa, 0x1, 0x106) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x1, r2}) socket$unix(0x1, 0x1, 0x0) r3 = inotify_init() r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x2}}}, 0x108) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) close_range(r3, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 909] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.607582][T13909] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.640132][T13909] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.667864][T13909] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.801875][T13909] usb 3-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1071.918826][T13909] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 1071.939417][T17825] fuse: Unknown parameter '0x0000000000000003' [ 1071.960218][T13909] usb 3-1: SerialNumber: syz [ 1072.017592][ T8848] EXT4-fs (loop3): unmounting filesystem. [ 1072.033872][T13909] usb 3-1: config 0 descriptor?? [ 1072.080674][T13909] usb 3-1: can't set config #0, error -71 [ 1072.100862][T13909] usb 3-1: USB disconnect, device number 84 [ 1072.372286][T17834] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1072.372286][T17834] program syz.3.4379 not setting count and/or reply_len properly [ 1072.433058][T17837] blktrace: Concurrent blktraces are not allowed on sg0 [ 1072.452870][T17836] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4382'. [ 1072.484288][T17836] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4382'. [ 1072.930822][T17844] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4384'. [ 1073.729065][ T32] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1073.906923][T17859] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4389'. [ 1073.939125][ T32] usb 6-1: Using ep0 maxpacket: 16 [ 1073.947649][ T32] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1073.984769][ T32] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1074.025995][T17859] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4389'. [ 1074.034631][ T32] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1074.079972][ T32] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1074.124488][ T32] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1074.183629][ T32] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1074.241313][ T32] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1074.266075][ T32] usb 6-1: Manufacturer: syz [ 1074.293046][ T32] usb 6-1: config 0 descriptor?? [ 1074.719084][ T32] rc_core: IR keymap rc-hauppauge not found [ 1074.725073][ T32] Registered IR keymap rc-empty [ 1074.757808][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1074.810195][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1074.848194][ T32] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1074.902081][ T32] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input186 [ 1075.024443][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.070499][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.109065][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.149446][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.199062][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.229075][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.297166][T17868] fuse: Unknown parameter '0x0000000000000003' [ 1075.349025][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.389040][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.419085][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.457783][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1075.570176][ T32] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1075.624445][ T32] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1075.681263][ T32] usb 6-1: USB disconnect, device number 11 [ 1075.909210][T13909] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1076.099677][T13909] usb 3-1: Using ep0 maxpacket: 8 [ 1076.107684][T13909] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1076.147494][T13909] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1076.183435][T13909] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.255528][T13909] usb 3-1: Product: syz [ 1076.273545][T13909] usb 3-1: Manufacturer: syz [ 1076.302952][T13909] usb 3-1: SerialNumber: syz [ 1076.335026][T13909] usb 3-1: config 0 descriptor?? [ 1076.364539][T13909] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1077.325649][T17895] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4398'. [ 1078.045572][T17898] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1078.045572][T17898] program syz.4.4399 not setting count and/or reply_len properly [ 1078.072097][T17898] blktrace: Concurrent blktraces are not allowed on sg0 [ 1078.779284][T13909] gspca_zc3xx: reg_r err -32 [ 1079.370295][T17907] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4402'. [ 1079.405940][T17907] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1079.416472][T13909] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1079.572021][T13909] gspca_zc3xx: probe of 3-1:0.0 failed with error -32 [ 1080.801290][T13909] usb 3-1: USB disconnect, device number 85 [ 1080.976684][T17914] fuse: Unknown parameter '0x0000000000000003' [ 1081.046765][T17919] tipc: Enabled bearer , priority 0 [ 1081.091081][T17919] device syzkaller0 entered promiscuous mode [ 1081.112725][T17919] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1081.180419][T17919] tipc: Resetting bearer [ 1081.216362][T17916] tipc: Resetting bearer [ 1081.269340][T17916] tipc: Disabling bearer [ 1081.349107][ T4362] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1081.549029][ T4362] usb 4-1: Using ep0 maxpacket: 32 [ 1081.557855][ T4362] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1081.603931][ T32] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1081.929191][ T32] usb 6-1: Using ep0 maxpacket: 16 [ 1082.073397][ T32] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1082.086343][ T32] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1082.095613][ T4362] usb 4-1: config 33 has an invalid interface number: 3 but max is 0 [ 1082.138356][ T4362] usb 4-1: config 33 has no interface number 0 [ 1082.155248][ T4362] usb 4-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1082.175477][ T4362] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1082.189011][ T32] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1082.265115][ T32] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1082.412177][T17932] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4410'. [ 1082.509277][T17917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1082.511946][ T32] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1082.539636][T17917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1082.569861][ T32] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1082.583229][T17917] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4406'. [ 1082.592522][ T32] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1082.604850][ T32] usb 6-1: Manufacturer: syz [ 1082.938555][ T32] usb 6-1: config 0 descriptor?? [ 1082.940096][ T4362] usb 4-1: string descriptor 0 read error: -71 [ 1083.004482][ T4362] ftdi_sio 4-1:33.3: FTDI USB Serial Device converter detected [ 1083.053547][ T4362] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1083.082254][ T4362] usb 4-1: USB disconnect, device number 10 [ 1083.134623][ T4362] ftdi_sio 4-1:33.3: device disconnected [ 1083.357471][T17941] random: crng reseeded on system resumption [ 1085.078957][ T32] rc_core: IR keymap rc-hauppauge not found [ 1085.084932][ T32] Registered IR keymap rc-empty [ 1085.189591][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1085.219064][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1085.985076][ T32] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1086.007577][ T32] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input187 [ 1086.098038][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.389024][ T4372] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1086.509391][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.539133][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.569128][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.599113][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.629964][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.659024][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.669073][ T4372] usb 4-1: Using ep0 maxpacket: 8 [ 1086.676356][ T4372] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1086.710995][ T4372] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1086.736281][ T4372] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.736298][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.759058][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.759273][ T4372] usb 4-1: Product: syz [ 1086.801430][ T4372] usb 4-1: Manufacturer: syz [ 1086.912312][ T4372] usb 4-1: SerialNumber: syz [ 1086.949233][ T32] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1086.974054][ T4372] usb 4-1: config 0 descriptor?? [ 1087.154254][ T4372] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1087.210140][ T32] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1087.422729][ T32] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1087.696790][ T32] usb 6-1: USB disconnect, device number 12 [ 1088.526348][T18042] syz.4.4416 (18042): drop_caches: 1 [ 1089.012096][T18042] syz.4.4416 (18042): drop_caches: 1 [ 1089.173801][ T4372] gspca_zc3xx: reg_r err -32 [ 1089.234401][T18047] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1089.234401][T18047] program syz.4.4419 not setting count and/or reply_len properly [ 1089.256773][T18049] fuse: Unknown parameter 'fd0x0000000000000003' [ 1089.271837][T18047] blktrace: Concurrent blktraces are not allowed on sg0 [ 1089.798963][ T4372] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1089.807481][ T4372] gspca_zc3xx: probe of 4-1:0.0 failed with error -32 [ 1090.273341][T18059] syz.5.4422 (18059): drop_caches: 1 [ 1090.594585][T16900] usb 4-1: USB disconnect, device number 11 [ 1091.490739][T18059] syz.5.4422 (18059): drop_caches: 1 [ 1092.067127][T18078] syz.4.4427 (18078): drop_caches: 1 [ 1092.853999][T18078] syz.4.4427 (18078): drop_caches: 1 [ 1093.234689][T18094] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4431'. [ 1094.268028][T18100] fuse: Unknown parameter 'fd0x0000000000000003' [ 1096.655840][T18112] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(4) [ 1096.662504][T18112] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1096.679140][T16825] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1096.729913][T18112] vhci_hcd vhci_hcd.0: Device attached [ 1096.755540][T18117] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1096.755540][T18117] program syz.3.4438 not setting count and/or reply_len properly [ 1096.821150][T18117] blktrace: Concurrent blktraces are not allowed on sg0 [ 1096.869032][T16825] usb 3-1: Using ep0 maxpacket: 8 [ 1096.875924][T16825] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1096.958464][T16825] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1096.986431][T16825] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1096.999014][T16900] usb 43-1: new low-speed USB device number 3 using vhci_hcd [ 1097.006241][T16825] usb 3-1: Product: syz [ 1097.078354][T16825] usb 3-1: Manufacturer: syz [ 1097.150625][T16825] usb 3-1: SerialNumber: syz [ 1097.211507][T16825] usb 3-1: config 0 descriptor?? [ 1097.304612][T16825] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1097.365673][T16825] gspca_zc3xx: reg_w_i err -71 [ 1097.541080][T18113] vhci_hcd: connection reset by peer [ 1097.546715][T13072] vhci_hcd: stop threads [ 1097.551112][T13072] vhci_hcd: release socket [ 1097.582233][T13072] vhci_hcd: disconnect device [ 1097.998951][T16825] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1098.005292][T16825] gspca_zc3xx: probe of 3-1:0.0 failed with error -71 [ 1098.100178][T16825] usb 3-1: USB disconnect, device number 86 [ 1098.808723][T18133] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4444'. [ 1098.827631][T18133] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1100.429970][T18138] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4445'. [ 1100.765719][T18147] fuse: Unknown parameter 'fd0x0000000000000003' [ 1100.999346][ T32] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 1101.210507][ T32] usb 1-1: Using ep0 maxpacket: 8 [ 1101.564713][T18155] syz.3.4452 (18155): drop_caches: 1 [ 1102.137133][ T32] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1102.169108][T16900] vhci_hcd: vhci_device speed not set [ 1102.194717][ T32] usb 1-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1102.228518][ T32] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1102.271102][ T32] usb 1-1: Product: syz [ 1102.285624][ T32] usb 1-1: Manufacturer: syz [ 1102.307489][ T32] usb 1-1: SerialNumber: syz [ 1102.352371][ T32] usb 1-1: config 0 descriptor?? [ 1102.377579][T18158] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1102.377579][T18158] program syz.2.4453 not setting count and/or reply_len properly [ 1102.412365][ T32] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1102.462508][T18159] blktrace: Concurrent blktraces are not allowed on sg0 [ 1102.498485][T18155] syz.3.4452 (18155): drop_caches: 1 [ 1102.732346][T18161] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4454'. [ 1103.548543][T18170] device bridge1 entered promiscuous mode [ 1103.960531][T18173] loop2: detected capacity change from 0 to 2048 [ 1104.035031][T18173] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 1104.665469][T18173] ext4 filesystem being mounted at /263/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1104.856929][T18182] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4458'. [ 1105.534756][ T32] gspca_zc3xx: reg_r err -32 [ 1105.808901][T12743] EXT4-fs (loop2): unmounting filesystem. [ 1106.158995][ T32] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1107.013045][ T32] gspca_zc3xx: probe of 1-1:0.0 failed with error -32 [ 1107.407473][ T4372] usb 1-1: USB disconnect, device number 83 [ 1107.625990][T18188] syz.5.4461 (18188): drop_caches: 1 [ 1107.994686][T18188] syz.5.4461 (18188): drop_caches: 1 [ 1108.462051][T18195] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4462'. [ 1110.131680][T18200] virt_wifi0 speed is unknown, defaulting to 1000 [ 1110.138730][T18200] lo speed is unknown, defaulting to 1000 [ 1110.875821][T18205] virt_wifi0 speed is unknown, defaulting to 1000 [ 1110.885056][T18205] lo speed is unknown, defaulting to 1000 [ 1112.684870][T18225] syz.0.4470 (18225): drop_caches: 1 [ 1113.340820][T18225] syz.0.4470 (18225): drop_caches: 1 [ 1113.639055][ T32] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1113.969052][ T32] usb 5-1: Using ep0 maxpacket: 8 [ 1113.983003][ T32] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1113.998506][ T32] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1114.007839][ T32] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1114.015983][ T32] usb 5-1: Product: syz [ 1114.020431][ T32] usb 5-1: Manufacturer: syz [ 1114.025123][ T32] usb 5-1: SerialNumber: syz [ 1114.497661][ T32] usb 5-1: config 0 descriptor?? [ 1114.553709][ T32] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1114.748982][ T3598] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 1114.949325][ T3598] usb 1-1: Using ep0 maxpacket: 32 [ 1114.957514][ T3598] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1115.014835][ T3598] usb 1-1: config 33 has an invalid interface number: 3 but max is 0 [ 1115.033256][ T3598] usb 