last executing test programs: 20m37.021108771s ago: executing program 0 (id=695): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x181600, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {}, {0xfff3, 0x1f}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x20000001, 0x3, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x50}, 0x20040800) 20m36.806365794s ago: executing program 0 (id=696): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x44, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x4908d13283d17e6b, 0x0, 0x6, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x44}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000700697036746e6c00002c000280140003002001000000000000000000000000000114000200fc02"], 0x5c}}, 0x0) 20m36.607386115s ago: executing program 0 (id=697): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, r1, 0x1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {0x0, r2, r0}}, 0x18) 20m36.435900162s ago: executing program 0 (id=699): r0 = syz_open_procfs(0x0, &(0x7f00000015c0)='limits\x00') utimensat(r0, 0x0, &(0x7f0000000040)={{0x0, 0x3ffffffe}, {0x0, 0x3fffffff}}, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) (async) io_setup(0x8, &(0x7f0000004200)=0x0) (async) ioctl$VT_DISALLOCATE(r0, 0x5608) (async) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x410b83, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) (async) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) (async) r6 = socket(0x1d, 0x2, 0x6) io_submit(r3, 0x1, &(0x7f0000000100)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) (async) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00', @ANYRES16=r2, @ANYBLOB="0800a4"], 0x24}, 0x1, 0x0, 0x0, 0x11}, 0x4000840) (async) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB=' \x00\x00', @ANYRES16=r2, @ANYBLOB="000226bd7000fddbdf250f00000008000300", @ANYRES32=0x0, @ANYBLOB="04001601"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x20008000) (async) mlock2(&(0x7f0000751000/0x3000)=nil, 0x3000, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xbecda000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000023000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) io_pgetevents(r3, 0x8, 0x8, &(0x7f0000000340)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000440)={0x0, 0x989680}, &(0x7f00000004c0)={&(0x7f0000000480)={[0x6]}, 0x8}) (async) io_uring_setup(0x22, &(0x7f0000000040)={0x0, 0x3503, 0x200, 0x1, 0x15d, 0x0, r0}) (async) munlockall() (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) mount_setattr(r5, &(0x7f00000001c0)='./file0\x00', 0x8900, &(0x7f0000000240)={0x100080, 0x70, 0x20000, {r0}}, 0x20) (async) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007500)=ANY=[@ANYBLOB="300000003e0007010000090000000000017c00000440fc800f0001806d14314965356e0300d20000080002"], 0x30}, 0x1, 0x0, 0x0, 0x20008020}, 0xc040) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000180)=0xb8b9) 20m36.062943696s ago: executing program 0 (id=701): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32={[0x0, 0x0, 0xfeffffff]}}], 0x1001a) dup(0xffffffffffffffff) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 20m35.758221488s ago: executing program 0 (id=705): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000240)={0x1, [0x2]}, &(0x7f00000002c0)=0x6) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x28, 0x0, 0xd, 0xfffff034}, {0x50, 0x0, 0x5, 0xfffffffd}, {0x6, 0x0, 0x2, 0xffffffff}]}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) sendmsg$kcm(r3, &(0x7f0000000b00)={&(0x7f0000000780)=@tipc=@name={0x1e, 0x2, 0x0, {{0x2, 0x3}, 0x1}}, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000000840)=[{0x88, 0x122, 0x9, "e37662fe86f7e55f16602cbe5b137eb78b71a8109b770764a9f3081f8b79ec59ed102fadae639f7e2a530fc782de03363fc68fd9043cf4eef2c929b477828f5e94c8a670af2ea961becfb5dc675c74b3f849f6d1fa8c9d0397e45ddf6bbb67a9cf251688b1f558d15184062eff568832750bc835949cfd"}, {0x40, 0x107, 0x8, "31e2ad893c70d62886102d31c7a10f8aabd36809c93466b93694f0db011863d5766feb40f3e9f1dd3e8a8f7156"}, {0x58, 0x10c, 0x9, "f09e818d751932a0ddd499f3ca8dc43ec323d0b984411783dcbdda4835994c2b12a316bc8a698cd434a0037fcfff4737c59ef4203daaab155987a13224ed10722e55d1"}, {0x30, 0x11, 0xf986, "3a0c032156250ca5b0e57044465d14e85c9f7a164d04ba7a9c"}, {0xd8, 0x112, 0x1f6, "e91237f30fc797e177d82ff082b59c6cb1aeeececf8a0ce9ea23c886c067f7a920c2481cc059dc733f78cf46316fcda68eca83b642380b78018c78733e112c5f7c82d26781fa1090f839336aacdabd1680fdff9e15a3bf7d04799c55ed821e4e0b0b9c40d47b32b87e1137d998023a658226b15ed3f325698b171e5c2989fee135ffbc763274f6e3042b580709be914e49e9aa785d1c3b2960ab208ea08e97a94b88a56be51be791a49c81382d0319a468c0e299c8ff11eb6162311057817b0279e80ce208"}, {0x60, 0x10c, 0x4, "c9460081194215a8af6a3a2cfee72697c05a38134792f21d35227a41381e0c99517f6d51551d82566285ff3be0414fb8fb21f54f824438e40f4687b2e628153b67d9cb8432f55b2845"}], 0x288}, 0x4010) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x13}}) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000040), 0x4) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) unshare(0x2a020400) ioctl$TIOCMSET(r4, 0x5418, 0x0) syz_extract_tcp_res(&(0x7f00000000c0)={0x41424344}, 0xe9d, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x2}) ioctl$KDSKBLED(r4, 0x4b65, 0x7) syz_extract_tcp_res$synack(&(0x7f0000000340)={0x41424344}, 0x1, 0x0) syz_extract_tcp_res(&(0x7f0000000380)={0x41424344, 0x41424344}, 0x5, 0x5) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0xd, 0xfffffffe, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c}, {@in=@broadcast, 0x0, 0x6c}, @in=@multicast2, {0x0, 0x192, 0x9ba3, 0xffff, 0x251c, 0x3, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x21}, {0x0, 0x0, 0x1}, 0x80, 0x3502, 0x2, 0x4}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) write$tun(r6, &(0x7f0000000500)={@val={0x0, 0x88f5}, @void, @eth={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xa8c298495af9f4a6}, @val={@val, {0x8100, 0x0, 0x0, 0x20}}, {@ipv4={0x800, @tcp={{0xe, 0x4, 0x3, 0x12, 0x74, 0x68, 0x0, 0xc, 0x6, 0x0, @local, @local, {[@noop, @rr={0x7, 0x1f, 0xa4, [@empty, @broadcast, @loopback, @dev={0xac, 0x14, 0x14, 0x2c}, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @noop]}}, {{0x4e20, 0x4e21, r7, r8, 0x0, 0x0, 0xf, 0xc2, 0x3, 0x0, 0x4617, {[@mptcp=@add_addr={0x1e, 0xe, 0x0, 0xe, 0x3, @multicast2, 0x8001, "8f273e18"}, @exp_smc={0xfe, 0x6}, @exp_fastopen={0xfe, 0x14, 0xf989, "307fc5c91a9cc8d6336ed337812b2814"}]}}}}}}}}, 0x8e) write$tun(r2, &(0x7f0000000380)={@void, @val={0x0, 0x0, 0x12}, @ipv6=@tcp={0x6, 0x6, "5c6db3", 0x39e, 0x6, 0x1, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {[@hopopts={0x3b, 0x3, '\x00', [@calipso={0x7, 0x18, {0x1, 0x4, 0x7, 0x6, [0x0, 0x5]}}]}, @srh={0x8, 0xc, 0x4, 0x6, 0x8, 0x70, 0x5, [@mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x37}, @loopback, @mcast2, @private2]}, @routing={0x1, 0x2, 0x2, 0x1, 0x0, [@private2={0xfc, 0x2, '\x00', 0x4}]}, @dstopts={0x2e, 0x12, '\x00', [@pad1, @generic={0x1, 0x88, "7f8ac02cb4e4cc9c086d3213755d62a752f2da77c21ef710edc98f91fe70d82b3d5b97dd00b9aa6521cc8e2315b8f59f66f273670099b6fb35127cb9973fe05cc58d07c88d50ab06f884c843634d11176e5c38d217836fd94bbe2f441618bbf8717277bf2d6dfed3f238869e20b509c2fb32e78e00724b523ed593941a2cf59bee68f1607a8652b9"}, @ra={0x5, 0x2, 0x1}]}, @srh={0x3b, 0x10, 0x4, 0x8, 0x7, 0x8, 0x9e1, [@private2, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, @dev={0xfe, 0x80, '\x00', 0x15}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}, @routing={0x32, 0x0, 0x4, 0x40}, @fragment={0x2b, 0x0, 0x1, 0x1, 0x0, 0x10, 0x68}, @srh={0x2, 0xc, 0x4, 0x6, 0x3, 0x20, 0x4, [@local, @ipv4={'\x00', '\xff\xff', @private=0xfffffe00}, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @private2={0xfc, 0x2, '\x00', 0x1}]}, @dstopts={0x32, 0x2, '\x00', [@pad1, @enc_lim={0x4, 0x1, 0xb}, @calipso={0x7, 0x8, {0x2, 0x0, 0x3, 0x7}}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}]}], {{0x4e23, 0x4e24, r5, r8, 0x0, 0x0, 0x1f, 0x10, 0x8, 0x0, 0x9, {[@sack={0x5, 0x12, [0x0, 0xfffffffe, 0x7fff, 0x5]}, @window={0x3, 0x3, 0x2}, @mptcp=@mp_fclose={0x1e, 0xc, 0x81, 0x0, 0x9}, @exp_fastopen={0xfe, 0xb, 0xf989, "2f0e0be163799b"}, @fastopen={0x22, 0xf, "f67b2b6906c6b7328683c7abe8"}, @md5sig={0x13, 0x12, "51010cc42cfc594172bfbf28ebc41180"}, @sack_perm={0x4, 0x2}, @exp_smc={0xfe, 0x6}, @sack_perm={0x4, 0x2}, @exp_fastopen={0xfe, 0x10, 0xf989, "cb8fc3a7b090166bf4176c5c"}]}}, {"c5ec2ecd6f0d46c0662f89453e4e58f2f13bc3102e8bcc8e818d39c4b65d5fc44cfcb94ae2e019e97dd85a059d73ee1a8dae77af083fb008adf635d6bd96b280269163b35419e82c45961711777c93664919168b6c4b6711eb6488e08ee031c1a415d803416b725f9a9f67e1e5a5acbdc0f7cb8a934c6e2be10762e4537b0ae4ba421e6e0ff2cda87c0e3b0f5288d4089de01726b3008b1c9f57b16426959823df1c9be600c288b5f01a3a7bc87f2e1ff861fd1a3189e8255b22"}}}}}, 