1-1: config 33 has no interface number 0 [ 1115.041116][ T3598] usb 1-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1115.104231][ T3598] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1115.374816][T18236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1115.390380][T18236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1115.574586][T18236] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4475'. [ 1115.614485][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.639911][T18263] virt_wifi0 speed is unknown, defaulting to 1000 [ 1115.646956][T18263] lo speed is unknown, defaulting to 1000 [ 1115.751339][ T3598] usb 1-1: string descriptor 0 read error: -71 [ 1115.762079][ T3598] ftdi_sio 1-1:33.3: FTDI USB Serial Device converter detected [ 1115.782598][ T3598] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1115.814863][ T3598] usb 1-1: USB disconnect, device number 84 [ 1115.836459][ T3598] ftdi_sio 1-1:33.3: device disconnected [ 1116.509251][ T7] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1116.718949][ T7] usb 6-1: device descriptor read/64, error -71 [ 1116.795103][T18272] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4480'. [ 1116.993451][ T7] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1117.549119][ T7] usb 6-1: device descriptor read/64, error -71 [ 1117.596505][ T32] gspca_zc3xx: reg_r err -32 [ 1117.669223][ T7] usb usb6-port1: attempt power cycle [ 1118.089235][ T7] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1118.176857][ T7] usb 6-1: device descriptor read/8, error -71 [ 1118.218963][ T32] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1118.225399][ T32] gspca_zc3xx: probe of 5-1:0.0 failed with error -32 [ 1118.506459][T18291] syz.3.4484 (18291): drop_caches: 1 [ 1118.569407][ T7] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1118.640457][ T7] usb 6-1: device descriptor read/8, error -71 [ 1118.879513][ T7] usb usb6-port1: unable to enumerate USB device [ 1119.009509][ T7] usb 5-1: USB disconnect, device number 85 [ 1121.277488][T18291] syz.3.4484 (18291): drop_caches: 1 [ 1121.660794][T18317] binder: 18316:18317 unknown command 1074553619 [ 1121.667210][T18317] binder: 18316:18317 ioctl c0306201 200000000440 returned -22 [ 1122.930270][T13515] Bluetooth: hci0: command 0x0406 tx timeout [ 1123.258952][ T7] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1123.748942][ T7] usb 5-1: Using ep0 maxpacket: 32 [ 1123.756712][ T7] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1124.192292][ T7] usb 5-1: config 33 has an invalid interface number: 3 but max is 0 [ 1124.200683][ T7] usb 5-1: config 33 has no interface number 0 [ 1124.218300][ T7] usb 5-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1124.230338][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1124.525850][T18337] random: crng reseeded on system resumption [ 1126.470791][ T7] usb 5-1: string descriptor 0 read error: -71 [ 1126.494703][ T7] ftdi_sio 5-1:33.3: FTDI USB Serial Device converter detected [ 1126.628291][ T7] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1126.774368][ T7] usb 5-1: USB disconnect, device number 86 [ 1126.981899][ T7] ftdi_sio 5-1:33.3: device disconnected [ 1128.539221][T13909] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 1128.559127][ T7] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1128.739538][T13909] usb 6-1: device descriptor read/64, error -71 [ 1128.769419][ T7] usb 5-1: Using ep0 maxpacket: 8 [ 1128.798645][ T7] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1128.887689][ T7] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1128.939137][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1128.970692][ T7] usb 5-1: Product: syz [ 1128.986844][ T7] usb 5-1: Manufacturer: syz [ 1129.017779][ T7] usb 5-1: SerialNumber: syz [ 1129.049296][T13909] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1129.085289][ T7] usb 5-1: config 0 descriptor?? [ 1129.172520][ T7] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1129.239239][T13909] usb 6-1: device descriptor read/64, error -71 [ 1129.369660][T13909] usb usb6-port1: attempt power cycle [ 1129.779182][T13909] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1129.872765][T13909] usb 6-1: device descriptor read/8, error -71 [ 1130.605811][T13909] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1131.050100][ T7] gspca_zc3xx: reg_w_i err -110 [ 1132.239597][T13909] usb 6-1: device descriptor read/8, error -71 [ 1132.370110][T13909] usb usb6-port1: unable to enumerate USB device [ 1132.743001][T18416] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4503'. [ 1132.813927][T18421] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1132.859084][ T7] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1133.005712][ T7] gspca_zc3xx: probe of 5-1:0.0 failed with error -110 [ 1133.499102][T18418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4504'. [ 1133.933343][T18423] syz.2.4505 (18423): drop_caches: 1 [ 1134.252444][T18423] syz.2.4505 (18423): drop_caches: 1 [ 1134.394914][T18418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4504'. [ 1134.409030][ T7] usb 5-1: USB disconnect, device number 87 [ 1134.755811][T18430] loop5: detected capacity change from 0 to 2048 [ 1135.819893][T18430] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1135.920695][T18430] ext4 filesystem being mounted at /96/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1136.003684][T18431] syz.3.4507 (18431): drop_caches: 1 [ 1136.371587][T18444] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4510'. [ 1136.651981][T18447] loop0: detected capacity change from 0 to 2048 [ 1136.703281][T18447] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 1136.721559][T18447] ext4 filesystem being mounted at /210/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1137.575967][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1137.617665][T13514] EXT4-fs (loop0): unmounting filesystem. [ 1137.641593][T18455] binder: 18448:18455 ioctl c0306201 0 returned -14 [ 1137.779192][ T7] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1137.961786][ T7] usb 5-1: device descriptor read/64, error -71 [ 1138.029066][T13909] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1138.278958][T13909] usb 6-1: Using ep0 maxpacket: 8 [ 1138.285621][T13909] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1138.380018][ T7] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1138.677054][T13909] usb 6-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1138.687235][T13909] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.700360][T13909] usb 6-1: Product: syz [ 1138.704540][T13909] usb 6-1: Manufacturer: syz [ 1138.709963][T13909] usb 6-1: SerialNumber: syz [ 1138.739638][T13909] usb 6-1: config 0 descriptor?? [ 1138.778437][T13909] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1138.829023][ T7] usb 5-1: device descriptor read/64, error -71 [ 1138.969326][ T7] usb usb5-port1: attempt power cycle [ 1139.047666][T18478] random: crng reseeded on system resumption [ 1139.299340][T13909] gspca_zc3xx: reg_w_i err -110 [ 1140.599051][ T7] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1140.669370][ T7] usb 5-1: device descriptor read/8, error -71 [ 1140.698904][T13909] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1140.713133][T13909] gspca_zc3xx: probe of 6-1:0.0 failed with error -110 [ 1141.627684][ T4319] usb 6-1: USB disconnect, device number 21 [ 1141.812270][T18529] loop0: detected capacity change from 0 to 2048 [ 1141.914310][T18529] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 1141.972486][T18529] ext4 filesystem being mounted at /213/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1142.185899][T18536] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4522'. [ 1143.039469][T18543] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4526'. [ 1143.428407][T18541] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4525'. [ 1143.451488][T18546] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1143.921209][T13514] EXT4-fs (loop0): unmounting filesystem. [ 1145.401575][T18563] tipc: Enabled bearer , priority 0 [ 1145.440209][T18563] device syzkaller0 entered promiscuous mode [ 1145.459564][T18563] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1145.474797][ T4283] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1145.485337][ T4283] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1145.495069][ T4287] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1145.511110][ T4287] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1145.519671][ T4287] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1145.526909][ T4287] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1145.583217][T18563] tipc: Resetting bearer [ 1145.614447][T18566] virt_wifi0 speed is unknown, defaulting to 1000 [ 1145.621761][T18562] tipc: Resetting bearer [ 1145.670505][T18562] tipc: Disabling bearer [ 1145.693002][T18566] lo speed is unknown, defaulting to 1000 [ 1145.809032][ T4319] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 1146.038951][ T4319] usb 3-1: Using ep0 maxpacket: 8 [ 1146.808102][ T4319] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1146.829794][ T4319] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1146.849077][ T4319] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1146.857107][ T4319] usb 3-1: Product: syz [ 1146.878918][ T4319] usb 3-1: Manufacturer: syz [ 1146.901772][ T4319] usb 3-1: SerialNumber: syz [ 1146.927643][ T4319] usb 3-1: config 0 descriptor?? [ 1146.937141][ T4319] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1147.609055][T13515] Bluetooth: hci3: command 0x0409 tx timeout [ 1147.659269][ T4319] gspca_zc3xx: reg_w_i err -110 [ 1147.946622][T18585] loop0: detected capacity change from 0 to 2048 [ 1148.068053][T18566] chnl_net:caif_netlink_parms(): no params data found [ 1148.084426][T18585] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 1148.099012][T18585] ext4 filesystem being mounted at /216/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1148.519135][ T4319] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1148.525906][ T4319] gspca_zc3xx: probe of 3-1:0.0 failed with error -110 [ 1148.929854][T18598] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4536'. [ 1149.205010][T16900] usb 3-1: USB disconnect, device number 87 [ 1149.528279][T18566] bridge0: port 1(bridge_slave_0) entered blocking state [ 1149.607441][T18607] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4539'. [ 1149.667406][T18606] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4541'. [ 1149.690026][T13515] Bluetooth: hci3: command 0x041b tx timeout [ 1149.699108][T18566] bridge0: port 1(bridge_slave_0) entered disabled state [ 1149.717669][T18566] device bridge_slave_0 entered promiscuous mode [ 1149.808492][T18566] bridge0: port 2(bridge_slave_1) entered blocking state [ 1149.845320][T18566] bridge0: port 2(bridge_slave_1) entered disabled state [ 1149.994805][T18566] device bridge_slave_1 entered promiscuous mode [ 1150.074845][T18566] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1150.093898][T18566] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1150.165845][T18566] team0: Port device team_slave_0 added [ 1150.195668][T18566] team0: Port device team_slave_1 added [ 1150.209115][T18612] loop5: detected capacity change from 0 to 2048 [ 1150.283410][T13514] EXT4-fs (loop0): unmounting filesystem. [ 1150.295112][T18566] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1150.323241][T18612] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1150.434597][T18566] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1150.479963][T18612] ext4 filesystem being mounted at /104/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1150.569898][T18566] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1150.609212][T18566] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1150.648715][T18566] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1151.198915][T18566] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1151.306365][T18620] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4540'. [ 1151.417832][T18566] device hsr_slave_0 entered promiscuous mode [ 1151.447211][T18566] device hsr_slave_1 entered promiscuous mode [ 1151.487145][T18566] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1151.577363][T18566] Cannot create hsr debugfs directory [ 1151.597944][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1151.769073][T13515] Bluetooth: hci3: command 0x040f tx timeout [ 1152.282732][T18628] syz.2.4545 (18628): drop_caches: 1 [ 1152.939714][T18638] random: crng reseeded on system resumption [ 1153.848960][T13515] Bluetooth: hci3: command 0x0419 tx timeout [ 1156.708680][T18628] syz.2.4545 (18628): drop_caches: 1 [ 1158.845223][T18566] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1159.067965][T18566] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1159.149356][ T7] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1159.359130][ T7] usb 3-1: Using ep0 maxpacket: 8 [ 1159.370047][ T7] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1159.462515][ T7] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1159.646381][T18707] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4552'. [ 1159.784460][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1159.804651][ T7] usb 3-1: Product: syz [ 1159.814762][ T7] usb 3-1: Manufacturer: syz [ 1159.901300][ T7] usb 3-1: SerialNumber: syz [ 1159.962986][ T7] usb 3-1: config 0 descriptor?? [ 1159.975292][ T7] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1160.104317][T18566] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1160.283491][T18566] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1161.474594][T18566] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1161.505578][T18566] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1161.518615][T18566] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1161.528604][T18566] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1162.813579][T18566] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1163.097248][ T7] gspca_zc3xx: reg_r err -32 [ 1163.137705][T18730] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4558'. [ 1163.150032][T17993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1163.166030][T17993] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1163.200343][T18566] 8021q: adding VLAN 0 to HW filter on device team0 [ 1163.720489][ T7] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1163.748757][ T7] gspca_zc3xx: probe of 3-1:0.0 failed with error -32 [ 1163.758094][T14639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1163.772623][T14639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1163.787096][T14639] bridge0: port 1(bridge_slave_0) entered blocking state [ 1163.794276][T14639] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1163.864340][T14639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1163.876282][T14639] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1163.894893][T14639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1163.944462][T14639] bridge0: port 2(bridge_slave_1) entered blocking state [ 1163.951663][T14639] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1163.975978][ T8401] usb 3-1: USB disconnect, device number 88 [ 1164.043321][T14639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1164.108555][T14387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1164.130108][T14387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1164.169872][T14387] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1164.198134][T14387] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1164.217250][T14387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1164.243629][T14387] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1164.327984][T18752] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4563'. [ 1164.369619][T14387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1164.452849][T14387] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1164.539883][T18752] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1164.572145][T14990] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1164.580344][ T8401] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 1164.625899][T14990] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1164.723405][T18566] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1165.204170][ T8401] usb 3-1: device descriptor read/64, error -71 [ 1165.479219][ T8401] usb 3-1: new high-speed USB device number 90 using dummy_hcd syzkaller syzkaller login: [ 1165.669138][ T8401] usb 3-1: device descriptor read/64, error -71 [ 1165.799705][ T8401] usb usb3-port1: attempt power cycle [ 1166.271800][ T8401] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1166.320869][ T8401] usb 3-1: device descriptor read/8, error -71 [ 1166.437786][T18772] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4570'. [ 1166.609103][ T8401] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1166.658510][ T8401] usb 3-1: device descriptor read/8, error -71 [ 1166.804177][ T8401] usb usb3-port1: unable to enumerate USB device [ 1167.675841][T11487] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1167.692011][T11487] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1167.736139][T18566] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1167.845808][T13072] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1167.907075][T13072] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1167.969040][T16825] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1167.994629][T18566] device veth0_vlan entered promiscuous mode [ 1168.052775][T13072] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1168.111954][T13072] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1168.159445][T13072] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1168.189087][T16825] usb 6-1: Using ep0 maxpacket: 8 [ 1168.197283][T16825] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1168.227852][T13072] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1168.232330][T18786] syz.4.4575 (18786): drop_caches: 1 [ 1168.251471][T16825] usb 6-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1168.274523][T18566] device veth1_vlan entered promiscuous mode [ 1168.293513][T16825] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1168.334836][T16825] usb 6-1: Product: syz [ 1168.356237][T16825] usb 6-1: Manufacturer: syz [ 1168.374312][T17989] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1168.385946][T17989] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1168.398262][T16825] usb 6-1: SerialNumber: syz [ 1168.416976][T17989] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1168.447726][T16825] usb 6-1: config 0 descriptor?? [ 1168.470586][T16825] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1168.479231][T17989] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1168.522267][T18566] device veth0_macvtap entered promiscuous mode [ 1168.593368][T18566] device veth1_macvtap entered promiscuous mode [ 1168.606390][T18786] syz.4.4575 (18786): drop_caches: 1 [ 1168.698572][ T9305] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1168.716064][ T9305] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1168.767525][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1168.828298][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1168.844273][T18793] loop0: detected capacity change from 0 to 2048 [ 1168.858994][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1168.870183][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1168.890071][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1168.902279][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1168.912726][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1168.915025][T18793] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 1168.924554][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1168.963207][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1169.006653][T18793] ext4 filesystem being mounted at /226/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1169.068044][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1169.599517][T16825] gspca_zc3xx: reg_w_i err -110 [ 1169.638674][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1169.659996][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1169.673807][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1169.684429][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1169.706316][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1169.751600][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1169.777586][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1169.802028][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1169.838423][T18566] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1169.867686][T18800] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4577'. [ 1169.886492][T18045] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1169.915113][T18045] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1169.956187][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1169.984076][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.008613][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1170.036019][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.058320][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1170.077741][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.087835][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1170.105313][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.115292][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1170.131859][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.145479][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1170.164458][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.176677][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1170.189051][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.199551][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1170.215260][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.227349][T18566] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1170.229164][T16825] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1170.238179][T18566] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1170.259724][T13514] EXT4-fs (loop0): unmounting filesystem. [ 1170.292105][T18566] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1170.295779][T16825] gspca_zc3xx: probe of 6-1:0.0 failed with error -110 [ 1170.342440][T17993] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1170.362757][T17993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1170.383822][T18566] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1170.397649][T18566] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1170.408199][T18566] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1170.423391][T18566] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1170.623543][T17993] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1170.637420][T17993] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1170.661378][ T9305] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1170.722745][T11369] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1170.739975][T11369] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1170.769818][T12443] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1170.781589][T16825] usb 6-1: USB disconnect, device number 22 [ 1170.866495][T18808] loop0: detected capacity change from 0 to 2048 [ 1171.027517][T18808] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 1171.112479][T18808] ext4 filesystem being mounted at /227/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1171.252719][T18817] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4579'. [ 1172.321431][T13514] EXT4-fs (loop0): unmounting filesystem. [ 1172.584721][T18831] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1172.584721][T18831] program syz.0.4585 not setting count and/or reply_len properly [ 1172.653664][T18834] blktrace: Concurrent blktraces are not allowed on sg0 [ 1172.699041][ T8401] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1172.906990][ T8401] usb 6-1: Using ep0 maxpacket: 16 [ 1172.914048][ T8401] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1172.938366][ T8401] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1173.001084][ T8401] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1173.027131][ T8401] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1173.051509][ T8401] usb 6-1: Manufacturer: syz [ 1173.146591][ T8401] usb 6-1: config 0 descriptor?? [ 1173.773139][T18836] syz.4.4587 (18836): drop_caches: 1 [ 1174.178935][ T4319] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1174.419137][ T4319] usb 3-1: Using ep0 maxpacket: 8 [ 1174.440588][ T4319] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1174.506798][ T4319] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1174.517387][ T4319] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1174.530547][ T4319] usb 3-1: Product: syz [ 1174.535163][ T4319] usb 3-1: Manufacturer: syz [ 1174.544305][ T4319] usb 3-1: SerialNumber: syz [ 1174.565735][ T4319] usb 3-1: config 0 descriptor?? [ 1174.575463][ T4319] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1175.499455][ T8401] usb 6-1: USB disconnect, device number 23 [ 1176.119561][ T4319] gspca_zc3xx: reg_w_i err -110 [ 1176.738957][ T4319] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1176.745811][ T4319] gspca_zc3xx: probe of 3-1:0.0 failed with error -110 [ 1176.940208][T18883] binder: 18882:18883 ioctl 4018620d 0 returned -22 [ 1177.053326][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 1178.288328][ T4319] usb 3-1: USB disconnect, device number 93 [ 1178.462297][T18895] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1178.462297][T18895] program syz.2.4603 not setting count and/or reply_len properly [ 1178.568176][T18895] blktrace: Concurrent blktraces are not allowed on sg0 [ 1180.908943][T16900] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1181.489006][T16900] usb 4-1: Using ep0 maxpacket: 16 [ 1181.496002][T16900] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1181.530347][T16900] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1181.582356][T16900] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1181.609155][T16900] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1181.641416][T16900] usb 4-1: Manufacturer: syz [ 1181.659692][T16900] usb 4-1: config 0 descriptor?? [ 1181.708613][T18925] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4612'. [ 1181.745512][T18925] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4612'. [ 1181.969997][T18932] loop5: detected capacity change from 0 to 2048 [ 1182.024667][T18932] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1182.040269][T18932] ext4 filesystem being mounted at /122/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1182.098963][ T4372] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1182.212267][T18936] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4614'. [ 1182.348923][ T4372] usb 5-1: Using ep0 maxpacket: 8 [ 1182.385885][ T4372] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1182.694282][ T4372] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1182.713513][ T4372] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1182.736141][ T4372] usb 5-1: Product: syz [ 1182.773171][ T4372] usb 5-1: Manufacturer: syz [ 1182.788144][ T4372] usb 5-1: SerialNumber: syz [ 1182.815075][ T4372] usb 5-1: config 0 descriptor?? [ 1182.834279][ T4372] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1183.426113][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1183.568564][ T3598] usb 4-1: USB disconnect, device number 12 [ 1185.587658][T18959] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 1185.606399][T18957] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1185.606399][T18957] program syz.2.4619 not setting count and/or reply_len properly [ 1185.671578][T18957] blktrace: Concurrent blktraces are not allowed on sg0 [ 1185.694706][ T4372] gspca_zc3xx: reg_r err -32 [ 1186.318909][ T4372] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1186.344353][ T4372] gspca_zc3xx: probe of 5-1:0.0 failed with error -32 [ 1186.799509][ T4323] usb 5-1: USB disconnect, device number 92 [ 1187.015625][T18969] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4622'. [ 1187.083131][T18970] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1188.989081][ T4323] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1189.239089][ T4323] usb 5-1: Using ep0 maxpacket: 32 [ 1189.255350][ T4323] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1189.299204][ T4323] usb 5-1: config 33 has an invalid interface number: 3 but max is 0 [ 1189.345037][ T4323] usb 5-1: config 33 has no interface number 0 [ 1189.381064][ T4323] usb 5-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1189.425547][ T4323] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1189.648736][T18989] vivid-001: disconnect [ 1191.377157][T18986] vivid-001: reconnect [ 1191.451361][T18974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1191.519280][T18974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1191.544047][T18974] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4623'. [ 1191.568287][ T4323] usb 5-1: string descriptor 0 read error: -71 [ 1191.581092][ T4323] ftdi_sio 5-1:33.3: FTDI USB Serial Device converter detected [ 1191.591314][ T4323] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1191.619890][ T4323] usb 5-1: USB disconnect, device number 93 [ 1192.513493][T18985] syz.3.4626 (18985): drop_caches: 1 [ 1192.538943][ T4323] ftdi_sio 5-1:33.3: device disconnected [ 1194.670539][T19015] random: crng reseeded on system resumption [ 1198.205555][T19087] random: crng reseeded on system resumption [ 1200.898978][ T4372] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1201.089662][ T4372] usb 5-1: Using ep0 maxpacket: 32 [ 1201.103492][ T4372] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1201.143610][ T4372] usb 5-1: config 33 has an invalid interface number: 3 but max is 0 [ 1201.234791][ T4372] usb 5-1: config 33 has no interface number 0 [ 1201.252978][ T4372] usb 5-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1201.310551][ T4372] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1201.883268][T19148] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4645'. [ 1201.949632][T19152] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1202.505564][T19138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1202.619093][T19138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1202.679671][T19138] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4642'. [ 1202.751328][ T4372] usb 5-1: string descriptor 0 read error: -71 [ 1202.761267][ T4372] ftdi_sio 5-1:33.3: FTDI USB Serial Device converter detected [ 1202.800341][ T4372] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1202.853183][ T4372] usb 5-1: USB disconnect, device number 94 [ 1203.721325][ T4372] ftdi_sio 5-1:33.3: device disconnected [ 1205.401434][T19183] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 1206.738229][T19203] loop4: detected capacity