0x3d0) 20m35.399837148s ago: executing program 32 (id=705): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000240)={0x1, [0x2]}, &(0x7f00000002c0)=0x6) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x28, 0x0, 0xd, 0xfffff034}, {0x50, 0x0, 0x5, 0xfffffffd}, {0x6, 0x0, 0x2, 0xffffffff}]}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) sendmsg$kcm(r3, &(0x7f0000000b00)={&(0x7f0000000780)=@tipc=@name={0x1e, 0x2, 0x0, {{0x2, 0x3}, 0x1}}, 0x80, &(0x7f0000000800), 0x0, &(0x7f0000000840)=[{0x88, 0x122, 0x9, "e37662fe86f7e55f16602cbe5b137eb78b71a8109b770764a9f3081f8b79ec59ed102fadae639f7e2a530fc782de03363fc68fd9043cf4eef2c929b477828f5e94c8a670af2ea961becfb5dc675c74b3f849f6d1fa8c9d0397e45ddf6bbb67a9cf251688b1f558d15184062eff568832750bc835949cfd"}, {0x40, 0x107, 0x8, "31e2ad893c70d62886102d31c7a10f8aabd36809c93466b93694f0db011863d5766feb40f3e9f1dd3e8a8f7156"}, {0x58, 0x10c, 0x9, "f09e818d751932a0ddd499f3ca8dc43ec323d0b984411783dcbdda4835994c2b12a316bc8a698cd434a0037fcfff4737c59ef4203daaab155987a13224ed10722e55d1"}, {0x30, 0x11, 0xf986, "3a0c032156250ca5b0e57044465d14e85c9f7a164d04ba7a9c"}, {0xd8, 0x112, 0x1f6, "e91237f30fc797e177d82ff082b59c6cb1aeeececf8a0ce9ea23c886c067f7a920c2481cc059dc733f78cf46316fcda68eca83b642380b78018c78733e112c5f7c82d26781fa1090f839336aacdabd1680fdff9e15a3bf7d04799c55ed821e4e0b0b9c40d47b32b87e1137d998023a658226b15ed3f325698b171e5c2989fee135ffbc763274f6e3042b580709be914e49e9aa785d1c3b2960ab208ea08e97a94b88a56be51be791a49c81382d0319a468c0e299c8ff11eb6162311057817b0279e80ce208"}, {0x60, 0x10c, 0x4, "c9460081194215a8af6a3a2cfee72697c05a38134792f21d35227a41381e0c99517f6d51551d82566285ff3be0414fb8fb21f54f824438e40f4687b2e628153b67d9cb8432f55b2845"}], 0x288}, 0x4010) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x13}}) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000040), 0x4) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) unshare(0x2a020400) ioctl$TIOCMSET(r4, 0x5418, 0x0) syz_extract_tcp_res(&(0x7f00000000c0)={0x41424344}, 0xe9d, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x2}) ioctl$KDSKBLED(r4, 0x4b65, 0x7) syz_extract_tcp_res$synack(&(0x7f0000000340)={0x41424344}, 0x1, 0x0) syz_extract_tcp_res(&(0x7f0000000380)={0x41424344, 0x41424344}, 0x5, 0x5) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0xd, 0xfffffffe, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c}, {@in=@broadcast, 0x0, 0x6c}, @in=@multicast2, {0x0, 0x192, 0x9ba3, 0xffff, 0x251c, 0x3, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x21}, {0x0, 0x0, 0x1}, 0x80, 0x3502, 0x2, 0x4}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) write$tun(r6, &(0x7f0000000500)={@val={0x0, 0x88f5}, @void, @eth={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xa8c298495af9f4a6}, @val={@val, {0x8100, 0x0, 0x0, 0x20}}, {@ipv4={0x800, @tcp={{0xe, 0x4, 0x3, 0x12, 0x74, 0x68, 0x0, 0xc, 0x6, 0x0, @local, @local, {[@noop, @rr={0x7, 0x1f, 0xa4, [@empty, @broadcast, @loopback, @dev={0xac, 0x14, 0x14, 0x2c}, @multicast1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @noop]}}, {{0x4e20, 0x4e21, r7, r8, 0x0, 0x0, 0xf, 0xc2, 0x3, 0x0, 0x4617, {[@mptcp=@add_addr={0x1e, 0xe, 0x0, 0xe, 0x3, @multicast2, 0x8001, "8f273e18"}, @exp_smc={0xfe, 0x6}, @exp_fastopen={0xfe, 0x14, 0xf989, "307fc5c91a9cc8d6336ed337812b2814"}]}}}}}}}}, 0x8e) write$tun(r2, &(0x7f0000000380)={@void, @val={0x0, 0x0, 0x12}, @ipv6=@tcp={0x6, 0x6, "5c6db3", 0x39e, 0x6, 0x1, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {[@hopopts={0x3b, 0x3, '\x00', [@calipso={0x7, 0x18, {0x1, 0x4, 0x7, 0x6, [0x0, 0x5]}}]}, @srh={0x8, 0xc, 0x4, 0x6, 0x8, 0x70, 0x5, [@mcast1, @loopback, @dev={0xfe, 0x80, '\x00', 0x37}, @loopback, @mcast2, @private2]}, @routing={0x1, 0x2, 0x2, 0x1, 0x0, [@private2={0xfc, 0x2, '\x00', 0x4}]}, @dstopts={0x2e, 0x12, '\x00', [@pad1, @generic={0x1, 0x88, "7f8ac02cb4e4cc9c086d3213755d62a752f2da77c21ef710edc98f91fe70d82b3d5b97dd00b9aa6521cc8e2315b8f59f66f273670099b6fb35127cb9973fe05cc58d07c88d50ab06f884c843634d11176e5c38d217836fd94bbe2f441618bbf8717277bf2d6dfed3f238869e20b509c2fb32e78e00724b523ed593941a2cf59bee68f1607a8652b9"}, @ra={0x5, 0x2, 0x1}]}, @srh={0x3b, 0x10, 0x4, 0x8, 0x7, 0x8, 0x9e1, [@private2, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, @dev={0xfe, 0x80, '\x00', 0x15}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}, @routing={0x32, 0x0, 0x4, 0x40}, @fragment={0x2b, 0x0, 0x1, 0x1, 0x0, 0x10, 0x68}, @srh={0x2, 0xc, 0x4, 0x6, 0x3, 0x20, 0x4, [@local, @ipv4={'\x00', '\xff\xff', @private=0xfffffe00}, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @private2={0xfc, 0x2, '\x00', 0x1}]}, @dstopts={0x32, 0x2, '\x00', [@pad1, @enc_lim={0x4, 0x1, 0xb}, @calipso={0x7, 0x8, {0x2, 0x0, 0x3, 0x7}}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}]}], {{0x4e23, 0x4e24, r5, r8, 0x0, 0x0, 0x1f, 0x10, 0x8, 0x0, 0x9, {[@sack={0x5, 0x12, [0x0, 0xfffffffe, 0x7fff, 0x5]}, @window={0x3, 0x3, 0x2}, @mptcp=@mp_fclose={0x1e, 0xc, 0x81, 0x0, 0x9}, @exp_fastopen={0xfe, 0xb, 0xf989, "2f0e0be163799b"}, @fastopen={0x22, 0xf, "f67b2b6906c6b7328683c7abe8"}, @md5sig={0x13, 0x12, "51010cc42cfc594172bfbf28ebc41180"}, @sack_perm={0x4, 0x2}, @exp_smc={0xfe, 0x6}, @sack_perm={0x4, 0x2}, @exp_fastopen={0xfe, 0x10, 0xf989, "cb8fc3a7b090166bf4176c5c"}]}}, {"c5ec2ecd6f0d46c0662f89453e4e58f2f13bc3102e8bcc8e818d39c4b65d5fc44cfcb94ae2e019e97dd85a059d73ee1a8dae77af083fb008adf635d6bd96b280269163b35419e82c45961711777c93664919168b6c4b6711eb6488e08ee031c1a415d803416b725f9a9f67e1e5a5acbdc0f7cb8a934c6e2be10762e4537b0ae4ba421e6e0ff2cda87c0e3b0f5288d4089de01726b3008b1c9f57b16426959823df1c9be600c288b5f01a3a7bc87f2e1ff861fd1a3189e8255b22"}}}}}, 0x3d0) 16m42.447119769s ago: executing program 1 (id=1864): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000440)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000100)={0x0, 0x0, r1, r2, 0x3, 0xe, 0x7f000, 0xffffffff, {0xabaf, 0x9, 0x2, 0x4, 0xffff, 0x8, 0x83, 0x0, 0x61ee, 0x4, 0x0, 0x5, 0x49, 0x1000ff, "3cbc98cff6cf0000000000dd0000000000000000003b00"}}) 16m41.959615187s ago: executing program 1 (id=1866): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4b0, 0x158, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3e0, 0xffffffff, 0xffffffff, 0x3e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xff], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x138, 0x158, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0x2}, {0x7f}], 0x2, 0x2}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @unspec=@NOTRACK={0x20}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [0x0, 0xffffffff], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x5, 0x41, 0x0, 0x2, 0x1800, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x510) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4a8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3d8, 0xffffffff, 0xffffffff, 0x3d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast1, [0x0, 0x0, 0x0, 0xff0000ff], [0x0, 0x0, 0x700], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x4}, 0x0, 0x128, 0x150, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x81, 0x0, 0x9}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e6, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'team0\x00', {0x7, 0x40, 0x41, 0x9, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x78}, {0xc5}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x508) 16m41.888315396s ago: executing program 1 (id=1867): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0xfffff801}, @NFTA_NG_DREG={0x8}, @NFTA_NG_OFFSET={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, 'u'}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000040)={0x5, 0x3}) 16m41.779432808s ago: executing program 1 (id=1868): mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(0xffffffffffffffff, 0x110, 0x5, &(0x7f0000000100)=[0x3, 0x4], 0x2) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000040)={@private2={0xfc, 0x2, '\x00', 0x1}}, 0x14) socket$inet6_udp(0xa, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x89801) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x20000, 0x0) 16m40.770713178s ago: executing program 1 (id=1872): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') read$FUSE(r0, 0x0, 0x500) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = fsopen(&(0x7f00000000c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fchdir(r4) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r6, 0x84, 0x13, &(0x7f00000000c0)=0x3ff, 0x4) write$binfmt_script(r5, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xffffffffffffbfff, 0x2) 16m40.297683118s ago: executing program 1 (id=1878): ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000000080)={0x6, {"7fb13911afb5ea7f027063aa876dd358", "cfe484e50900", "d9ca451d96249a1dee77476cc87f7d0a"}, 0x6}) r0 = gettid() syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x800) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x0, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0xc3e, 0x7e, 0x2}) ioctl$XFS_IOC_AG_GEOMETRY(0xffffffffffffffff, 0xc080583d, &(0x7f00000000c0)={0x5, 0x7, 0x100, 0x1, 0xc9, 0x40, 0x8000c, 0xdf4}) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 16m39.856444844s ago: executing program 33 (id=1878): ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(0xffffffffffffffff, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000000080)={0x6, {"7fb13911afb5ea7f027063aa876dd358", "cfe484e50900", "d9ca451d96249a1dee77476cc87f7d0a"}, 0x6}) r0 = gettid() syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x800) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x0, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0xc3e, 0x7e, 0x2}) ioctl$XFS_IOC_AG_GEOMETRY(0xffffffffffffffff, 0xc080583d, &(0x7f00000000c0)={0x5, 0x7, 0x100, 0x1, 0xc9, 0x40, 0x8000c, 0xdf4}) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 10.610739363s ago: executing program 4 (id=7078): syz_open_dev$tty1(0xc, 0x4, 0x3) (async) r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) writev(r0, &(0x7f0000003340)=[{&(0x7f00000000c0)="4f3bf5835e000000002251a1d6958c78cfc0e1f14f1b257f40", 0x19}], 0x1) syz_usb_connect$cdc_ncm(0x3, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0000000000000000000006241a0000000905810300020300000904010000020d00000904010102020d0000090582020002000000090503020002"], 0x0) (async) r1 = syz_usb_connect$cdc_ncm(0x3, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0000000000000000000006241a0000000905810300020300000904010000020d00000904010102020d0000090582020002000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_emit_ethernet(0xbe, &(0x7f0000000b80)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0xfd, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x32, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x37}, {[@cipso={0x86, 0x71, 0x3, [{0x0, 0xc, "e256b28c04000000fb52"}, {0x0, 0x9, "789607675ca638"}, {0x0, 0xe, "7434954373561de584b703c8"}, {0x2, 0x9, "e706d30bd224f8"}, {0x6, 0x7, "cfa11cab1a"}, {0x0, 0x10, "c600"/14}, {0x0, 0xa, "65807fe97612fe86"}, {0x0, 0x12, "73bc2300ad9d19a30000000000000000"}, {0x6, 0xc, "c8f46976e79e56c7a95e"}]}, @cipso={0x86, 0xc, 0x2, [{0x1, 0x6, "7f36c525"}]}]}}}}}}}, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000140)={0x14, &(0x7f0000000000)={0x0, 0x9, 0x52, {0x52, 0x31, "3a7b768d3f5c74fd96b8781a24fe9b0e38c56c07df076bd2094d290e22700e013d9b9f4e88570dc205b1101f63e29993a6cde0e41fcb0b4d2d6b9aa988f4652b5bc2a3081cc0e9964573bac7521aca1c"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}}, &(0x7f00000004c0)={0x34, &(0x7f0000000240)={0x40, 0xd, 0xa4, "f52a22064449268e412a6dea8cb7100bd55d7d0653d72c1058fdb61d0597e42789506359c4469230a1aa416d8d3397156f3ea57e12a94c7f5d8134b779c69de3e8df6ff4b56a33becd18d3e1e0261840a57c3484a59fa0471c8fb5fb964f24567f602a1066a770cfc0823ccbf9cc6df7df3170821ceb0903afa6119cd957beee790fc3efe907d93f960afefb74b05df74432ba34ef1e6726108301c00004adb2333231fd"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x4d}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000400)={0x20, 0x0, 0x1d, {0x1b, "e67ac2704734c51ba85269d836551f0f51393bf5a68396c1d33cee"}}, &(0x7f0000000440)={0x20, 0x1, 0x1, 0x9}, &(0x7f0000000480)={0x20, 0x0, 0x1, 0x6}}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) 8.800241128s ago: executing program 4 (id=7086): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000380)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x2, 0x18, 0x0, 0xe, 0x7, 0x0, 0x0, 0x0, [@sadb_x_filter={0x5, 0x1a, @in6=@mcast2, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x29, 0x10, 0x10}]}, 0x38}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x4e24, 0x40, @local, 0x1}]}, &(0x7f0000000100)=0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETRULE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x20, 0x7, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040}, 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00v'], 0x24}, 0x1, 0x5502000000000000}, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) ioctl$BLKTRACESETUP(r9, 0xc0401273, &(0x7f0000000680)={'\x00', 0x8001, 0x101, 0x5308, 0xfffffffffffffffb, 0x40000, 0xffffffffffffffff}) r10 = dup(r9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r10, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001000010700020100000000000a0000000600010016"], 0x1c}}, 0x0) r11 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$KVM_GET_XSAVE(r10, 0x9000aea4, &(0x7f0000000700)) ioctl$FS_IOC_GETVERSION(r11, 0x80047601, &(0x7f00000003c0)) close(0x3) 7.31115122s ago: executing program 2 (id=7091): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000096c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x2400c0c1}, 0x8000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000480)}) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x23, 0x0, 0x0) r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x188300, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000040)={0x356, 0x160, 0x10, 0x3f, 0xaa, 0x1, 0x0, 0x0, {}, {0x0, 0x3000000}, {}, {}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x10000004, 0x0, 0x6, 0xfffffffe, 0xfffffffd, 0x0, 0x8, 0x4, 0x0, 0x0, 0xa}) 6.713569368s ago: executing program 2 (id=7095): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000007f326fae5800"/28], 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0x18, 0x2, 0x1) sendmsg$FOU_CMD_GET(r2, &(0x7f00000008c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000040}, 0x4028081) socket$packet(0x11, 0x2, 0x300) sendmsg$key(0xffffffffffffffff, 0x0, 0x2000c804) mkdirat(0xffffffffffffff9c, 0x0, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f00000004c0)='./file0\x00', 0x80000000) inotify_add_watch(r3, &(0x7f0000000080)='./file0\x00', 0x44000004) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001ec0)=ANY=[@ANYBLOB="340000003e0007012bbd700000000000010100080400fc800c00018008000600", @ANYRES32=0x0, @ANYBLOB="080002800400338008000900", @ANYRES32=r4], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x60842, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, 0x0}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_GET_LAPIC(r7, 0x8400ae8e, &(0x7f0000000400)) openat$audio(0xffffffffffffff9c, &(0x7f00000002c0), 0x100, 0x0) close_range(r6, r7, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @empty}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bridge0\x00'}]}, 0x50}, 0x1, 0xc3, 0x0, 0x11}, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000200)={@mcast1}, 0x14) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000004200)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0xffffffff92466c96}}, 0x50) 6.543700774s ago: executing program 5 (id=7096): sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_uring_setup(0x267a, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b19, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="84010000210001000000000004000000ffe2ffffffffffffff00000000000001fc02000000000000002000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000034011100e0000001000000000000000000000000ac1414aa000000000000000000000000fc020000000000000000000000000000fe88000000000000000000000000000133040000ff34000002000200fc010000000000000000000000000001fe800000000000000000000000000035ac1414aa000000000000000000000000fc0200000000000000000000000000013c000000000000000a0008000a01010200000000000000000000000000000000000000000000000000000000ac1414aa000000000000000000000000fe8000000000000000000000000000373c0000000535000002000a007f000001000000000000000000000000fe8000000000000000000000000000bbfc010000000000000000000000000001fc00000000000000000000000000000133040000033500000a000200"], 0x184}}, 0x0) bind$tipc(r0, 0x0, 0x0) landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) renameat2(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000200)='.