change from 0 to 2048 [ 1207.280158][T19211] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1207.304009][T19203] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 1207.314140][T19203] ext4 filesystem being mounted at /273/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1207.424342][T19215] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4659'. [ 1209.021239][T13342] EXT4-fs (loop4): unmounting filesystem. [ 1209.558943][ T32] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1209.748950][ T32] usb 4-1: Using ep0 maxpacket: 8 [ 1209.756009][ T32] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1209.807882][ T32] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1209.843047][ T32] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1209.875217][ T32] usb 4-1: Product: syz [ 1209.893897][ T32] usb 4-1: Manufacturer: syz [ 1209.913721][ T32] usb 4-1: SerialNumber: syz [ 1209.956424][ T32] usb 4-1: config 0 descriptor?? [ 1209.975694][ T32] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1210.918450][T19236] virt_wifi0 speed is unknown, defaulting to 1000 [ 1210.926711][T19236] lo speed is unknown, defaulting to 1000 [ 1211.467954][T19243] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4669'. [ 1211.790893][ T32] gspca_zc3xx: reg_w_i err -110 [ 1212.438970][ T32] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1212.527157][ T32] gspca_zc3xx: probe of 4-1:0.0 failed with error -110 [ 1212.855328][ T32] usb 4-1: USB disconnect, device number 13 [ 1213.695560][T19261] vivid-002: disconnect [ 1215.012920][T19257] vivid-002: reconnect [ 1216.459330][T19277] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4677'. [ 1217.721168][T19285] virt_wifi0 speed is unknown, defaulting to 1000 [ 1217.728226][T19285] lo speed is unknown, defaulting to 1000 [ 1218.459079][ T4319] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1218.499094][ T32] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1218.639014][T19314] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4686'. [ 1218.658943][ T4319] usb 5-1: Using ep0 maxpacket: 8 [ 1218.698983][ T32] usb 6-1: Using ep0 maxpacket: 32 [ 1218.706151][ T32] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1218.724432][ T4319] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1218.744262][ T32] usb 6-1: config 33 has an invalid interface number: 3 but max is 0 [ 1218.772400][ T4319] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1218.787465][ T32] usb 6-1: config 33 has no interface number 0 [ 1218.813068][ T32] usb 6-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1218.824337][ T4319] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1218.851937][ T4319] usb 5-1: Product: syz [ 1218.856792][ T32] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1218.865872][ T4319] usb 5-1: Manufacturer: syz [ 1218.886061][ T4319] usb 5-1: SerialNumber: syz [ 1218.956050][ T4319] usb 5-1: config 0 descriptor?? [ 1218.979560][ T4319] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1219.899652][T19300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1219.972562][T19300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1220.042844][T19300] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4682'. [ 1220.203219][ T32] usb 6-1: string descriptor 0 read error: -71 [ 1220.216248][ T32] ftdi_sio 6-1:33.3: FTDI USB Serial Device converter detected [ 1220.257780][ T32] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1220.319003][ T32] usb 6-1: USB disconnect, device number 24 [ 1220.341549][ T32] ftdi_sio 6-1:33.3: device disconnected [ 1221.656204][T19338] syz.0.4691 (19338): drop_caches: 1 [ 1222.258301][T19345] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4693'. [ 1222.709310][T19349] virt_wifi0 speed is unknown, defaulting to 1000 [ 1222.716489][T19349] lo speed is unknown, defaulting to 1000 [ 1222.810053][ T4319] gspca_zc3xx: reg_r err -32 [ 1222.824994][T19338] syz.0.4691 (19338): drop_caches: 1 [ 1223.429021][ T4319] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1223.441797][ T4319] gspca_zc3xx: probe of 5-1:0.0 failed with error -32 [ 1224.350692][ T4319] usb 5-1: USB disconnect, device number 95 [ 1225.870853][T19389] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4705'. [ 1226.446062][T19392] virt_wifi0 speed is unknown, defaulting to 1000 [ 1226.453196][T19392] lo speed is unknown, defaulting to 1000 [ 1226.983759][T19400] random: crng reseeded on system resumption [ 1229.028780][T19404] syz.3.4708 (19404): drop_caches: 1 [ 1229.339102][ T7] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 1229.549025][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 1229.558389][ T7] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1230.350734][ T7] usb 1-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1230.396210][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1230.416233][ T7] usb 1-1: Product: syz [ 1230.427755][ T7] usb 1-1: Manufacturer: syz [ 1230.457948][ T7] usb 1-1: SerialNumber: syz [ 1230.489000][T16900] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1230.497258][ T7] usb 1-1: config 0 descriptor?? [ 1230.514912][ T7] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1230.609140][T19470] binder: 19469:19470 unknown command 1074553619 [ 1230.623432][T19470] binder: 19469:19470 ioctl c0306201 200000000440 returned -22 [ 1230.699314][T16900] usb 6-1: Using ep0 maxpacket: 16 [ 1230.723455][T16900] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1230.742578][T16900] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1230.763096][T16900] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1230.799434][T16900] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1230.808581][T16900] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1230.945671][T16900] usb 6-1: Manufacturer: syz [ 1231.071509][T16900] usb 6-1: config 0 descriptor?? [ 1231.906477][T19480] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4719'. [ 1231.994130][T19480] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4719'. [ 1232.567516][T19493] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4721'. [ 1232.874883][ T32] usb 6-1: USB disconnect, device number 25 [ 1233.589306][ T7] gspca_zc3xx: reg_r err -110 [ 1233.875319][T19503] syz.4.4723 (19503): drop_caches: 1 [ 1234.433516][ T7] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1234.456825][ T7] gspca_zc3xx: probe of 1-1:0.0 failed with error -110 [ 1234.490236][ T7] usb 1-1: USB disconnect, device number 85 [ 1235.482356][T19503] syz.4.4723 (19503): drop_caches: 1 [ 1235.635291][T19519] device bridge1 entered promiscuous mode [ 1235.787308][T19525] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4730'. [ 1235.834061][T19525] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4730'. [ 1236.005555][T19527] virt_wifi0 speed is unknown, defaulting to 1000 [ 1236.889547][T19527] lo speed is unknown, defaulting to 1000 [ 1238.491157][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.498945][T13909] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1238.519685][ T8401] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1238.689113][T19548] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4736'. [ 1238.779073][T13909] usb 6-1: Using ep0 maxpacket: 16 [ 1238.787352][T13909] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1238.860692][ T8401] usb 3-1: Using ep0 maxpacket: 8 [ 1238.926092][ T8401] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1238.988438][T13909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1239.002437][ T8401] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1239.018353][ T8401] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1239.027081][ T8401] usb 3-1: Product: syz [ 1239.031685][ T8401] usb 3-1: Manufacturer: syz [ 1239.036394][ T8401] usb 3-1: SerialNumber: syz [ 1239.041186][T13909] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1239.061257][ T8401] usb 3-1: config 0 descriptor?? [ 1239.098454][ T8401] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1239.107709][T13909] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1239.141348][T13909] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1239.168902][T13909] usb 6-1: Manufacturer: syz [ 1239.258929][T13909] usb 6-1: config 0 descriptor?? [ 1239.679147][T19559] random: crng reseeded on system resumption [ 1240.009376][ T8401] gspca_zc3xx: reg_w_i err -110 [ 1240.486393][T19555] device bridge1 entered promiscuous mode [ 1240.679070][ T8401] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1240.711189][ T8401] gspca_zc3xx: probe of 3-1:0.0 failed with error -110 [ 1241.708178][T14004] usb 3-1: USB disconnect, device number 94 [ 1242.032584][ T8401] usb 6-1: USB disconnect, device number 26 [ 1243.168385][T19613] syz.4.4741 (19613): drop_caches: 1 [ 1243.460226][T19633] random: crng reseeded on system resumption [ 1245.797274][T19691] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4749'. [ 1246.648967][ T32] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1246.935493][ T32] usb 5-1: Using ep0 maxpacket: 8 [ 1246.983518][ T32] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1247.048775][ T32] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1247.109507][ T32] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1247.138925][ T32] usb 5-1: Product: syz [ 1247.143158][ T32] usb 5-1: Manufacturer: syz [ 1247.147785][ T32] usb 5-1: SerialNumber: syz [ 1247.427351][T19708] syz.0.4752 (19708): drop_caches: 1 [ 1247.739731][T19708] syz.0.4752 (19708): drop_caches: 1 [ 1248.038311][ T32] usb 5-1: config 0 descriptor?? [ 1248.102316][ T32] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1248.149997][T19716] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1248.149997][T19716] program syz.0.4756 not setting count and/or reply_len properly [ 1249.032011][T19716] blktrace: Concurrent blktraces are not allowed on sg0 [ 1250.649660][ T32] gspca_zc3xx: reg_w_i err -110 [ 1250.952807][T19730] syz.0.4758 (19730): drop_caches: 1 [ 1251.408873][ T32] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1251.415317][ T32] gspca_zc3xx: probe of 5-1:0.0 failed with error -110 [ 1251.497435][T13909] usb 5-1: USB disconnect, device number 96 [ 1251.566554][T19747] virt_wifi0 speed is unknown, defaulting to 1000 [ 1251.582528][T19747] lo speed is unknown, defaulting to 1000 [ 1252.242285][T19753] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4765'. [ 1252.967499][T19762] loop0: detected capacity change from 0 to 2048 [ 1253.069819][T19770] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1253.069819][T19770] program syz.4.4769 not setting count and/or reply_len properly [ 1253.129166][T19762] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 1253.137748][T19762] ext4 filesystem being mounted at /263/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1253.416481][T19770] blktrace: Concurrent blktraces are not allowed on sg0 [ 1253.455783][T19774] virt_wifi0 speed is unknown, defaulting to 1000 [ 1253.478035][T19775] loop3: detected capacity change from 0 to 2048 [ 1253.559866][T19774] lo speed is unknown, defaulting to 1000 [ 1253.822247][T19775] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 1253.858985][T19775] ext4 filesystem being mounted at /43/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1253.891245][T19777] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4768'. [ 1254.071429][T19784] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4770'. [ 1254.879697][T13514] EXT4-fs (loop0): unmounting filesystem. [ 1254.912777][T18566] EXT4-fs (loop3): unmounting filesystem. [ 1256.039595][ T3598] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1256.249090][ T3598] usb 5-1: Using ep0 maxpacket: 8 [ 1256.264393][ T3598] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1256.296984][ T3598] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1256.306673][ T3598] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1256.317852][ T3598] usb 5-1: Product: syz [ 1256.324147][ T3598] usb 5-1: Manufacturer: syz [ 1256.330489][ T3598] usb 5-1: SerialNumber: syz [ 1256.373961][ T3598] usb 5-1: config 0 descriptor?? [ 1256.409037][ T3598] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1256.844036][T19794] syz.3.4773 (19794): drop_caches: 1 [ 1257.476421][T19817] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4778'. [ 1257.680981][T19817] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4778'. [ 1258.769287][T19834] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4780'. [ 1259.543467][ T3598] gspca_zc3xx: reg_r err -32 [ 1259.585502][T19848] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4783'. [ 1259.642959][T19849] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1260.179462][ T3598] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1260.453445][ T3598] gspca_zc3xx: probe of 5-1:0.0 failed with error -32 [ 1260.623700][ T3598] usb 5-1: USB disconnect, device number 97 [ 1263.007923][T19870] IPv6: sit1: Disabled Multicast RS [ 1265.565107][T19879] syz.3.4789 (19879): drop_caches: 1 [ 1266.303706][T19898] IPv6: sit1: Disabled Multicast RS [ 1266.677597][T19905] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4794'. [ 1266.734836][T19906] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1268.118936][T19894] syz.0.4792 (19894): drop_caches: 1 [ 1268.675908][T19929] vivid-004: disconnect [ 1270.919394][T19918] vivid-004: reconnect [ 1271.208969][T19920] syz.5.4799 (19920): drop_caches: 1 [ 1271.289221][T13515] Bluetooth: hci3: command 0x0406 tx timeout [ 1271.563482][T19920] syz.5.4799 (19920): drop_caches: 1 [ 1273.130378][T19941] syz.0.4804 (19941): drop_caches: 1 [ 1273.343489][T19958] device bridge1 entered promiscuous mode [ 1275.034774][ T7] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 1276.118960][ T7] usb 1-1: Using ep0 maxpacket: 16 [ 1276.359968][ T7] usb 1-1: too many configurations: 123, using maximum allowed: 8 [ 1276.385650][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1276.414109][ T7] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1276.438915][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1276.458839][ T7] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1276.480901][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1276.531786][ T7] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1276.559472][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1276.590968][ T7] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1277.049519][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1277.078468][T19997] syz.3.4816 (19997): drop_caches: 1 [ 1277.130621][ T7] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1277.197015][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1277.213729][ T7] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1277.223722][T20008] device bridge1 entered promiscuous mode [ 1277.276182][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1277.297926][ T7] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1277.325686][T20012] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4821'. [ 1277.343958][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1277.383121][T20012] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4821'. [ 1277.393367][ T7] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1277.414268][ T7] usb 1-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1277.436853][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 1277.455810][ T7] usb 1-1: SerialNumber: syz [ 1277.475869][ T7] usb 1-1: config 0 descriptor?? [ 1277.828188][ T4362] usb 1-1: USB disconnect, device number 86 [ 1280.350935][T20025] binder: 