\x02\x00', 0x4) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r0, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/tty/drivers\x00', 0x0, 0x0) fcntl$lock(r3, 0x5, &(0x7f0000000040)={0x0, 0x2, 0x7fffffffffffffff, 0xb}) syz_usb_connect$cdc_ncm(0x3, 0x0, 0x0, 0xfffffffffffffffc) 6.184576631s ago: executing program 4 (id=7097): inotify_init() r0 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000002, 0x9132, 0xffffffffffffffff, 0x2e3dc000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) memfd_secret(0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007bc0)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x201}, @NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8}, @NFTA_OBJ_HANDLE={0xc}]}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x301, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb0}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(0xffffffffffffffff, 0x4068aea3, &(0x7f00000002c0)={0x8f, 0x0, 0x1}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0100000005001000050000000500"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r5}, &(0x7f0000000380), &(0x7f00000003c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r5, 0x0, &(0x7f0000000480)=""/187}, 0x20) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_MMIO(r0, 0x20, &(0x7f0000000100)="64be365de974de7ab149b947a8218d12625b0c29c0496e90", 0x0, 0x18) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ce7000/0x1000)=nil, 0x1000}, 0x1}) close_range(r3, 0xffffffffffffffff, 0x2) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000200000010ac053002400001020301090224000101030000090400040103010206092105000701221e03090581a64fda353a324edbc4bd0121f4b0764308653a1381e40d1c5186536956c8b775f390ba56159bd3b4ec4cc279b665ea855b15f1572746db826697122a85844f73867ea188e8ffffffff226274947b3a61fc4d9c18f98624c0b239204129"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) syz_io_uring_setup(0x63c0, &(0x7f0000000140)={0x0, 0xed77, 0x10, 0x2, 0x45}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000000)) kexec_load(0x0, 0x4, &(0x7f00000003c0)=[{&(0x7f0000000080)="28ac96005005f09b70409a0106d28e1edacb777de32d3dc1fccc15aa2b33f43152f05add533adb05710cec022f093c99f6b312711a2d84b2e11363b1557410629beded5edf", 0x45, 0x8, 0x2}, {&(0x7f0000000240)="ad25c62deb152355e456e0c63cf613979ffe5c1451f560c15b578e5549626a66dd348bc403ea2db1f7d96ab333290e9d29534fcbf82b277e7a676fc7913c607363", 0x41, 0x8, 0x400}, {&(0x7f00000002c0)="42e449c2397392375833473c93f59ddcc9602a81363a036cecbd46af9cefdd584b874f8caa75986618037a38ed2a9004b8ddc335b29f2fb3eb851c5bab9a04d2a5fb9cd5e1c2850c99ba5151c750eb5410e7ab2a000d18d63b66da39a8530ef6b87d38af39236f6e98361093776e528cba7d03768304991b34c45a3cd08f0e8d032c96e23728a65d5d08d5780d89d8b7c63696dfcd132997b6d8cca90170df72f6393d9a9bb7d1733d7b2b2ea958559ef6800dcf4bde2d7c5185278235e5d1", 0xbf, 0x36, 0x2}, {&(0x7f00000001c0)="7f33d1f51f949244d24d86d833f07ada50974f07de72348d844799ff74355f5bd333b3fadfd8e95cb08d0530f0f8e41ec7dcdf23dd35aa89", 0x38, 0x9, 0x3}], 0x140000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) 5.695926574s ago: executing program 6 (id=7101): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socket$isdn(0x22, 0x3, 0x26) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x20, 0xffffffff}, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000340)={0x400000100002f, {0x0, 0x0, 0x5}}) write$uinput_user_dev(r3, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0xf, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x401, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x298, 0x1, 0xfffffffe, 0x0, 0x0, 0x2000, 0x0, 0xfffffffc, 0x0, 0x100, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200, 0x7, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x3, 0x0, 0x1fd, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x4, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x4, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x0, 0x0, 0x0, 0x204, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0xffff7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x2, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xff, 0x0, 0xfffffffa, 0x0, 0x2, 0x0, 0x0, 0x8, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5cb9, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f00000003c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280000001400090a0000000000000000021f4800", @ANYRES32=r6, @ANYBLOB="08000200e4d4c21e080008004c06"], 0x28}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x1000000, 0x0, {0x0, 0x0, 0x74, r6}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) r7 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r7, &(0x7f0000004d80)=[{{&(0x7f0000000100)={0xa, 0xfffd, 0x0, @private0}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000040)="cc41", 0x2}], 0x1}}], 0x1, 0x0) shutdown(r7, 0x1) getsockopt$bt_hci(r7, 0x84, 0x80, &(0x7f00000010c0)=""/4111, &(0x7f0000000000)=0x100f) ioctl$UI_DEV_CREATE(r3, 0x5501) syz_open_dev$dri(&(0x7f0000000180), 0x800000000000001, 0x406002) socket(0x28, 0x1, 0x0) r8 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="68ebffff0106050000009643effa718794000000000000000000ff0700000000000080080008400000001808001255fffffffd0d0003006c6973743a738f7400000000050001000600000014000357f06173683a69702c70"], 0x68}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 5.636563929s ago: executing program 5 (id=7102): r0 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) writev(r1, &(0x7f0000000700)=[{&(0x7f0000000300)="aefdf79d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76632cb010852f426072a", 0x2a}, {&(0x7f00000003c0)="4673c875ca4d9cb6f1d39f1148c805c9a48b6bfad79db2f8ffac454102a0b64722d3f9bc6cd3f362387a706fcab2b62c9cf701191e6f1843142a512f5fb5e28c4537c755c5390b2c44", 0x49}], 0x2) write$UHID_INPUT(r1, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf063a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b124e4ebe0d9883ef100f1934e42794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423b38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f826c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746733d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c1169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a63941564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9fe9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc5492b4e1083a2e3d77215a34abef947b5b9a950e780662de18873e55899c92db3ad3d437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb0466c237376ca2944ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c7c636b3a2b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e4", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000000000002000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300"}}) 5.191100354s ago: executing program 5 (id=7103): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000003c0)={0x24, 0x18, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x0, 0x0, 0x0, @str=':*b\xc3{\x00'}, @typed={0x8, 0x1f, 0x0, 0x0, @fd}]}, 0x24}], 0x1}, 0x0) (async, rerun: 32) syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000220edf104c05c10687c20102030109022400010000ae0009040000024f69960009050f029d82297200090582"], 0x0) (rerun: 32) 4.498267932s ago: executing program 3 (id=7105): socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$AUTOFS_IOC_READY(r0, 0x9360, 0x3) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)={0x0, 0x0}) prlimit64(r1, 0xe, 0x0, &(0x7f00000000c0)) r2 = syz_open_dev$evdev(&(0x7f0000000100), 0x63, 0x14b000) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000140)={0x6, 0x6, 0x1ff, 0x5, 0x3, 0x70}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x8000, 0x3, 0x0, 0xe1}]}) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000001240)={0x12, 0x1000, &(0x7f0000000240)="2616a8d54fd434489000b4d00ca7457635a09d2ec903581882fa40a86ab57cffca14a9d1a99a12b05c52f9f08c9c22ab8fe40df945c4cfbcfdc98785fdbf6de21d4a4f143d37ce1e1d7cef3c931b85b3dfa6eb54aac9f41718bee17db3cde5087fc2ae99a8c9e7c68869b2d5503147919c885f6f20ec39381ad62bc0444dab79b74de2a158a565a3eb1c2bb9f09b333c76a7a7a6629a3e3dab7cee6514e4ddf6fec62b99a72db63fff4c74f41529a377ae6627fa7c0643a28a1315ab1061188a264f43f1cbbbc07c32e50d4e79b039be13ddeaed2d7d4a40b637f1c776abaae8f2e962a09643200c41500f53d310c92a4d2a42bc2208a57efb184bc6adf4ab53651d7d63262666705875623a04adf46fa9e5b15c93d5a4a6af9b5e81a4053796369df849ebbc6a9745bdf5858af9998ff141c812729e8ebb217c683bb93d72ab504d6d1e1d41063b231792837fa59c94399c5f7765315c45a4f0d4830c058b4304e980d3dcb3baeb2e17953b7438e352edd7c8b9ca148c6feecfe693895f698b3a43647cab18043fa0d0c4fedda258c8a3ca1dc4343de7205f28ffa475ccd4f43a6925bb41a349ca26946d70aa629e379bb67cdd47bee9ecc9c5c9d7ccbe4331043d6aea2414efa61f228ec9e2884dcdea83716d4a1e0a2b4f79487daed133854169986efb112a30dd416af0da72f92f8731dc53e0f3f8a3e961beacb172b7f76efe1cf3c8f9abb7580867a13f08640fba0cba9d91d6bb7e8263b2cafe154ec91ec8dcf3af283d5893585cc88383103e18902289f53ecfafd8cc873083b84178c54038c13e093d8981fb82975fb833249085bba25447c5aa115645a61be3eec3aae172af4c997aec4558c0e12a517cc0e4a21849d634cc3de56fc000f0f037ae6796a87253dcc5e9c1e8c0732fac0bf96f473caa417ad501092856c1be4b847612f2de5bfb025c059c4e6492c0fa80b49a25becf8535ba62890811203e8f6b1efa495024a72f8571567c9a1a08144fe0b964ad8ad75d4d097c4ae3d3178e02051acd24c913afc2f6487a333818e20ea92ce80ffa08394ed6accba77fd4b868f8f5b3cb84819632f7f05e56d4d654e9665d95f999fa0c9b35cb6db3770358938b5ffdfe85595153ee638fb22b7a38d361a709b50a71fa69f490841fd3732e6b02287b31b8cd154a10ffe8205b414de28ea308fd5bcae38839a2cdc2308b0b0c98420ee8e2c8bab71e1f74914a540f5297a85c3e0585f0402987a4d965e762e8b25edcec030540cc12fadaf44afa8a8028ef2fa91a10e298e6662a237ab0a1575b46dd655aeb48b6f8189bacd5675bdfbe13726a438d574800f571d171974b3e859d1bf89a834020e8791e43865822e159f5c3021a39349f73413c0f247a729f89231ee158a2db9cedd94149c0757056a5cf38915907fbcf211e471fa805edd6481352a4509d5204756a193b51e273f003ae729012426a83fcbdba3523921985eea4c7801dade9b2ba585a36950050267d0ed06b48a4637da268ac0d61fcadbd14cb4077b11b9b2a4635fa74fa456d5df33404cf11acc5b93472be95d1cdf944518dc0fbc554759be042096e0138f01bc6a5fcac79b984393a81d23e8f5fa2d9715f8450ed2ec349d382e46c5de8f7a001438065e141d5f0a5df820b78033b03456928f1e7244e6b19e2e8c28332e3c6e8e0027fb9a2b1f2c84f5e42c8b8551e8a9f8521b6dc07448e58b552fcc2140c2327b564cecf4f7d0658391f347690d049ef9e3556f7fe1d615b01af3fd0856b0ed160c822d377dca5163002080cfae66898ad938d5c63006b6f83dadfa385a1716ed121298558b48d7e7c397ae04d91eb4cff963742c8dcda7858d43e37e2fa3f525152577afaf22e053b2d4d230255414a339a7ff76659c51d9be526430b57eafdda3a80eb6a72d611dd7a49b3ae6553a6ff8851a8dfbda992c9926b26b65fa2e78759f5d1f0ab664df5817159cb7c7ac4a38205cb0d729dca34fdb8c73204817b158fc1e798b7d957a2b7e08b54fac97c743933f78ce6ef8dffdd4dc5e6caa74e6684bbcbad870ee6a4194e8f3f7c09f6c9e548745acf123ce0a897d70becc7e6de8ba6a71c30cb32321a395eaac66aff14b86a0f9b6278e14d8419bff6b8c07899b946388fe5838c7f7b60e128e0b2ec37bab46b8a70f541c3066a64ebb8f9da02f020e5a463f5dc41f4722be20b3e8c666ca469a6412eacc102929cc2a686af4f19d06ce13b1d17877c4eb0d76c1d5e33aaf53217e8cc6f4ffca3bd7aa72479dc8ca17ac687780d3c44eb131a536b3ca22bd8d2efe0dcef4d2e5cbca4b114c53611cbbc2bdb7b63c8ed2485aca4046a67a507df83ab04c0848b82c27f498b4b2feb266949b0da49d795fa668447cfc1f2c6aa5d11dfedd4cc9dfc4de9472fcd4c85e5f8b0c059ad22d1aa4609375867492cd831668dca1754a6513eaa052106a2439fccad9451e47a6f083ab17d4b4b36cbb969f0efb3af9e900331ffab0aeb65f6fa40ff4041faecc58755c33c22e86a81de94a4a8c86c4e02ae44a810c1b56bf05d655d52bf54848bbfbf8376587efcb9cd272933bcab2f3db786380532f4f1353bf4e7ac9967cbf679226d0b9625e5a611ce8942971ec6c64dd41ce53d7e26567e6d0fbdfffc7258099da4e23fd20c69e8057b32f7fbe81ce870b48bc23d5dcbb130867d5e5929c80faa4d90fe135c6e5493980653d3380624077fecf656bcbe1f01d1b2b13fedd2af8417c093bee5aee28cc20ecd752ffed905bd6e45aafb73b114cfe8f0ca4e1650aab23ced2e569d2ec5b65a5322408ef760a6ac1edfc13ffec9dccddbbf99c6ff1dba24cac488a80eac3e4b5f85e133363b3e32f860dbf8b35121c94755677f1c572cc8287e2498ed8626efce40d83a8b6e1f6a8a896d264c8b1cb38e6d859c91edc0b1068b9ab365b7346f8e9ffd1b62caac4a5c3609a260e958f566efc6699c614da20447ad5c45d756608de6ece5b56fdb2d842fdf2bdfa1b30dce169a27a875b5cfd17439dac108dd05ffc202dcbcf4569dbc42c32d4f8d68710f39ef5a47ca7cf31829a902355871b4291f5bbc64d250d43f4e2d2cda35cfb61ddb5086b7fb739d4a2a00b1f137ea9d22003c908f292c3c3a704b8729a9143a1c0aba1a11f35928aae7d6d445a1f4acd83ef9abd2f55cc6012440225a5aa031bd1c0f6513a304aa168684c81e8174e18d604b1b887f664670f9b0ae11575c1895361bdb99bb820ef3eb278555c5300e9d14f263cc059f5b9675040a919e47809df012828095a577d2d4b54657b319e6cbe313d7db3cf3e1b7a9ce397f134c8653090f05551448f8969302c30c51d90ba5057fc99b9b0d578d6a3da89c4518985a7aac743a79acfe16efb1bebf844a7c7a1d18486b508676843d6596401f5b9d5a834dc19c406aaf1cb8fc905578c1241c3e76a6e180d0afe80a5fe5f71d040b1cf516d4dfd2dee6fa25f43efb647866d5e4a19d5bd4e1b01c70817f1e01f5e9999559452e340c6c0f47d9338ca4dc0c360426a28bc67f1b6508b38805cc1e52050207095520855bda5e9394b5f360f404f522346c938ffb01d345a4caf03426217b32fba0a040fa0455a8933bd3662a8ec435f5e1562ac8b8ef5ed99925ad21d9ec2a430e7f428d8aed1332cf47f89ba2dd7e09e22641c4579414b30f3480f5a664aa13f59661bda63f51dce6be5eab0c353c464094464059718bb6152d1b21610c849b21c76336d6b2022b2fc334e6d832b537e25ae337878315fe4adc37d9e900baaa362b018c011ef1ca4d758fe93d579fb08c488bc7e6265b5d7aad6e2714e3a713082f22d5f69566a4bc4e7d92f109dbcc44bbff6316d950d3dfaf71467d6f0b4a1310a3b325554b4387fc07f4ac9c71163a85d2c9afd27429c1f515eb45255f6e6c07b998440f0be8e07681487261be6bdba5f4c5a9078a6dca85a97dcf557cda30df31da26028437dcb58d57265d0bc225cddd7b6a4fddd13c4f0e823449de47e93a7fd5af8fc4a47a8ed18560d297fd386a4644b1ca0f6d8c7079b6b7b24392ade7d1574adb5c333584150d55f28032935bdcd1b657ee623442d7f3e22711d602c3a23a2c80f7e17b463cb935537051a1c123faabdabc94c97643d2d7eab535cc87d1b60b3dc96db163c202bcfcd796e7290db936d05871de9afbe3f34c5cf5c4d541225ae8ea68ae53b9132c93ad42ae1687b03f333e02e9d5e6d80d9d7d1545f0b91552c8971057292bec6496b8769a998628f18aeb8b62e29a6178f95e0e56a535ef82ab62caa1821a3229bccc41ee3cb6a2a2a3f40206e5819e3d88359e3eba8ceeea9d4585d242ec7f6171f2d7af12904d4aa781a338d19f27ec7fa33af6313aecc244836976185c44875beb690d6855e5de6217c97099e1d78767dbec1dbec620a2455fc560ec647eacdae7af263de3d32a908027236aaa368887ed21d3d356e1275eea29369b6d66b8171df22d2c8b5b2a8a5a9007296715a560967fd0e34eade7bf0d8cdcc212e5af56f4985c0e4c284a1ff1d8a132596867670fcd2c48e6b4f987ad3e2f3d45071830939c890b159a93e69eff96ca751a20b12fcf0a124d5d63425e6dc51ebbbf0bc2d55f6f2927419868c6e1ec8e0214ec1e41eea29b268846e2553800f1ccd7b817a9eb57e16c1b15de09dc7710aa2e16d1cfd5701112ac380847b151837873a718547a593d1da3c83b712535448969ee6cbb06e753c6b5a296ea09a040c64bc45e96dec0c8fae9be376d445f8c04a16ae6c95770c70099f5e94bf740f1e1533846d3b79211836f272db3294a0a6a34d328b5188f571709d5afc75cdcb1c1d194944a12efb04ec03004302779441ea1af965e062cac013aeaee2fd41fd8aec8e83c5dcfe916270078f72c99fc5579c998f3e8a27f2e669704a753265db740af5be79aa32809199d0be7eae1810630272f2a0695602b46421b8ac81a45d383ab6d9002d0902e0cf8381fd628e408f093aac0f8a2e741df337e62d57745ae91bf10c4b42817af555c589f5333d3fcd4c024150d6ec09804c704ff46b8303123d7c1c3147debf8c251e0760b3186375b8511252e9a6b1353706b604bc94f6030edffa7e3559f6e7bb73f8d224cec3aa13e44226cec83f5b77c9520010fc779bf2d5e3727b8942769a23de9ec51dcc1901edc6ee411711e006e0d6db3856b3689cba6c600642a20a562b05653002e7cd8ad5137cf4043299c1105b46ea640d589a5fd9aff6c6e8292df9d01b79f6e00b0362fc4297a8daf37ca45d7bc8d8661d425a47fa20fdf6201912785cf769107edc93748096d767fea41fcf510207dee6de93f4c1c33c1eb8770cd751bcf43ade8280b040fd2b4dfdbf4b845abb3ebf6eea0e99e5854b0336a2a536f3a76aa9f17f8272091e170fe634ee405de82701803edf0b7b29679d63397aea2ffdc82a64b4488f0931f90385625933fe3d05042f76648e7849dc39354ecd83141375752741d0b409585f1c5f7c29a95c6223eb9125a56ee0ec4cef011cd5a9efd791f71a7d5ff2d0c98c9a6d3a1ab859b3dd55435373730e93d4f8fc2c8a97e92e8c9f4a0783862cce8b8f1d548f89a60f440f4c79d0ce71590093e125b4872f8cd324476f48bc6f270336f1c87c9e9f9f7914f53e97d037cbb8b111f5ef7f9010797f096a84e59983267f76cd641eee2ac2752d9825e815af81ec53f1b452d1d89659b901c7f9d5249e0c326715efc4a3ba8f275d16568d3f9e9dce053ebe4dfa80964bf8793d241d78316cb6fd2"}) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000001280), 0x2, 0x0) ioctl$VIDIOC_S_EDID(r5, 0xc0285629, &(0x7f0000001300)={0x0, 0xe7, 0x1, '\x00', &(0x7f00000012c0)=0x4}) r6 = io_uring_setup(0x4a58, &(0x7f0000001340)={0x0, 0x2813, 0x400, 0x0, 0xb7}) syz_io_uring_setup(0x71d3, &(0x7f00000013c0)={0x0, 0x9eb3, 0x1000, 0x1, 0x33a, 0x0, r6}, &(0x7f0000001440), &(0x7f0000001480), &(0x7f00000014c0)) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000001500)={0x0, @in={{0x2, 0x4e24, @multicast1}}, 0x6, 0x5}, &(0x7f00000015c0)=0x90) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f0000001600)={r8, 0xb44c, 0x8325}, 0x8) sched_setaffinity(r4, 0x8, &(0x7f0000001640)=0x80) r9 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$BTRFS_IOC_SNAP_CREATE(r9, 0x50009401, &(0x7f0000001680)={{r3}, "2e3a39d5cb986546ef644ef68a7f80342b0efe4930e5c33e4500f2982d5cbde55d75042891e9d4f01e54bdc8e0be407f953aa049cd1a4388245326fee139a672a0d8ac98950656407039b222ff6aee21fad6a5906a66b8cc7ed8d4f687d15a2d333b31e6b18cf4fb8706646c98232ee1038ee7a58ed85f6a2c9f34bd17ede0b5a0aa324ef642aa9c3d2505413c89f9ce3da28a978f154679c2a131eec77202394c492d6b3ebdde0cf3102bef59a560419f647d9d5428ab5e934861de99f49f3b3675b3285552b78d882f05ef9d0c12d0becbdd34151fb7c88206a2d5e4cc54a9f03d30e8fa6dad6c0e2d078f41a6a9124a6e71c97f9e1f2caf0956a085d8bd9f684818a75be9e1d64d447a799e120616e24d0079f111c582cf55ffdf130a1dd27d0cd124bb8fe20d7aedf2686a93c591df4652e47c7dceb49927b87d4f7490815719506bb89fc0da20523e7471c2fa6a2d8b634807cbd53e9ffadbf35617613b33bc96bdde8ddd75112ede26af5c5c1b5180d96275f6f75cc26047390ebf64b74ee231ae79dc8508f112884643f9ac4863d5f1549e583073365c387f78abed559d9a7542ad5db79da86de47a576186ae31dcd526205673952e69410536b60b2b95f1067dcb7d1df240dc43437db90f57a88da95c3d2a6d9edab71138fb5e86e669458d98dc91683988c9f815aa107fd33088db42426c23e843c74f75bf9908be0025faf1f54b499e99ee2a12ddf4277b62bb5572c3887dd1e776447aa35840c8b40407d7bec1c599e02e45406cca8928944a7f75e92ea67ec5b6461b0e0022a7f28867f80ba725401aa40543e156aa72a2929df85ead41dd02c06ef2f92cac29a466612ee16c11c5a2eef16572d64b8c493106c6a3a1cc227504c70b826d41b99155a86a4c4ae715b0802928f84e3efaf1ee2cffc8bc65aa5c18116a7fe96c4d210f6d865bf498a0ade97f38e966cde82c422ae0a8652935767d636b4bb18eb9e962c386b21451fa9c93d6d92964980eba7d9695552ae7499275995a305e6eb001dadb9f9fe8c7aac4dff94ec2f42cc389f3