20023:20025 unknown command 1074553619 [ 1280.468985][T20025] binder: 20023:20025 ioctl c0306201 200000000440 returned -22 [ 1281.000111][T20042] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4828'. [ 1281.014477][T20042] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1282.873781][T20051] vivid-000: disconnect [ 1283.643165][T20044] vivid-000: reconnect [ 1284.603554][T20065] device bridge2 entered promiscuous mode [ 1284.698263][T20066] random: crng reseeded on system resumption [ 1286.330124][T20072] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4834'. [ 1287.396919][T20077] fuse: Bad value for 'fd' [ 1287.854318][T20091] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4838'. [ 1288.659542][T20094] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1289.226504][T20098] virt_wifi0 speed is unknown, defaulting to 1000 [ 1289.291518][T20098] lo speed is unknown, defaulting to 1000 [ 1291.250646][T20122] device bridge2 entered promiscuous mode [ 1291.769679][T20129] loop4: detected capacity change from 0 to 2048 [ 1291.892957][T20129] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 1291.914694][T20129] ext4 filesystem being mounted at /310/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1292.045881][T20135] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4849'. [ 1292.659007][T13342] EXT4-fs (loop4): unmounting filesystem. [ 1292.887071][T20138] loop3: detected capacity change from 0 to 2048 [ 1292.996601][T20138] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 1293.006017][T20138] ext4 filesystem being mounted at /62/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1293.061703][T20143] device syzkaller0 entered promiscuous mode [ 1294.036972][T20144] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4850'. [ 1294.850434][T20156] virt_wifi0 speed is unknown, defaulting to 1000 [ 1294.870686][T20156] lo speed is unknown, defaulting to 1000 [ 1294.890165][T18566] EXT4-fs (loop3): unmounting filesystem. [ 1295.032085][T20160] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4854'. [ 1295.222984][T20166] loop3: detected capacity change from 0 to 2048 [ 1295.311981][T20166] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 1295.341548][T20166] ext4 filesystem being mounted at /63/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1295.465241][T20170] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4856'. [ 1296.028533][T20172] loop5: detected capacity change from 0 to 2048 [ 1296.187883][T20172] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1296.248221][T20172] ext4 filesystem being mounted at /169/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1296.527097][T18566] EXT4-fs (loop3): unmounting filesystem. [ 1296.909075][T20176] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4858'. [ 1297.300076][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1298.743912][T20181] vivid-002: disconnect [ 1298.752843][T20192] random: crng reseeded on system resumption [ 1299.818275][T20187] syz.4.4860 (20187): drop_caches: 1 [ 1299.932109][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 1299.969594][T20180] vivid-002: reconnect [ 1300.242928][T20199] virt_wifi0 speed is unknown, defaulting to 1000 [ 1300.272644][T20199] lo speed is unknown, defaulting to 1000 [ 1301.221837][T20213] loop5: detected capacity change from 0 to 2048 [ 1301.603845][T20213] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1301.624427][T20213] ext4 filesystem being mounted at /171/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1301.839645][T20220] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4868'. [ 1303.205423][T20230] syz.2.4871 (20230): drop_caches: 1 [ 1303.657615][T20235] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 1303.953044][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1304.093682][T20230] syz.2.4871 (20230): drop_caches: 1 [ 1304.184229][T20241] loop5: detected capacity change from 0 to 2048 [ 1304.548420][T20252] random: crng reseeded on system resumption [ 1305.917376][T20241] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1306.145366][T20241] ext4 filesystem being mounted at /172/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1306.717742][T20297] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4874'. [ 1308.688386][T20310] random: crng reseeded on system resumption [ 1310.233757][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1310.340030][T20322] loop4: detected capacity change from 0 to 2048 [ 1310.941323][T20322] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 1311.160291][T20322] ext4 filesystem being mounted at /318/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1313.170362][T13342] EXT4-fs (loop4): unmounting filesystem. [ 1313.275726][T20382] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4885'. [ 1313.322629][T20382] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4885'. [ 1314.296989][T20392] virt_wifi0 speed is unknown, defaulting to 1000 [ 1314.304512][T20392] lo speed is unknown, defaulting to 1000 [ 1314.405818][T20395] loop2: detected capacity change from 0 to 2048 [ 1314.619654][T20395] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 1314.628237][T20395] ext4 filesystem being mounted at /343/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1314.836515][T20403] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4891'. [ 1315.544150][T20407] loop0: detected capacity change from 0 to 2048 [ 1315.572107][T12743] EXT4-fs (loop2): unmounting filesystem. [ 1315.964267][T20407] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 1315.983618][T20407] ext4 filesystem being mounted at /289/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1317.790557][T20424] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4893'. [ 1318.928147][T20431] virt_wifi0 speed is unknown, defaulting to 1000 [ 1318.993015][T20431] lo speed is unknown, defaulting to 1000 [ 1319.755459][T13514] EXT4-fs (loop0): unmounting filesystem. [ 1321.299074][T20452] vivid-004: disconnect [ 1322.622613][T20447] vivid-004: reconnect [ 1322.997347][T20456] loop5: detected capacity change from 0 to 2048 [ 1323.114261][T20456] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1323.149012][T20456] ext4 filesystem being mounted at /177/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1323.680931][T20465] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4904'. [ 1325.286159][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1326.361190][T20494] random: crng reseeded on system resumption [ 1330.552605][T20550] binder: BINDER_SET_CONTEXT_MGR already set [ 1330.558662][T20550] binder: 20549:20550 ioctl 4018620d 200000004a80 returned -16 [ 1330.888999][T20559] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4919'. [ 1330.948916][ T4372] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 1331.188899][ T4372] usb 1-1: Using ep0 maxpacket: 16 [ 1331.195055][ T4372] usb 1-1: too many configurations: 123, using maximum allowed: 8 [ 1331.232987][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1331.457800][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.172224][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.196766][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.228980][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.249233][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.279619][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.367126][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.391963][ T4372] usb 1-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1332.416915][ T4372] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 1332.446694][ T4372] usb 1-1: SerialNumber: syz [ 1332.476731][ T4372] usb 1-1: config 0 descriptor?? [ 1332.512845][ T4372] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1332.742138][ T7] usb 1-1: USB disconnect, device number 87 [ 1332.919720][ T4372] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1333.138883][ T4372] usb 6-1: Using ep0 maxpacket: 16 [ 1333.146235][ T4372] usb 6-1: too many configurations: 123, using maximum allowed: 8 [ 1333.216396][ T4372] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.236538][ T4372] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.255649][ T4372] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.309751][ T4372] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.335689][ T4372] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.356310][ T4372] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.410301][ T4372] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.444208][ T4372] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.476526][ T4372] usb 6-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1333.510328][ T4372] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 1333.539008][ T4372] usb 6-1: SerialNumber: syz [ 1333.562219][ T4372] usb 6-1: config 0 descriptor?? [ 1333.582872][ T4372] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1333.618939][ T4362] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1333.778943][ T32] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 1333.818894][ T4362] usb 4-1: Using ep0 maxpacket: 16 [ 1333.825921][ T3598] usb 6-1: USB disconnect, device number 27 [ 1333.826385][ T4362] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1333.883225][ T4362] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1333.917678][ T4362] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1333.944327][ T4362] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1333.967295][ T4362] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1333.988910][ T32] usb 1-1: Using ep0 maxpacket: 16 [ 1333.995342][ T4362] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1334.012562][ T32] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1334.024321][ T4362] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1334.039797][ T32] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1334.050962][ T4362] usb 4-1: Manufacturer: syz [ 1334.065690][ T4362] usb 4-1: config 0 descriptor?? [ 1334.071709][ T32] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1334.102104][ T32] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1334.130815][ T32] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1334.164607][ T32] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1334.224922][ T32] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1334.245200][ T32] usb 1-1: Manufacturer: syz [ 1334.275124][ T32] usb 1-1: config 0 descriptor?? [ 1334.280164][T20583] fuse: Bad value for 'fd' [ 1334.533159][T20587] fuse: Bad value for 'fd' [ 1334.569018][ T4362] rc_core: IR keymap rc-hauppauge not found [ 1334.575083][ T4362] Registered IR keymap rc-empty [ 1334.614255][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1334.668968][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1335.456607][ T4362] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 1336.951150][ T4362] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input188 [ 1336.970847][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1336.999427][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1337.038927][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1337.089625][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1337.123863][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1337.198961][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1337.257254][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1337.318962][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1337.358910][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1337.418962][ T32] rc_core: IR keymap rc-hauppauge not found [ 1337.426188][ T32] Registered IR keymap rc-empty [ 1337.562946][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1337.598904][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1337.598987][ T4362] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 1338.319388][ T32] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc1 [ 1338.370837][ T32] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc1/input189 [ 1338.390123][ T4362] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1338.418225][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.431348][ T4362] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1338.448932][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.479005][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.516928][ T4362] usb 4-1: USB disconnect, device number 14 [ 1338.519246][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.579025][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.639967][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.688920][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.728912][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.778889][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.838899][ T32] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1338.900253][ T32] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1338.918412][ T32] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1338.984524][ T32] usb 1-1: USB disconnect, device number 88 [ 1339.478071][T20627] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1339.478071][T20627] program syz.4.4938 not setting count and/or reply_len properly [ 1339.648051][T20627] blktrace: Concurrent blktraces are not allowed on sg0 [ 1339.841343][T20631] fuse: Bad value for 'fd' [ 1339.854539][T20632] fuse: Bad value for 'fd' [ 1340.328873][ T4372] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1340.518928][ T4372] usb 3-1: Using ep0 maxpacket: 16 [ 1340.524887][ T4372] usb 3-1: too many configurations: 123, using maximum allowed: 8 [ 1340.582058][ T4372] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1340.624288][ T4372] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1340.667692][ T4372] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1340.714870][ T4372] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1340.777273][ T4372] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1340.859235][ T4372] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1340.892725][ T4372] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1340.976329][ T4372] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1341.081632][ T4372] usb 3-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1341.095812][ T4372] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 1341.883800][ T4372] usb 3-1: SerialNumber: syz [ 1341.923245][ T4372] usb 3-1: config 0 descriptor?? [ 1341.979348][ T4372] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1342.191545][ T4372] usb 3-1: USB disconnect, device number 95 [ 1342.897954][T20664] fuse: Bad value for 'fd' [ 1343.508527][T20675] sg_write: data in/out 1252404699/178 bytes for SCSI command 0xff-- guessing data in; [ 1343.508527][T20675] program syz.3.4956 not setting count and/or reply_len properly [ 1343.573321][T20675] blktrace: Concurrent blktraces are not allowed on sg0 [ 1343.897662][T20681] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4955'. [ 1345.640846][T20700] random: crng reseeded on system resumption [ 1348.398843][ T4362] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1348.778928][ T4362] usb 4-1: Using ep0 maxpacket: 8 [ 1348.845840][ T4362] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1349.120997][ T4362] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1349.156772][ T4362] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1349.457726][ T4362] usb 4-1: Product: syz [ 1349.462348][ T4362] usb 4-1: Manufacturer: syz [ 1349.466970][ T4362] usb 4-1: SerialNumber: syz [ 1349.475212][ T4362] usb 