dd1cae230b2bdbbab7c087ad49cb1d5ef31aff207916f86eb6a91b20dba8227ec34f19a0aadde6faccc3077c305df116e3aac57b150600ec65e287b628ff9491381df6768a48a08204290cc1737965c5327ae2969bb4accd4587c2b7136d166452e6972ad4d54970458a1b9ff613bbbb39f8e140848e227c390c04ff428e76a5df533fa7efe11ba2cd046f90a9c9981b56c25686af4610686c319f47fe2000e33a25e81afe803d69fe789c89d09513425ae59f899786fc9a8c822c7a5399d9845874523033389b88dcd64f4ba201a5c200096e86db3b6354a312c7a8cddf39c2c5397da971145be3cde4988d1ce6f1ec2b1071db33d95c1abbdc54dda7d285f22e79f7cf5bfe07fc5f71f9b04ac95eff358a7a65c1b499bf350f210d5b7ba8f284147072b6a7803a73ed5f264c709928fb8ecc3793ebb9293e4a7c16d4d8eb9a7220d5321aefbe122560400d9c9144212a15af5fb013119998ae3a8c95a401410774e6057ede7cfc430521ca75139311554732e1c86dc37383227f431a58ce112efd815f116c0566f7dd6445c8f7927e7c9e140541cf1061e33acef9b83d1318913ff0fc0574fc56837a32c1eff0a967dc45cd0d5b182442acdfcf46fc7228b13bb893e06799476b8d86afd8a3f8ff3bb33ae164f6d6268cee4fac9ad7eb33ab89a4aa3aa8503f2a60267f09615e35e22d128364bf2294840cc632d7870dd51debf4cdd7858ff16d853bc6c02bc9e1f279896e8f7008e7873448d7c798760c89dfdef0a39b3732fc2b81c1afc644dd6c793729c26d523b56149d51f83506ed30be51b8b380256053846fa8ebc6d5b2c63a12089ddddecfb760e7556cd12685213ed838bb8b8bcdc9591f5b8358b202f55b07955f1c774c33a55f26fc73989256606fe8dcbfaf688f378a9fafa10b6eb1bcf378966612586a487f948c445c89cb9c72149f4de252148bf0fb42731e03469273d68cb1b14242de4532452e0554fb4e7370a1e3a48969cdc87ec65ab72e61a91df9176f891581779186f167199ddf8ef2e2d0451278f4905edf55647007896de02a5981b8b9ac5cff6e7e2961416f07152d82e4fc8b92fda84f036d9b502f028a7d645e812a7ef0b1b51959054e3a67cbbaa1c70b91c35d849379c83d390d924d64cbdffe8cd60ff3298e8eff07a3a5f6e19ad6c836083aac2a6dde26f31940302cec8ddd401c2fd84c4fbd4cc7e04031e2649be5da2e285a979f362f25bbabb83ef970244b03d97a2cb6ff00a58709cb7a4b079cb1c0200585726d0dc18ee42ca67cc878d9a7dab4a173878ca5e1d29226928625247ecb898d301e887eb3e04cd1c4b25f7beac3c57c90e6745f0bba7979546b2ead8648ff10a859c216aa438155390fa7180c8c4c0c981e28c95c5e2a7c0b8374ef0d5fdcd64ee9f998197da3f8239f55735c2e5f579893778899c95edd2fce7e0f3c278ec15d6fd2c91eb5d423889a093e3872cdef4c75954c8be8966ae4fda5ecb7049f8a5811594001744830b178ee977f120a1e6b65fbe9c2b13d880d1c1f29ecfc8ffc8becc4e135b6295ba0bc6b4d42ce6d84b27bb343de0d0e07b17c7e4ac557f69978189f3e416aafc1526d836d0f770021301643b904999c5cd931a22076849a29f3fbdd6d1fbe328ee89e43f3c55d72fdba795a3e7fdf9de026a128cc5d16829f68493a52e0f3db30047056dc856520f65e56a3aabd8c19075c507f29d4091f49d443e96aba1250d895cbb76153e56efc8440eb1877192c5e14e9783750972cfcada48cda8550d6c1e31ddcde388cf3691aab73c5348b91424605f26afe4c2aa2cab796be1b0c9feb8ee111c1ed825ad4f063c4ce18912676072c24730b01f1934903a4f6f5a8e1adda6d132664498a91f172af38cef4561875c3f0e228ddf25f83db6d8557a2dc9709c6d5cc86ec6a0d25ec2e34e94be3ab409c48fe4aeb1e70f14dcbe346698a726533a6fc3b760d0ff27d66d9a50d2551895efe46cb930a7ae96d4f504b52fe673cd8bd782f69ae29b8f303801216a0cd65b0d54b2d7288dfdce06c737faf0b896d04e145fc3663d25db4101b9211d540ccea4b8405e0fdc02d8e7b5e5575ca1278809c83034f36d648d5e97174868d9ce0327d7882596be069920179fca3c0a8268dc21f110439a084394a6eac1877694808425aaac2192487a32926a5805d56f4a680dc2dc3c8ba893f17a1789486f456bc8f9709ec93022db27a6e119ae76085ae453100580d8ab271cd01552025ed314e5d20854120d97aeb0ac8b572ec7ab7cb374d1088348bf3fb64064eb57f0c6588d512f315aec87cf8b64ceabd6f6b4649db807118da6ae6879a56cbdcd46f700b205e01da0166214bbd684eed3dd6c977f67e59d5b275e0e557120289da0c845c01aa75bf6539167dd439363c714089d0fe171a9bf63a5a90244b808db7bd05eb4ea69df2cfdbebfcf3528542d328ad4f575bfb06012ed6704780f8f2d2a3441aa112089e7929d12542082fa714753a232543d5f457255ac4d080599984e7494f591f3594a4a1e9be8c2a6188487cda9ee5c8c0cab8787b2b4de6b2be88b9a774cf55e64c0d9dfe72a9d2b4c96c1bc00d1ee37c77e9184219caf1883df8fc49fde595c82c55ba2e3f4c53522ce2080a0e2d96ad79aa3b85edb03f5447b43380a93635993a2aff4289b97f13eea00eed7649c2944ee99e2c41c6cfde103476986abde78262ab246e8b7e8fffad8aaedd833185a88c6cf2d8d1848c5ca506b39aba591f5b4b3435514e6aaeb5de20e4d259288897e0cc8b2644b1be841ae7b1ddd1cf4802390ce88826736bb40bff1cf0ace88a1daa01c25852d5995faa935c86ac9622ef0681eb9c26c193d2f7590f7b0193d17cb6c7311cd5a6551ecf747a260f6f53b55dd33306c6384f306422f1eb2b94555698660156fad91e3c36c814662623eba8be8ae506f78aa35c7dd1003a43f7d2a41c225673e7e31e5841654d4e3e86a03ce75853aa4492c79548e61e890b1df79a01ccd9f478adf86bc9952a104d69d758c69d32deae1456c0b19ea9d9008663f962f5b43e5a2b321499e3f6ca7d0d52af28501751a7afd869c670ba25dd9bbd408fec5e963c8cd3b0249abbfc3ba4b7c6c865e7dde39939fe4920be7ed1076aa790d72831b654b96434ea856ca86b1c9d45a84983dd919b7cf4862dfbb8524061dda4f36f227d3e48887a7027110ae9641e10230e16ba24879d815cd37d2aeff7a17c61d1f339c31cad04de6b7dab0890e2f0ddaff10fdd918f10fe4b242789efac982ec32b12b9dce72228dd3ad23147267351fd494c5f610f5f7563bd811ff1aaec61554e7783952f20151bdc5600711d46f47bb6ef13c56db79f7073815b94930db2177ac5eb61192f306ee32b528b3ea3b59880a30e80b34570c8f5152aa1113f185e2c95c714486b451da9566cb00700f426e82ce0fb81b5a404e8608aca994093301c99371662c2b9b80a7364ea954a1b9de28fdeff922ca5ca29d151307103ebd58e23ee81b37ca068b506a1a5d28f19b2ea3668a80543d8fcb56b006a87e4d58a4aac70abb06a1e98b8a0d4a20d01127eedb27cecd23658f45996b375d111e9f492a317ca8d501b162d9c853b2cd7ceaf3ba1eea13d91d637930643e85d6d162260af94f77940edd01a6d2ac3fb9520553697c6c5dc0413d4c5c4f0dc49e9cca3d3e2ab0af46be522f9e070257396898816e24a7aef3e9c16aeadd3b6384f63ca220c0ee33ae7ddafdfc736b968c7147950c9f650840b1a5b023881ebf13ff9af719fdf4548c8ac96ece0bde82cf6450fe8cff245e649a689157cfa89d35d73db0a07842260ce03e28a899c7222ecead8c2e42e80fc804cc5d5010d66b76e3e944adbfaa895bd3df233012a18cea4e299e9e4e3a01f5c56a0ee1800039a86ce73dd1c4a018bfc0d560a071a29ba9e367c3a2316361c6a8ffc3376e0648f6b984f0ac162a1868e329398115c7cdbb8efcd8ecca160ea4bcfec1e9843161254088404f506228cc2fd7fa3b0a38890a7f1f3b4fb2b887da73ca6225ace0767ee0543d275df4e3f4d2c24dfaf280eed6cf7e35ef869488b513f624de9d812a2d5677cc1dafff77ecda91ac2b63db5a616fe54d9ff9d9ef4383202d669b6e352968b408b09a6dd73ace8542e3480a85f433c43fcd100efa4be2b6a170bd268d58e4c94876c652165fb6482e015ed17d0c8d82acb1eccf2d9003e7763e61d307fd504659dae4548af2dee2ff0278c4b096d06be37595baeee058633085da33b57e7020e2fb1f92b0c6579fff75bc907048eadb79fbd17cbb73001f6b695d1b4694ece5215723978f9d6229a6f976175aeab087adee9c0f5ce2c585c64ea42ce7fc68d7df17c4d55dd8ab384f3bf3d16a52c06f2ba6c9d0b6665bfb3eaa41a2b6d66323c9f24a7dcf39c3ff446f7fddb097a6cf3f54f61b284974186ba9225f920d7608a8675c2f799a7676dffd22405e97085a21eaf7b3c8955053d20059e9a23bd395e046ef717dfe1084d6f002cb27873ebc2d752ce83e28681ae181e10c9912be71026a8dcf45a8ae1254a883146fe5e166376d2e6555f0212122fb3cc25663392fa36d90206dab7af1d3e9aa085f7944f542f93ffc953ca88f16772127e8b031d785e179ea4769a9b7214c646cf319df7ebde21f6df74b2ef8f7bf1e59c64776ab8be24e07899ba128b8053"}) r10 = syz_open_dev$dri(&(0x7f0000002680), 0x27a, 0xb8040) ioctl$DRM_IOCTL_SET_VERSION(r10, 0xc0106407, &(0x7f00000026c0)={0x8001, 0xb, 0x1, 0xfffffffa}) rename(&(0x7f0000002700)='./file0\x00', &(0x7f0000002740)='./file0\x00') ioctl$EVIOCGABS2F(r3, 0x8018456f, &(0x7f0000002780)=""/86) setsockopt$IPT_SO_SET_ADD_COUNTERS(r7, 0x0, 0x41, &(0x7f0000002800)={'security\x00', 0x4, [{}, {}, {}, {}]}, 0x68) r11 = syz_open_dev$evdev(&(0x7f0000002880), 0xfb7, 0x4040) ioctl$EVIOCSMASK(r11, 0x40104593, &(0x7f0000002940)={0x15, 0x5d, &(0x7f00000028c0)="412dfd36890e450890f167469aed2e0f239bd31b65dbd73d75c96523091cd5c96d68723c65886cfad477f63f0db98687f57df21c82d4da5ed67172763c1eb725e81a71c2c847194a5e064263a204b37ee72e1b5d7e317e5744435cdbd9"}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002a00)={0xffffffffffffffff, 0x58, &(0x7f0000002980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r13 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000002a40), 0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000002a80)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, '\x00', r12, r13, 0x3, 0x4, 0x1}, 0x50) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000002b00), &(0x7f0000002b40)=0x4) 4.368894423s ago: executing program 2 (id=7106): connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x8000001, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xf9}}, 0x10}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac95ab194f93f8e795a9b29420fa62d", 0x11}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x1009}, 0x50) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0xfd, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00db6072000001ea89de2b4410000e60080b8785d960000100000000000000000000000000000000000527000", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd000000801900000000000000000000000000000000000000000100", [0x0, 0x2000000000001]}}) 4.279649053s ago: executing program 3 (id=7107): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000001c0)=[@in6={0xa, 0x4e24, 0xf1, @empty, 0x19f49a9}], 0x1c) r1 = dup(r0) sendmsg$inet_sctp(r1, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2a}}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000300)="d9", 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000118400000007000000ac1414aa"], 0x18, 0x48d5}, 0x8050) 4.188238779s ago: executing program 3 (id=7108): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x21, 0x0, 0x0, 0x8000}, 0x50) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000001000ffff28bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="f80a0500230807003c0012800b000100697036746e6c00002c00028014000300ff7b000000000000000400000000000114000200"/62], 0x5c}}, 0x24000800) 4.08030765s ago: executing program 2 (id=7109): socket(0x22, 0x4, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010026bd7000004000000200000008000300", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00@\x00\x00\x00\x00\x00\a\x00\x00\x00'], 0x34}, 0x1, 0x0, 0x0, 0x20008004}, 0x81) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_emit_ethernet(0x46, &(0x7f00000000c0)=ANY=[@ANYRES8=r2], 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001030000000000000000fc0100000000000000000000000000003ed300000000000000000000000000000000000000000000020010"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYRES32], 0x188}, 0x1, 0x0, 0x0, 0x4}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0x10, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@ldst={0x1, 0x3, 0x4, 0x3, 0xc198d89d58fddcbf, 0x50, 0xfffffffffffffffc}], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$dma_heap(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c081, 0x0) close(0xffffffffffffffff) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) accept(0xffffffffffffffff, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r8, 0x29, 0x10, &(0x7f0000000000)=0x2, 0x4) setsockopt$inet6_int(r8, 0x29, 0x46, 0x0, 0x0) sendto$inet6(r8, 0x0, 0x0, 0x20008045, &(0x7f00000001c0)={0xa, 0x2, 0x1000, @mcast2}, 0x1c) 3.858724507s ago: executing program 3 (id=7110): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000400)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd', @ANYRESHEX, @ANYRES64, @ANYRESDEC=r1]) syz_clone3(&(0x7f0000000380)={0x200, 0x0, &(0x7f0000000140), &(0x7f0000000180), {0x19}, &(0x7f0000000280)=""/215, 0xd7, &(0x7f00000001c0)=""/26, &(0x7f0000000200)=[0x0, 0x0], 0x2}, 0x58) r2 = fsopen(&(0x7f0000000000)='udf\x00', 0x0) gettid() r3 = socket$nl_generic(0x10, 0x3, 0x10) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000080)='iocharset', &(0x7f00000000c0)='io#harset', 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x28000) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4040) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36"], 0x0) r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r4, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000000080)={0x6, {"7fb13911afb5ea7f027063aa876dd358", "cfe484e50900", "d9ca451d96249a1dee77476cc87f7d0a"}, 0x6}) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x0, r5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x80101) unshare(0x2c020400) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4880) fcntl$setpipe(r6, 0x407, 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[], 0x0) 3.528666634s ago: executing program 6 (id=7111): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, [], [0xff, 0x0, 0x0, 0xff000000], 'erspan0\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1f8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "cfcfcf0c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1a, 0x0, {0x80000}}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x17, 0x3, 0x6, 0x80000000, 'snmp\x00', 'syz0\x00', {0xe6}}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @broadcast}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xff, 0xff000000, 0xff000000, 0xff], [0xffffff00, 0x2000000, 0xffffff00], 'wg0\x00', 'nicvf0\x00', {0xff}, {0xff}, 0x0, 0xc0, 0x0, 0x14}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x4, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) 3.387473612s ago: executing program 6 (id=7112): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000100)=0x2c0000) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x20000, 0x0}, &(0x7f0000000240)="948d7acda0b2", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ff}) 3.262978547s ago: executing program 6 (id=7113): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001f80)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0xfffffffe}, 0x80, 0x0}, 0x0) socket(0x10, 0x803, 0x0) (async) socket$unix(0x1, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x80001, 0x84) (async) socket$inet6_sctp(0xa, 0x801, 0x84) socket$netlink(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) socket$inet6(0xa, 0x2, 0x0) socket(0x28, 0x5, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), r1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r1], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 3.221767322s ago: executing program 6 (id=7114): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000440)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000100)={0x0, 0x0, r1, r2, 0x3, 0xe, 0x7f000, 0xffffffff, {0xabaf, 0x9, 0x2, 0x4, 0xffff, 0x8, 0x83, 0x0, 0x61ee, 0x4, 0x0, 0x5, 0x49, 0x1000ff, "3cbc98cff6cf0000000000000000000000000000003b000000000500"}}) 3.140081996s ago: executing program 6 (id=7115): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_uring_setup(0x267a, &(0x7f0000000140)={0x0, 0x52a0, 0x20000, 0x1, 0x8e}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8b19, &(0x7f0000000140)={'wlan1\x00', @random="0100eb00"}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="84010000210001000000000004000000ffe2ffffffffffffff00000000002001fc02000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000034011100e0000001000000000000000000000000ac1414aa000000000000000000000000fc020000000000000000000000000000fe88000000000000000000000000000133040000ff34000002000200fc010000000000000000000000000001fe800000000000000000000000000035ac1414aa000000000000000000000000fc0200000000000000000000000000013c000000000000000a0008000a01010200000000000000000000000000000000000000000000000000000000ac1414aa000000000000000000000000fe8000000000000000000000000000373c0000000535000002000a007f000001000000000000000000000000fe8000000000000000000000000000bbfc010000000000000000000000000001fc00000000000000000000000000000133040000033500000a000200"], 0x184}}, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r6, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) r7 = creat(&(0x7f0000000300)='./file0\x00', 0x68) landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) r8 = openat(r7, &(0x7f0000000640)='.\x00', 0x80, 0x126) renameat2(r8, &(0x7f00000001c0)='./file0\x00', r8, &(0x7f0000000200)='.\x02\x00', 0x4) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='.\x02\x00', r8, &(0x7f0000000000)='./file0\x00', 0x2) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r3, 0x0, 0x0) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/tty/drivers\x00', 0x0, 0x0) fcntl$lock(r9, 0x5, &(0x7f0000000040)={0x0, 0x2, 0x7fffffffffffffff, 0xb}) syz_usb_connect$cdc_ncm(0x3, 0x0, 0x0, 0xfffffffffffffffc) 3.006978732s ago: executing program 2 (id=7116): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x2fffb, 0x0}, &(0x7f0000000240)="5b8d7acda0b2", 0x0, 0x0, 0x3000000, 0x0, 0x0}) 2.656529832s ago: executing program 5 (id=7117): r0 = socket$igmp6(0xa, 0x3, 0x2) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000001"], 0x0) syz_emit_ethernet(0x52, &(0x7f0000000040)={@broadcast, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "a583e2", 0x1c, 0x2c, 0xff, @remote, @local, {[@routing={0x8, 0x0, 0x0, 0xe}], {{0x8000, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}}}}}}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$dvb_demux(&(0x7f0000000000), 0x0, 0x480) preadv(r3, &(0x7f00000000c0)=[{0x0}], 0x1, 0x7, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x1ff}, 0x0) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r4 = shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) r5 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg(r5, &(0x7f00000052c0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000200)=""/189, 0xbd}], 0x1}, 0xef35}, {{&(0x7f0000000780)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000001d80)}, 0x79}], 0x2, 0x2000, 0x0) sendmmsg(r5, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) shmat(r4, &(0x7f0000f62000/0x1000)=nil, 0x7000) mremap(&(0x7f0000f7f000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) ioctl$NBD_SET_BLKSIZE(0xffffffffffffffff, 0xab01, 0x5) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, 0x0, 0x14) r7 = timerfd_create(0x0, 0x0) timerfd_settime(r7, 