4-1: config 0 descriptor?? [ 1349.484153][ T4362] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1351.136979][T20771] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4971'. [ 1353.434102][ T4362] gspca_zc3xx: reg_r err -71 [ 1353.842128][T20818] random: crng reseeded on system resumption [ 1354.058860][ T4362] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1355.161176][ T4362] gspca_zc3xx: probe of 4-1:0.0 failed with error -71 [ 1355.435016][ T4362] usb 4-1: USB disconnect, device number 15 [ 1355.818881][ T4362] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1356.018887][ T4362] usb 4-1: Using ep0 maxpacket: 16 [ 1356.059636][ T4362] usb 4-1: config 0 has an invalid descriptor of length 93, skipping remainder of the config [ 1356.174059][ T4362] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1356.293113][ T4362] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1356.432692][ T4362] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1356.499661][ T4362] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1356.669778][ T4362] usb 4-1: string descriptor 0 read error: -71 [ 1356.738895][ T4362] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1356.752834][ T4362] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1356.763346][ T4362] usb 4-1: config 0 descriptor?? [ 1356.769127][ T4362] usb 4-1: can't set config #0, error -71 [ 1356.776242][ T4362] usb 4-1: USB disconnect, device number 16 [ 1358.089120][T20870] device bridge2 entered promiscuous mode [ 1358.307226][T20865] syz.3.4985 (20865): drop_caches: 1 [ 1358.920093][T20885] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4990'. [ 1359.449539][T20893] syz.0.4993 (20893): drop_caches: 1 [ 1359.507647][T20893] syz.0.4993 (20893): drop_caches: 1 [ 1359.514094][ T4362] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1359.535698][T20898] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4995'. [ 1359.728836][ T4362] usb 6-1: Using ep0 maxpacket: 8 [ 1359.736109][ T4362] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1359.784690][ T4362] usb 6-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1359.851467][ T32] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1359.876521][ T4362] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1359.920132][ T4362] usb 6-1: Product: syz [ 1359.924328][ T4362] usb 6-1: Manufacturer: syz [ 1359.957514][ T4362] usb 6-1: SerialNumber: syz [ 1359.978021][ T4362] usb 6-1: config 0 descriptor?? [ 1359.993499][ T4362] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1360.118865][ T32] usb 3-1: Using ep0 maxpacket: 16 [ 1360.384680][ T32] usb 3-1: config 0 has an invalid descriptor of length 93, skipping remainder of the config [ 1360.418182][ T32] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1360.480672][ T32] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1360.522078][ T32] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1360.565381][ T32] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1361.381081][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.399001][ T4362] gspca_zc3xx: reg_w_i err -110 [ 1362.355288][ T32] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1362.437295][ T32] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1362.485292][ T32] usb 3-1: Manufacturer: syz [ 1362.577503][ T32] usb 3-1: config 0 descriptor?? [ 1362.629235][ T32] usb 3-1: can't set config #0, error -71 [ 1362.701771][ T32] usb 3-1: USB disconnect, device number 96 [ 1362.748972][ T4362] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1362.758934][ T4362] gspca_zc3xx: probe of 6-1:0.0 failed with error -110 [ 1362.969908][ T4362] usb 6-1: USB disconnect, device number 28 [ 1363.538038][T20923] device bridge3 entered promiscuous mode [ 1364.761952][T20938] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5006'. [ 1364.807381][T20938] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5006'. [ 1364.872296][T20934] syz.4.5003 (20934): drop_caches: 1 [ 1365.184774][T20934] syz.4.5003 (20934): drop_caches: 1 [ 1366.396394][T20948] vivid-000: kernel_thread() failed [ 1366.744912][T20957] random: crng reseeded on system resumption [ 1368.698833][ T4372] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1368.928839][ T4372] usb 3-1: Using ep0 maxpacket: 16 [ 1368.948853][ T4372] usb 3-1: config 0 has an invalid descriptor of length 93, skipping remainder of the config [ 1369.027905][ T4372] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1369.071552][ T4372] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1369.358598][T21001] random: crng reseeded on system resumption [ 1370.496184][ T4372] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1370.957404][ T4372] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1371.084665][ T4372] usb 3-1: string descriptor 0 read error: -71 [ 1371.094780][ T4372] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1371.196349][ T4372] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1371.251879][ T4372] usb 3-1: config 0 descriptor?? [ 1371.387080][ T4372] usb 3-1: can't set config #0, error -71 [ 1371.459830][ T4372] usb 3-1: USB disconnect, device number 97 [ 1373.930349][T21048] syz.4.5018 (21048): drop_caches: 1 [ 1375.170329][T21075] fuse: Unknown parameter 'grou00000000000000000000' [ 1375.206763][T21075] 9pnet_fd: Insufficient options for proto=fd [ 1376.006675][T21086] loop5: detected capacity change from 0 to 2048 [ 1376.338864][T21086] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1376.369361][T21086] ext4 filesystem being mounted at /202/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1376.558810][T21091] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5028'. [ 1377.320696][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1379.411679][T21101] syz.0.5031 (21101): drop_caches: 1 [ 1380.100851][T21101] syz.0.5031 (21101): drop_caches: 1 [ 1380.167275][T21118] netlink: 40 bytes leftover after parsing attributes in process `syz.5.5035'. [ 1380.580783][T14004] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 1380.818969][T14004] usb 1-1: Using ep0 maxpacket: 32 [ 1380.857010][T14004] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1380.935139][T14004] usb 1-1: config 33 has an invalid interface number: 3 but max is 0 [ 1380.988455][T14004] usb 1-1: config 33 has no interface number 0 [ 1381.040610][T14004] usb 1-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1381.101877][T14004] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1381.498482][T21121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1381.609363][T21121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1381.665432][T21121] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5037'. [ 1381.800895][T14004] usb 1-1: string descriptor 0 read error: -71 [ 1381.814412][T14004] ftdi_sio 1-1:33.3: FTDI USB Serial Device converter detected [ 1381.847669][T14004] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1381.884843][T14004] usb 1-1: USB disconnect, device number 89 [ 1381.912475][T14004] ftdi_sio 1-1:33.3: device disconnected [ 1381.977364][T21132] loop5: detected capacity change from 0 to 2048 [ 1382.060538][T21132] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1382.085254][T21136] random: crng reseeded on system resumption [ 1382.103957][T21132] ext4 filesystem being mounted at /207/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1383.316663][T21139] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5039'. [ 1384.797527][T21146] vivid-000: kernel_thread() failed [ 1385.194725][T21160] random: crng reseeded on system resumption [ 1385.742011][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1390.243592][T21216] vivid-000: kernel_thread() failed [ 1390.433403][T21221] binder: BINDER_SET_CONTEXT_MGR already set [ 1390.689522][T21221] binder: 21220:21221 ioctl 4018620d 200000004a80 returned -16 [ 1392.345638][T21241] fuse: Bad value for 'fd' [ 1392.984999][T21252] device bridge3 entered promiscuous mode [ 1393.078917][ T7] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1394.067409][ T7] usb 6-1: Using ep0 maxpacket: 32 [ 1394.176191][ T7] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1394.354978][ T7] usb 6-1: config 33 has an invalid interface number: 3 but max is 0 [ 1394.508335][ T7] usb 6-1: config 33 has no interface number 0 [ 1394.627241][ T7] usb 6-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1394.680038][ T7] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1396.979400][ T7] usb 6-1: string descriptor 0 read error: -71 [ 1397.002719][ T7] ftdi_sio 6-1:33.3: FTDI USB Serial Device converter detected [ 1397.039521][ T7] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1397.063698][ T7] usb 6-1: USB disconnect, device number 29 [ 1397.099932][ T7] ftdi_sio 6-1:33.3: device disconnected [ 1397.223440][T21273] loop5: detected capacity change from 0 to 2048 [ 1397.384185][T21273] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1397.413276][T21273] ext4 filesystem being mounted at /211/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1397.986787][T21281] vivid-004: disconnect [ 1399.420966][T21274] vivid-004: reconnect [ 1399.490388][T21289] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5062'. [ 1400.195304][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1400.317429][T21298] random: crng reseeded on system resumption [ 1402.971977][T21313] device bridge4 entered promiscuous mode [ 1403.470548][T21324] loop5: detected capacity change from 0 to 2048 [ 1403.693669][T21330] binder: 21326:21330 unknown command 1074553619 [ 1403.729081][T21330] binder: 21326:21330 ioctl c0306201 200000000440 returned -22 [ 1403.764231][T21324] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 1403.779324][T21324] ext4 filesystem being mounted at /213/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1403.903555][T21338] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5075'. [ 1404.984656][ T4362] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1405.682656][T15696] EXT4-fs (loop5): unmounting filesystem. [ 1405.848969][ T4362] usb 3-1: Using ep0 maxpacket: 16 [ 1405.854863][ T4362] usb 3-1: too many configurations: 123, using maximum allowed: 8 [ 1405.910326][ T4362] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1405.952409][ T4362] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1405.985560][ T4362] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1406.012145][ T4362] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1406.037903][ T4362] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1406.081566][ T4362] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1406.584990][ T4362] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1406.640681][ T4362] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1406.671374][ T4362] usb 3-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1406.732923][ T4362] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 1406.792555][ T4362] usb 3-1: SerialNumber: syz [ 1406.827443][ T4362] usb 3-1: config 0 descriptor?? [ 1406.872000][ T4362] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input190 [ 1406.900095][T21362] device bridge4 entered promiscuous mode [ 1407.059174][T13349] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1407.110430][ T3623] bcm5974 3-1:0.0: could not read from device [ 1407.138960][ T4362] usb 3-1: USB disconnect, device number 98 [ 1407.269001][T13349] usb 4-1: Using ep0 maxpacket: 8 [ 1407.280718][T13349] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1407.330372][T13349] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1407.378878][T13349] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1407.663478][T13349] usb 4-1: Product: syz [ 1407.693860][T13349] usb 4-1: Manufacturer: syz [ 1407.714122][T13349] usb 4-1: SerialNumber: syz [ 1407.776996][T13349] usb 4-1: config 0 descriptor?? [ 1407.801745][T13349] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1407.871851][T21373] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5087'. [ 1407.918813][ T7] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 1408.108958][ T7] usb 1-1: Using ep0 maxpacket: 16 [ 1408.118698][ T7] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1408.189045][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1408.211802][ T7] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1408.224355][ T7] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1408.244937][ T7] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1408.289838][ T7] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1408.302102][T21382] device syzkaller0 entered promiscuous mode [ 1408.346447][ T7] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1408.517088][ T7] usb 1-1: Manufacturer: syz [ 1408.687261][ T7] usb 1-1: config 0 descriptor?? [ 1409.398869][ T7] rc_core: IR keymap rc-hauppauge not found [ 1409.955024][ T7] Registered IR keymap rc-empty [ 1409.988556][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1410.078983][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1410.119866][ T7] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 1410.177719][ T7] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input191 [ 1410.206944][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1410.246935][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1410.288916][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1410.303278][T21398] device bridge2 entered promiscuous mode [ 1410.328922][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1410.369025][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1410.473669][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1411.068978][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1411.110165][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1411.159142][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1411.188864][ T7] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1411.247650][ T7] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1411.292740][ T7] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1411.380463][ T7] usb 1-1: USB disconnect, device number 90 [ 1411.496001][T13349] gspca_zc3xx: reg_w_i err -71 [ 1411.559408][T13349] gspca_zc3xx: probe of 4-1:0.0 failed with error -71 [ 1411.594707][T13349] usb 4-1: USB disconnect, device number 17 [ 1411.594718][T14004] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1411.970819][T14004] usb 6-1: Using ep0 maxpacket: 32 [ 1411.979669][T14004] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1412.027283][T14004] usb 6-1: config 33 has an invalid interface number: 3 but max is 0 [ 1412.047175][T14004] usb 6-1: config 33 has no interface number 0 [ 1412.078438][T14004] usb 6-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1412.097933][T14004] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1412.327452][T21405] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1412.747920][T21405] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1412.775252][T21405] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5097'. [ 1412.822454][T14004] usb 6-1: string descriptor 0 read error: -71 [ 1412.840713][T14004] ftdi_sio 6-1:33.3: FTDI USB Serial Device converter detected [ 1412.851512][T14004] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1412.879145][T14004] usb 6-1: USB disconnect, device number 30 [ 1412.999722][T14004] ftdi_sio 6-1:33.3: device disconnected [ 1413.445104][T21432] loop4: detected capacity change from 0 to 2048 [ 1413.526606][T13515] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 1413.537511][T13515] CPU: 1 PID: 13515 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1413.545218][T13515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1413.555328][T13515] Workqueue: hci1 hci_rx_work [ 1413.560232][T13515] Call Trace: [ 1413.563545][T13515] [ 1413.566499][T13515] dump_stack_lvl+0x188/0x24e [ 1413.571224][T13515] ? show_regs_print_info+0x12/0x12 [ 1413.576461][T13515] ? load_image+0x400/0x400 [ 1413.581049][T13515] sysfs_create_dir_ns+0x26a/0x290 [ 1413.586270][T13515] ? sysfs_warn_dup+0xa0/0xa0 [ 1413.590975][T13515] ? do_raw_spin_unlock+0x11d/0x230 [ 1413.596206][T13515] kobject_add_internal+0x61c/0xcc0 [ 1413.601519][T13515] kobject_add+0x160/0x230 [ 1413.605963][T13515] ? kobject_init+0x1d0/0x1d0 [ 1413.610665][T13515] ? klist_children_get+0x50/0x50 [ 1413.615852][T13515] ? get_device_parent+0x121/0x3f0 [ 1413.620985][T13515] device_add+0x483/0xfb0 [ 1413.625332][T13515] ? kmem_cache_free+0xf7/0x290 [ 1413.630249][T13515] hci_conn_add_sysfs+0xd1/0x1e0 [ 1413.635271][T13515] le_conn_complete_evt+0x1062/0x1670 [ 1413.640678][T13515] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 1413.646948][T13515] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 1413.652652][T13515] ? skb_pull_data+0xf7/0x200 [ 1413.657357][T13515] hci_le_conn_complete_evt+0x183/0x440 [ 1413.662931][T13515] ? hci_remote_host_features_evt+0x270/0x270 [ 1413.669028][T13515] hci_event_packet+0x7b9/0x1280 [ 1413.674009][T13515] ? bis_list+0x280/0x280 [ 1413.678382][T13515] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1413.684302][T13515] ? kcov_remote_start+0x4c7/0x7e0 [ 1413.689491][T13515] ? spurious_interrupt+0x30/0xd0 [ 1413.694686][T13515] ? hci_send_to_monitor+0x9c/0x4a0 [ 1413.699910][T13515] hci_rx_work+0x3eb/0xd40 [ 1413.704354][T13515] ? _raw_spin_unlock+0x40/0x40 [ 1413.709244][T13515] ? process_one_work+0x7b0/0x1160 [ 1413.714409][T13515] process_one_work+0x8a2/0x1160 [ 1413.719379][T13515] ? worker_detach_from_pool+0x240/0x240 [ 1413.725045][T13515] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1413.730105][T13515] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1413.735688][T13515] ? kthread_data+0x4b/0xc0 [ 1413.740273][T13515] worker_thread+0xaa2/0x1270 [ 1413.745002][T13515] ? __kthread_parkme+0x162/0x1c0 [ 1413.750073][T13515] kthread+0x29d/0x330 [ 1413.754209][T13515] ? worker_clr_flags+0x1a0/0x1a0 [ 1413.759257][T13515] ? kthread_blkcg+0xd0/0xd0 [ 1413.764010][T13515] ret_from_fork+0x1f/0x30 [ 1413.768496][T13515] [ 1413.773487][T13515] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1413.788008][T13515] Bluetooth: hci1: failed to register connection device [ 1413.820848][T21432] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 1413.859770][T21432] ext4 filesystem being mounted at /365/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1414.298817][T21445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5104'. [ 1414.831597][T21448] device bridge5 entered promiscuous mode [ 1415.192966][T13342] EXT4-fs (loop4): unmounting filesystem. [ 1415.867187][T21452] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5109'. [ 1415.934923][T21457] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 1416.441692][ T4372] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1416.949000][ T4372] usb 6-1: Using ep0 maxpacket: 8 [ 1416.974267][ T4372] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1417.029685][ T4372] usb 6-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1417.072477][ T4372] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1417.095881][ T4372] usb 6-1: Product: syz [ 1417.110252][ T4372] usb 6-1: Manufacturer: syz [ 1417.125392][ T4372] usb 6-1: SerialNumber: syz [ 1417.146941][ T4372] usb 6-1: config 0 descriptor?? [ 1417.194212][ T4372] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1417.398972][T16825] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1417.588883][T16825] usb 5-1: Using ep0 maxpacket: 32 [ 1417.600178][T21487] random: crng reseeded on system resumption [ 1418.335403][T16825] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1418.416927][T16825] usb 5-1: config 33 has an invalid interface number: 3 but max is 0 [ 1418.538919][T16825] usb 5-1: config 33 has no interface number 0 [ 1418.545322][T16825] usb 5-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1418.741042][T16825] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1419.060489][T21482] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1419.079189][T21482] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1419.214365][T21482] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5117'. [ 1419.452211][T16825] usb 5-1: string descriptor 0 read error: -71 [ 1419.466024][T16825] ftdi_sio 5-1:33.3: FTDI USB Serial Device converter detected [ 1419.484781][T16825] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1419.509957][T16825] usb 5-1: USB disconnect, device number 98 [ 1419.550002][T16825] ftdi_sio 5-1:33.3: device disconnected [ 1420.329025][ T4287] Bluetooth: hci1: command 0x0406 tx timeout [ 1420.759348][ T4372] gspca_zc3xx: reg_w_i err -71 [ 1421.124887][ T4372] gspca_zc3xx: probe of 6-1:0.0 failed with error -71 [ 1421.748620][ T4372] usb 6-1: USB disconnect, device number 31 [ 1422.121819][T21557] binder: BINDER_SET_CONTEXT_MGR already set [ 1422.127866][T21557] binder: 21554:21557 ioctl 4018620d 200000004a80 returned -16 [ 1422.872753][ T1277] ieee802154 phy0 wpan0: encryption failed: -22 [ 1424.068019][T21580] random: crng reseeded on system resumption [ 1425.318802][T16900] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 1425.488881][ T4372] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1425.518927][T16900] usb 1-1: Using ep0 maxpacket: 8 [ 1425.525827][T16900] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1425.628790][ T7] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1425.678136][T16900] usb 1-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1425.698831][ T4372] usb 5-1: Using ep0 maxpacket: 32 [ 1425.713538][ T4372] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1425.789225][T16900] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1425.804224][ T4372] usb 5-1: config 33 has an invalid interface number: 3 but max is 0 [ 1425.839987][T16900] usb 1-1: Product: syz [ 1425.845614][ T4372] usb 5-1: config 33 has no interface number 0 [ 1425.858882][ T7] usb 4-1: Using ep0 maxpacket: 16 [ 1425.866103][T16900] usb 1-1: Manufacturer: syz [ 1425.872640][ T7] usb 4-1: too many configurations: 123, using maximum allowed: 8 [ 1425.897238][ T4372] usb 5-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1425.911316][T16900] usb 1-1: SerialNumber: syz [ 1425.923324][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1425.960614][T16900] usb 1-1: config 0 descriptor?? [ 1425.973266][ T4372] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1426.004467][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.015500][T16900] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1426.041091][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.065174][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.090611][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.144208][T21619] virt_wifi0 speed is unknown, defaulting to 1000 [ 1426.165379][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.184649][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.189342][T21619] lo speed is unknown, defaulting to 1000 [ 1426.223108][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1426.252590][T21577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1426.278148][ T7] usb 4-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1426.289123][T21577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1426.309968][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 1426.330813][T21577] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5133'. [ 1426.358674][ T7] usb 4-1: SerialNumber: syz [ 1426.385781][ T7] usb 4-1: config 0 descriptor?? [ 1426.394839][ T4372] usb 5-1: string descriptor 0 read error: -71 [ 1426.411849][ T4372] ftdi_sio 5-1:33.3: FTDI USB Serial Device converter detected [ 1426.437267][ T7] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input192 [ 1426.448549][ T4372] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1426.496807][ T4372] usb 5-1: USB disconnect, device number 99 [ 1426.512448][ T4372] ftdi_sio 5-1:33.3: device disconnected [ 1426.630875][ T3623] bcm5974 4-1:0.0: could not read from device [ 1426.659551][ T7] usb 4-1: USB disconnect, device number 18 [ 1426.857213][T21629] binder: BINDER_SET_CONTEXT_MGR already set [ 1426.864406][T21629] binder: 21628:21629 ioctl 4018620d 200000004a80 returned -16 [ 1426.997955][ T4287] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 1427.008197][ T4287] CPU: 1 PID: 4287 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 1427.015869][ T4287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1427.025937][ T4287] Workqueue: hci2 hci_rx_work [ 1427.030649][ T4287] Call Trace: [ 1427.033952][ T4287] [ 1427.036914][ T4287] dump_stack_lvl+0x188/0x24e [ 1427.041619][ T4287] ? show_regs_print_info+0x12/0x12 [ 1427.046846][ T4287] ? load_image+0x400/0x400 [ 1427.051389][ T4287] sysfs_create_dir_ns+0x26a/0x290 [ 1427.056528][ T4287] ? sysfs_warn_dup+0xa0/0xa0 [ 1427.061226][ T4287] ? do_raw_spin_unlock+0x11d/0x230 [ 1427.066447][ T4287] kobject_add_internal+0x61c/0xcc0 [ 1427.071674][ T4287] kobject_add+0x160/0x230 [ 1427.076117][ T4287] ? kobject_init+0x1d0/0x1d0 [ 1427.080835][ T4287] ? klist_children_get+0x50/0x50 [ 1427.085881][ T4287] ? get_device_parent+0x121/0x3f0 [ 1427.091006][ T4287] device_add+0x483/0xfb0 [ 1427.095348][ T4287] ? kmem_cache_free+0xf7/0x290 [ 1427.100219][ T4287] hci_conn_add_sysfs+0xd1/0x1e0 [ 1427.105201][ T4287] le_conn_complete_evt+0x1062/0x1670 [ 1427.110602][ T4287] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 1427.116870][ T4287] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 1427.122543][ T4287] ? skb_pull_data+0xf7/0x200 [ 1427.127246][ T4287] hci_le_conn_complete_evt+0x183/0x440 [ 1427.132859][ T4287] ? hci_remote_host_features_evt+0x270/0x270 [ 1427.138964][ T4287] hci_event_packet+0x7b9/0x1280 [ 1427.143980][ T4287] ? bis_list+0x280/0x280 [ 1427.148449][ T4287] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1427.154390][ T4287] ? kcov_remote_start+0x4c7/0x7e0 [ 1427.159550][ T4287] ? spurious_interrupt+0x30/0xd0 [ 1427.164606][ T4287] ? hci_send_to_monitor+0x9c/0x4a0 [ 1427.169826][ T4287] hci_rx_work+0x3eb/0xd40 [ 1427.174267][ T4287] ? _raw_spin_unlock+0x40/0x40 [ 1427.179141][ T4287] ? process_one_work+0x7b0/0x1160 [ 1427.184271][ T4287] process_one_work+0x8a2/0x1160 [ 1427.189238][ T4287] ? worker_detach_from_pool+0x240/0x240 [ 1427.194891][ T4287] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1427.199949][ T4287] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1427.205512][ T4287] ? kthread_data+0x4b/0xc0 [ 1427.210048][ T4287] worker_thread+0xaa2/0x1270 [ 1427.214762][ T4287] kthread+0x29d/0x330 [ 1427.218843][ T4287] ? worker_clr_flags+0x1a0/0x1a0 [ 1427.223887][ T4287] ? kthread_blkcg+0xd0/0xd0 [ 1427.228496][ T4287] ret_from_fork+0x1f/0x30 [ 1427.232970][ T4287] [ 1427.255006][ T4287] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1427.268290][ T4287] Bluetooth: hci2: failed to register connection device [ 1427.770403][T21635] vivid-004: disconnect [ 1427.916380][T21634] vivid-004: reconnect [ 1428.945087][T21657] random: crng reseeded on system resumption [ 1429.568931][T16900] gspca_zc3xx: reg_r err -110 [ 1430.188969][T16900] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1430.195478][T16900] gspca_zc3xx: probe of 1-1:0.0 failed with error -110 [ 1430.294859][T16900] usb 1-1: USB disconnect, device number 91 [ 1430.825688][T21700] binder: BINDER_SET_CONTEXT_MGR already set [ 1430.848893][T21700] binder: 21699:21700 ioctl 4018620d 200000004a80 returned -16 [ 1431.358837][ T4372] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1432.309162][ T4372] usb 6-1: Using ep0 maxpacket: 32 [ 1432.771297][ T4372] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1432.798503][ T4372] usb 6-1: config 33 has an invalid interface number: 3 but max is 0 [ 1432.847669][ T4372] usb 6-1: config 33 has no interface number 0 [ 1432.870615][ T4372] usb 6-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1432.916123][ T4372] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1433.294040][T21706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1433.312799][T21706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1433.332705][T21706] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5150'. [ 1433.429448][ T4372] usb 6-1: string descriptor 0 read error: -71 [ 1433.456133][ T4372] ftdi_sio 6-1:33.3: FTDI USB Serial Device converter detected [ 1433.522179][ T4372] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1433.589382][ T4372] usb 6-1: USB disconnect, device number 32 [ 1433.608914][ T4287] Bluetooth: hci2: command 0x0406 tx timeout [ 1433.612008][ T4372] ftdi_sio 6-1:33.3: device disconnected [ 1435.532072][T21760] random: crng reseeded on system resumption [ 1438.494250][T21826] loop3: detected capacity change from 0 to 2048 [ 1438.682075][T21826] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 1438.725185][T21826] ext4 filesystem being mounted at /122/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1438.756714][T21831] device syzkaller0 entered promiscuous mode [ 1438.804599][T21831] tipc: Enabled bearer , priority 0 [ 1439.391675][T21830] tipc: Resetting bearer [ 1439.932844][T21830] tipc: Disabling bearer [ 1439.966158][T21838] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5170'. [ 1440.005224][T16825] tipc: Node number set to 544368482 [ 1440.381697][T18566] EXT4-fs (loop3): unmounting filesystem. [ 1443.859463][ T4372] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 1444.258892][ T4372] usb 1-1: Using ep0 maxpacket: 16 [ 1444.265474][ T4372] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1444.328894][ T4372] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1444.368706][ T4372] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1444.393822][ T4372] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1444.435441][ T4372] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1444.544311][ T4372] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1444.669907][ T4372] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1444.771374][ T4372] usb 1-1: Manufacturer: syz [ 1445.107238][ T4372] usb 1-1: config 0 descriptor?? [ 1446.857234][ T4372] usb 1-1: can't set config #0, error -71 [ 1446.888387][ T4372] usb 1-1: USB disconnect, device number 92 [ 1447.022711][T21914] virt_wifi0 speed is unknown, defaulting to 1000 [ 1447.074377][T21914] lo speed is unknown, defaulting to 1000 [ 1447.508854][ T8401] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1448.479082][ T8401] usb 4-1: Using ep0 maxpacket: 32 [ 1448.495520][ T8401] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1448.529322][ T8401] usb 4-1: config 33 has an invalid interface number: 3 but max is 0 [ 1448.547963][ T8401] usb 4-1: config 33 has no interface number 0 [ 1448.616102][ T8401] usb 4-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 6.07 [ 1448.635919][ T8401] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1448.882874][T21935] virt_wifi0 speed is unknown, defaulting to 1000 [ 1448.902690][T21924] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1448.920631][T21924] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1448.959763][T21924] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5196'. [ 1449.044089][ T8401] usb 4-1: string descriptor 0 read error: -71 [ 1449.059685][ T8401] ftdi_sio 4-1:33.3: FTDI USB Serial Device converter detected [ 1449.097778][T21935] lo speed is unknown, defaulting to 1000 [ 1449.198387][ T8401] ftdi_sio ttyUSB0: unknown device type: 0x607 [ 1449.226966][ T8401] usb 4-1: USB disconnect, device number 19 [ 1449.266232][ T8401] ftdi_sio 4-1:33.3: device disconnected [ 1451.350779][ T4287] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci6/hci6:201' [ 1451.361885][ T4287] CPU: 1 PID: 4287 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 1451.369483][ T4287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1451.379741][ T4287] Workqueue: hci6 hci_rx_work [ 1451.384474][ T4287] Call Trace: [ 1451.387791][ T4287] [ 1451.390746][ T4287] dump_stack_lvl+0x188/0x24e [ 1451.395467][ T4287] ? show_regs_print_info+0x12/0x12 [ 1451.400711][ T4287] ? load_image+0x400/0x400 [ 1451.405290][ T4287] sysfs_create_dir_ns+0x26a/0x290 [ 1451.410446][ T4287] ? sysfs_warn_dup+0xa0/0xa0 [ 1451.415163][ T4287] ? do_raw_spin_unlock+0x11d/0x230 [ 1451.420391][ T4287] kobject_add_internal+0x61c/0xcc0 [ 1451.425631][ T4287] kobject_add+0x160/0x230 [ 1451.430084][ T4287] ? kobject_init+0x1d0/0x1d0 [ 1451.434809][ T4287] ? klist_children_get+0x50/0x50 [ 1451.439851][ T4287] ? get_device_parent+0x121/0x3f0 [ 1451.445017][ T4287] device_add+0x483/0xfb0 [ 1451.449372][ T4287] ? kmem_cache_free+0xf7/0x290 [ 1451.454255][ T4287] hci_conn_add_sysfs+0xd1/0x1e0 [ 1451.459218][ T4287] le_conn_complete_evt+0x1062/0x1670 [ 1451.464626][ T4287] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 1451.470892][ T4287] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 1451.476547][ T4287] ? skb_pull_data+0xf7/0x200 [ 1451.481259][ T4287] hci_le_conn_complete_evt+0x183/0x440 [ 1451.486861][ T4287] ? hci_remote_host_features_evt+0x270/0x270 [ 1451.492956][ T4287] hci_event_packet+0x7b9/0x1280 [ 1451.497935][ T4287] ? bis_list+0x280/0x280 [ 1451.502296][ T4287] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1451.508210][ T4287] ? kcov_remote_start+0x4c7/0x7e0 [ 1451.513341][ T4287] ? spurious_interrupt+0x30/0xd0 [ 1451.518425][ T4287] ? hci_send_to_monitor+0x9c/0x4a0 [ 1451.523736][ T4287] hci_rx_work+0x3eb/0xd40 [ 1451.528179][ T4287] ? _raw_spin_unlock+0x40/0x40 [ 1451.533114][ T4287] ? process_one_work+0x7b0/0x1160 [ 1451.538252][ T4287] process_one_work+0x8a2/0x1160 [ 1451.543225][ T4287] ? worker_detach_from_pool+0x240/0x240 [ 1451.548891][ T4287] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1451.554036][ T4287] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1451.559592][ T4287] ? kthread_data+0x4b/0xc0 [ 1451.564146][ T4287] worker_thread+0xaa2/0x1270 [ 1451.568872][ T4287] kthread+0x29d/0x330 [ 1451.573059][ T4287] ? worker_clr_flags+0x1a0/0x1a0 [ 1451.578104][ T4287] ? kthread_blkcg+0xd0/0xd0 [ 1451.582706][ T4287] ret_from_fork+0x1f/0x30 [ 1451.587151][ T4287] [ 1451.716597][ T4287] kobject_add_internal failed for hci6:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1452.058941][ T4287] Bluetooth: hci6: failed to register connection device [ 1452.081267][ T4287] ================================================================== [ 1452.089397][ T4287] BUG: KASAN: use-after-free in l2cap_connect_cfm+0x700/0x1120 [ 1452.096979][ T4287] Read of size 8 at addr ffff888059750498 by task kworker/u5:5/4287 [ 1452.104976][ T4287] [ 1452.107324][ T4287] CPU: 1 PID: 4287 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 1452.114888][ T4287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1452.124961][ T4287] Workqueue: hci6 hci_rx_work [ 1452.129676][ T4287] Call Trace: [ 1452.132982][ T4287] [ 1452.135941][ T4287] dump_stack_lvl+0x188/0x24e [ 1452.140657][ T4287] ? __lock_acquire+0x7d10/0x7d10 [ 1452.145760][ T4287] ? show_regs_print_info+0x12/0x12 [ 1452.151019][ T4287] ? load_image+0x400/0x400 [ 1452.155586][ T4287] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 1452.161116][ T4287] ? __virt_addr_valid+0x188/0x540 [ 1452.166380][ T4287] ? __virt_addr_valid+0x465/0x540 [ 1452.171532][ T4287] ? l2cap_connect_cfm+0x700/0x1120 [ 1452.176763][ T4287] print_report+0xa8/0x210 [ 1452.181232][ T4287] kasan_report+0x10b/0x140 [ 1452.185827][ T4287] ? l2cap_connect_cfm+0x700/0x1120 [ 1452.191056][ T4287] l2cap_connect_cfm+0x700/0x1120 [ 1452.196147][ T4287] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 1452.201475][ T4287] ? hci_connect_cfm+0x86/0x130 [ 1452.206374][ T4287] ? l2cap_connect_cfm+0x4/0x1120 [ 1452.211428][ T4287] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 1452.216738][ T4287] hci_connect_cfm+0x8f/0x130 [ 1452.221554][ T4287] le_conn_complete_evt+0x10ef/0x1670 [ 1452.226962][ T4287] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 1452.233245][ T4287] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 1452.238931][ T4287] ? skb_pull_data+0xf7/0x200 [ 1452.243653][ T4287] hci_le_conn_complete_evt+0x183/0x440 [ 1452.249264][ T4287] ? hci_remote_host_features_evt+0x270/0x270 [ 1452.255468][ T4287] hci_event_packet+0x7b9/0x1280 [ 1452.260508][ T4287] ? bis_list+0x280/0x280 [ 1452.264955][ T4287] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1452.270980][ T4287] ? kcov_remote_start+0x4c7/0x7e0 [ 1452.276160][ T4287] ? spurious_interrupt+0x30/0xd0 [ 1452.281266][ T4287] ? hci_send_to_monitor+0x9c/0x4a0 [ 1452.286552][ T4287] hci_rx_work+0x3eb/0xd40 [ 1452.291050][ T4287] ? _raw_spin_unlock+0x40/0x40 [ 1452.295972][ T4287] ? process_one_work+0x7b0/0x1160 [ 1452.301144][ T4287] process_one_work+0x8a2/0x1160 [ 1452.306224][ T4287] ? worker_detach_from_pool+0x240/0x240 [ 1452.311920][ T4287] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1452.317043][ T4287] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1452.322651][ T4287] ? kthread_data+0x4b/0xc0 [ 1452.327262][ T4287] worker_thread+0xaa2/0x1270 [ 1452.332017][ T4287] kthread+0x29d/0x330 [ 1452.336135][ T4287] ? worker_clr_flags+0x1a0/0x1a0 [ 1452.341275][ T4287] ? kthread_blkcg+0xd0/0xd0 [ 1452.345925][ T4287] ret_from_fork+0x1f/0x30 [ 1452.350459][ T4287] [ 1452.353529][ T4287] [ 1452.355914][ T4287] Allocated by task 4287: [ 1452.360290][ T4287] kasan_set_track+0x4b/0x70 [ 1452.364962][ T4287] __kasan_kmalloc+0x8e/0xa0 [ 1452.369660][ T4287] l2cap_chan_create+0x4c/0x760 [ 1452.374608][ T4287] l2cap_sock_new_connection_cb+0x17e/0x2a0 [ 1452.380628][ T4287] l2cap_connect_cfm+0x35f/0x1120 [ 1452.385734][ T4287] hci_connect_cfm+0x8f/0x130 [ 1452.390542][ T4287] le_conn_complete_evt+0x10ef/0x1670 [ 1452.395997][ T4287] hci_le_conn_complete_evt+0x183/0x440 [ 1452.401617][ T4287] hci_event_packet+0x7b9/0x1280 [ 1452.406655][ T4287] hci_rx_work+0x3eb/0xd40 [ 1452.411148][ T4287] process_one_work+0x8a2/0x1160 [ 1452.416179][ T4287] worker_thread+0xaa2/0x1270 [ 1452.420933][ T4287] kthread+0x29d/0x330 [ 1452.425070][ T4287] ret_from_fork+0x1f/0x30 [ 1452.429565][ T4287] [ 1452.431928][ T4287] Freed by task 21966: [ 1452.436035][ T4287] kasan_set_track+0x4b/0x70 [ 1452.440719][ T4287] kasan_save_free_info+0x2d/0x50 [ 1452.445840][ T4287] ____kasan_slab_free+0x126/0x1e0 [ 1452.451057][ T4287] slab_free_freelist_hook+0x131/0x1a0 [ 1452.456611][ T4287] __kmem_cache_free+0xb6/0x1f0 [ 1452.461546][ T4287] l2cap_sock_cleanup_listen+0xea/0x270 [ 1452.467166][ T4287] l2cap_sock_release+0x66/0x1e0 [ 1452.472276][ T4287] sock_close+0xd5/0x240 [ 1452.476628][ T4287] __fput+0x22c/0x920 [ 1452.480759][ T4287] task_work_run+0x1d0/0x260 [ 1452.485449][ T4287] exit_to_user_mode_loop+0xe6/0x110 [ 1452.490869][ T4287] exit_to_user_mode_prepare+0xee/0x180 [ 1452.496544][ T4287] syscall_exit_to_user_mode+0x16/0x40 [ 1452.502061][ T4287] do_syscall_64+0x58/0xa0 [ 1452.506579][ T4287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1452.512547][ T4287] [ 1452.514918][ T4287] Last potentially related work creation: [ 1452.520680][ T4287] kasan_save_stack+0x3a/0x60 [ 1452.525434][ T4287] __kasan_record_aux_stack+0xb2/0xc0 [ 1452.530864][ T4287] call_rcu+0x14f/0x990 [ 1452.535146][ T4287] netlink_release+0x158e/0x19e0 [ 1452.540252][ T4287] sock_close+0xd5/0x240 [ 1452.544559][ T4287] __fput+0x22c/0x920 [ 1452.548612][ T4287] task_work_run+0x1d0/0x260 [ 1452.553293][ T4287] exit_to_user_mode_loop+0xe6/0x110 [ 1452.558692][ T4287] exit_to_user_mode_prepare+0xee/0x180 [ 1452.564374][ T4287] syscall_exit_to_user_mode+0x16/0x40 [ 1452.569925][ T4287] do_syscall_64+0x58/0xa0 [ 1452.574413][ T4287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1452.580443][ T4287] [ 1452.582861][ T4287] Second to last potentially related work creation: [ 1452.589492][ T4287] kasan_save_stack+0x3a/0x60 [ 1452.594264][ T4287] __kasan_record_aux_stack+0xb2/0xc0 [ 1452.599682][ T4287] call_rcu+0x14f/0x990 [ 1452.603945][ T4287] netlink_release+0x158e/0x19e0 [ 1452.609001][ T4287] sock_close+0xd5/0x240 [ 1452.613298][ T4287] __fput+0x22c/0x920 [ 1452.617365][ T4287] task_work_run+0x1d0/0x260 [ 1452.622054][ T4287] exit_to_user_mode_loop+0xe6/0x110 [ 1452.627439][ T4287] exit_to_user_mode_prepare+0xee/0x180 [ 1452.633081][ T4287] syscall_exit_to_user_mode+0x16/0x40 [ 1452.638632][ T4287] do_syscall_64+0x58/0xa0 [ 1452.643140][ T4287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1452.649129][ T4287] [ 1452.651490][ T4287] The buggy address belongs to the object at ffff888059750000 [ 1452.651490][ T4287] which belongs to the cache kmalloc-2k of size 2048 [ 1452.665612][ T4287] The buggy address is located 1176 bytes inside of [ 1452.665612][ T4287] 2048-byte region [ffff888059750000, ffff888059750800) [ 1452.679152][ T4287] [ 1452.681532][ T4287] The buggy address belongs to the physical page: [ 1452.687980][ T4287] page:ffffea000165d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59750 [ 1452.698188][ T4287] head:ffffea000165d400 order:3 compound_mapcount:0 compound_pincount:0 [ 1452.706588][ T4287] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 1452.714631][ T4287] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888017442000 [ 1452.723285][ T4287] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 1452.731932][ T4287] page dumped because: kasan: bad access detected [ 1452.738388][ T4287] page_owner tracks the page as allocated [ 1452.744148][ T4287] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 13342, tgid 13342 (syz-executor), ts 614420007483, free_ts 614397598008 [ 1452.766734][ T4287] post_alloc_hook+0x173/0x1a0 [ 1452.771580][ T4287] get_page_from_freelist+0x1a1e/0x1ab0 [ 1452.777212][ T4287] __alloc_pages+0x1ec/0x4f0 [ 1452.781965][ T4287] alloc_slab_page+0x5d/0x160 [ 1452.786734][ T4287] new_slab+0x87/0x2c0 [ 1452.790898][ T4287] ___slab_alloc+0xbc6/0x1240 [ 1452.795659][ T4287] __kmem_cache_alloc_node+0x1a0/0x260 [ 1452.801180][ T4287] __kmalloc_node_track_caller+0x9e/0x230 [ 1452.807002][ T4287] __alloc_skb+0x22a/0x7e0 [ 1452.811459][ T4287] inet6_ifinfo_notify+0x6c/0x110 [ 1452.816567][ T4287] addrconf_notify+0xc4c/0xf40 [ 1452.821362][ T4287] raw_notifier_call_chain+0xcb/0x160 [ 1452.826765][ T4287] __dev_notify_flags+0x1a6/0x310 [ 1452.831855][ T4287] dev_change_flags+0xe4/0x1a0 [ 1452.836651][ T4287] do_setlink+0xba1/0x3e60 [ 1452.841209][ T4287] rtnl_newlink+0x17d9/0x20a0 [ 1452.845931][ T4287] page last free stack trace: [ 1452.850619][ T4287] free_unref_page_prepare+0x8b4/0x9a0 [ 1452.856204][ T4287] free_unref_page+0x2e/0x3f0 [ 1452.860929][ T4287] __unfreeze_partials+0x1a5/0x200 [ 1452.866067][ T4287] put_cpu_partial+0x17c/0x250 [ 1452.870861][ T4287] qlist_free_all+0x76/0xe0 [ 1452.875391][ T4287] kasan_quarantine_reduce+0x144/0x160 [ 1452.880880][ T4287] __kasan_slab_alloc+0x1e/0x80 [ 1452.885771][ T4287] slab_post_alloc_hook+0x4b/0x480 [ 1452.890917][ T4287] kmem_cache_alloc_node+0x14d/0x320 [ 1452.896241][ T4287] __alloc_skb+0xfc/0x7e0 [ 1452.900623][ T4287] netlink_sendmsg+0x654/0xbd0 [ 1452.905418][ T4287] __sys_sendto+0x497/0x650 [ 1452.910007][ T4287] __x64_sys_sendto+0xda/0xf0 [ 1452.914712][ T4287] do_syscall_64+0x4c/0xa0 [ 1452.919165][ T4287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1452.925097][ T4287] [ 1452.927435][ T4287] Memory state around the buggy address: [ 1452.933099][ T4287] ffff888059750380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1452.941211][ T4287] ffff888059750400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1452.949303][ T4287] >ffff888059750480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1452.957387][ T4287] ^ [ 1452.962261][ T4287] ffff888059750500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1452.970352][ T4287] ffff888059750580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1452.978439][ T4287] ================================================================== [ 1453.017003][ T4287] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1453.024242][ T4287] CPU: 0 PID: 4287 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 1453.031859][ T4287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1453.042061][ T4287] Workqueue: hci6 hci_rx_work [ 1453.046765][ T4287] Call Trace: [ 1453.050056][ T4287] [ 1453.053007][ T4287] dump_stack_lvl+0x188/0x24e [ 1453.057714][ T4287] ? memcpy+0x3c/0x60 [ 1453.061702][ T4287] ? show_regs_print_info+0x12/0x12 [ 1453.066912][ T4287] ? load_image+0x400/0x400 [ 1453.071435][ T4287] panic+0x2e5/0x730 [ 1453.075363][ T4287] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1453.081555][ T4287] ? bpf_jit_dump+0xd0/0xd0 [ 1453.086082][ T4287] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 1453.092184][ T4287] ? _raw_spin_unlock+0x40/0x40 [ 1453.097054][ T4287] check_panic_on_warn+0x80/0xa0 [ 1453.102175][ T4287] ? l2cap_connect_cfm+0x700/0x1120 [ 1453.107401][ T4287] end_report+0x66/0x110 [ 1453.111670][ T4287] kasan_report+0x118/0x140 [ 1453.116187][ T4287] ? l2cap_connect_cfm+0x700/0x1120 [ 1453.121402][ T4287] l2cap_connect_cfm+0x700/0x1120 [ 1453.126445][ T4287] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 1453.131742][ T4287] ? hci_connect_cfm+0x86/0x130 [ 1453.136614][ T4287] ? l2cap_connect_cfm+0x4/0x1120 [ 1453.141650][ T4287] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 1453.147056][ T4287] hci_connect_cfm+0x8f/0x130 [ 1453.151751][ T4287] le_conn_complete_evt+0x10ef/0x1670 [ 1453.157142][ T4287] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 1453.163408][ T4287] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 1453.169086][ T4287] ? skb_pull_data+0xf7/0x200 [ 1453.173775][ T4287] hci_le_conn_complete_evt+0x183/0x440 [ 1453.179344][ T4287] ? hci_remote_host_features_evt+0x270/0x270 [ 1453.185430][ T4287] hci_event_packet+0x7b9/0x1280 [ 1453.190390][ T4287] ? bis_list+0x280/0x280 [ 1453.194740][ T4287] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 1453.200651][ T4287] ? kcov_remote_start+0x4c7/0x7e0 [ 1453.205781][ T4287] ? spurious_interrupt+0x30/0xd0 [ 1453.210820][ T4287] ? hci_send_to_monitor+0x9c/0x4a0 [ 1453.216040][ T4287] hci_rx_work+0x3eb/0xd40 [ 1453.220481][ T4287] ? _raw_spin_unlock+0x40/0x40 [ 1453.225343][ T4287] ? process_one_work+0x7b0/0x1160 [ 1453.230468][ T4287] process_one_work+0x8a2/0x1160 [ 1453.235428][ T4287] ? worker_detach_from_pool+0x240/0x240 [ 1453.241087][ T4287] ? _raw_spin_lock_irq+0xb7/0xf0 [ 1453.246158][ T4287] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1453.251733][ T4287] ? kthread_data+0x4b/0xc0 [ 1453.256283][ T4287] worker_thread+0xaa2/0x1270 [ 1453.260996][ T4287] kthread+0x29d/0x330 [ 1453.265090][ T4287] ? worker_clr_flags+0x1a0/0x1a0 [ 1453.270134][ T4287] ? kthread_blkcg+0xd0/0xd0 [ 1453.274745][ T4287] ret_from_fork+0x1f/0x30 [ 1453.279197][ T4287] [ 1453.282800][ T4287] Kernel Offset: disabled [ 1453.287151][ T4287] Rebooting in 86400 seconds..