0x3, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_BEARER_ADD(r8, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f00000001c0)={0x328, r9, 0x2, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x40, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfdd}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7fff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}]}, @TIPC_NLA_NODE={0x100, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0xeb, 0x3, "330a1851fe5bdc874d256a73419bf24feb41d3e90620910fe4b2324cdf9956aab627c27a5ba584a22446eb857263a2802e2d1981b7e9280cff7d76b72117608e5ff78c009bdebb2a0ff46ff63c73bf7da9d14f6f93fd1b5fe59f1de55409cd8e3202fbfc8622e5bb8813746f25431a71aabc9a6d9666cf160f57d2c5a805b5657a057a1aa81398beddb7cfebccf5fe4fb7132c21cc19eb2a458a7434b139b72eb8660f30841568736b071661f2aac8ff8ec08391493f2e77835ac0c5cc6cdf4dda3e668657a939b8ac653a2daddaef8d8fa0f2a3699e1cd2dfddfb49fb439b1b26cfe0bef57cc3"}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x766}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}, @TIPC_NLA_BEARER={0xa8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x128, @empty, 0xa}}, {0x14, 0x2, @in={0x2, 0x4e20, @rand_addr=0x64010102}}}}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'team_slave_1\x00'}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x68e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'ip6gre0\x00'}}]}, @TIPC_NLA_NODE={0xdc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9811}, @TIPC_NLA_NODE_ID={0xb8, 0x3, "609d16f7bdace8be76f984ad70abfcfafc7bb88e4d5f55187f8ee35fe5d0207aac2f2940ac659787781b51b04cd9cbe34537ecabe0c900d7e60556d375fce06cc6ddcd5c04dd76adb860ae0f4e787777d41d9b25af4717ca3473b3193cd23958f05543d0c3a910288d502bbb2412b85780b745a37b30d83068580b20b3d44d0572df759e1830fdda921c67edc74cbdaf8e217379df58988f168c8df1159d3914e6030b1c8a5b34b789ab88b662afd11d16dfde56"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x99d7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3d15}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xd}]}, @TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe6}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x20000000}, 0x10000000) r10 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r10, &(0x7f0000004d40)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x7ff, @mcast2, 0xffffffff}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@rthdrdstopts={{0x18, 0x29, 0x37, {0x3a}}}, @dstopts={{0x18, 0x29, 0x37, {0x73}}}], 0x30}}], 0x1, 0x20000030) 2.572562662s ago: executing program 2 (id=7118): openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x2, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = memfd_create(0x0, 0x3) r3 = socket$inet6(0xa, 0x1, 0x0) close(r2) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmmsg(r4, &(0x7f00000094c0)=[{{&(0x7f00000007c0)=@nl=@kern={0x10, 0x0, 0x0, 0x10000}, 0x80, &(0x7f0000000e00)=[{&(0x7f0000000880)="f3", 0x1}], 0x1}}, {{&(0x7f00000011c0)=@nl=@kern={0x10, 0x0, 0x0, 0x10000}, 0x80, 0x0}}], 0x2, 0x10) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000140)={@mcast1, 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_int(r3, 0x29, 0x4a, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000080)={0xa, 0x4e1d, 0xf0, @mcast1, 0xffffff7e}, 0x1c, 0x0, 0x0, &(0x7f0000000780)=ANY=[], 0x18}, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000180)='./file1\x00', 0x0, 0x0, 0x1000) socket(0x2, 0x80805, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20004054) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001080), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000380)=ANY=[@ANYRES32, @ANYBLOB="e83d49a6e33ebb4e500e3d3eaa55dd996bba141fc3308fc3765ae0822ed17e84a1652a322a91a44dd30225af5625aa1587d5b1dbfb651807e78d291e1a19"], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) ioctl$USBDEVFS_SETINTERFACE(r5, 0x80045510, &(0x7f0000000040)={0x3, 0xfffffffc}) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0x20, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0xc}, {0x6, 0xfff2}, {0xb, 0xfff4}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x8080) 2.507557026s ago: executing program 4 (id=7119): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010029bd7000beffffff0200000008000300", @ANYRES32=r2, @ANYBLOB="080027000000000008002600b40900000800a100000000000500180101"], 0x44}, 0x1, 0x0, 0x0, 0x48080}, 0x20004056) 1.121822229s ago: executing program 4 (id=7120): getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}]}, 0x0) io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x251f, 0x2000, 0x4, 0xd1}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4048aecb, &(0x7f0000000340)={0x7, 0x0, [{0x80000000, 0x2000006, 0x6, 0x0, 0x7, 0x9, 0x7b87a9e3}, {0xa, 0xffffffff, 0x0, 0x333, 0x4, 0xa, 0x8}, {0x80000000, 0xffffffff, 0x7, 0x1008, 0x4, 0x2000110, 0x4}, {0x80000001, 0x4, 0x0, 0x3, 0x1, 0x4, 0x9}, {0xa, 0x2, 0x0, 0xb7, 0x9, 0xa, 0x1c3}, {0xc0000000, 0x80007, 0x4, 0x2, 0x0, 0x7c0, 0x800}, {0xc0000001, 0x0, 0x0, 0x6, 0xb, 0x7, 0x84}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@bridge_getlink={0x28, 0x12, 0x301, 0x70bd2c, 0x25dfdbfb, {0x7, 0x0, 0x0, 0x0, 0x8a6b, 0x11530}, [@IFLA_EXT_MASK={0x8, 0x1d, 0xffffff80}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0xbd, 0x0, 0xffff, 0x2, 0x2, '\x00', 0x654}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 407.908574ms ago: executing program 3 (id=7121): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00U\x00=\t\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="20000280", @ANYRES32=r0, @ANYBLOB="0000000000000000000000000a00000000000000dd86001420000100", @ANYRES32=r2], 0x58}}, 0x0) 279.590738ms ago: executing program 5 (id=7122): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'hsr0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="03000000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r1], 0x4c}}, 0x0) 155.402926ms ago: executing program 4 (id=7123): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)=@newtfilter={0x54, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x6}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x28, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0xb709, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4084}, 0x24040084) recvmmsg$unix(r0, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)=""/219, 0xdb}], 0x1, &(0x7f0000000180)}}], 0x1, 0x20, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[], 0xc3}, 0x1, 0x100000000000000, 0x0, 0x2000}, 0x40400c0) syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x4) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)={0xeb, 0x0, [{0x12, 0x0, 0x5, 0x7, 0x800, 0x7fffffff, 0x2}]}) r4 = socket(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) 24.948315ms ago: executing program 3 (id=7124): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x4e0206, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000440)=[@code={0xa, 0x58, {"0f380a669766ba6100b000eeb98f090000b88c000000ba000000000f30c4827941fac4e1f96e42e46505e7ee1921b9500b00000f328fe9209b7ce100c403790cde08c461f8ae18"}}, @rdmsr={0x32, 0x18, {0x2bd}}, @wr_crn={0x46, 0x20, {0x0, 0x69f}}, @in_dx={0x82, 0x20, {0xaea, 0x7}}, @in_dx={0x82, 0x20, {0xfd90, 0x6}}, @cpuid={0x14, 0x18}, @rdmsr={0x32, 0x18, {0x40000082}}], 0x100}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(0xffffffffffffffff, 0xc004ae02, &(0x7f00000001c0)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x3}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000140)={[{0xffffffff, 0xc, 0x6, 0x3, 0x40, 0x2, 0x42, 0x9, 0x1, 0x4, 0x2, 0x8, 0x4}, {0x1, 0x8080, 0x7, 0x0, 0x8, 0x4, 0x49, 0xff, 0x2, 0x1, 0x9, 0xf, 0x20000000006}, {0x2, 0x5, 0x5, 0x84, 0x8, 0x7, 0xfd, 0x40, 0x5, 0x1, 0x2, 0x3}], 0xf87}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000140)={0xa3, 0x0, 0x0}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f00000005c0)=[@wr_crn={0x46, 0x20, {0x4, 0x6}}, @wr_drn={0x6e, 0x20, {0x0, 0x5}}, @rdmsr={0x32, 0x18, {0xb2f}}, @code={0xa, 0x53, {"67735a2e0f019ee0000000650f01cfab66ba420066b89b1566ef4d0fc79ee388ef1966450f38803266baf80cb8947a2c89ef66bafc0ced40e80018000043d07c7800"}}, @out_dx={0xaa, 0x28, {0x5b77, 0x5, 0x4}}, @cpuid={0x14, 0x18, {0x10001, 0xa}}, @rdmsr={0x32, 0x18, {0xb7d}}, @rdmsr={0x32, 0x18, {0x2f0}}, @out_dx={0xaa, 0x28, {0xe6cb, 0x3, 0x4}}, @uexit={0x0, 0x18, 0x6}, @rdmsr={0x32, 0x18, {0x966}}, @rdmsr={0x32, 0x18, {0x5df6051ca135e8a7}}, @wr_drn={0x6e, 0x20, {0x6}}, @in_dx={0x82, 0x20, {0xbde0, 0x7}}], 0x1cb}) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f00000002c0)={0xbe, 0x0, 0x1}) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000080)={0x0, 0x21b7, 0x800, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f00000001c0)=@IORING_OP_SHUTDOWN={0x22, 0x58, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, {0x0, r7}}) io_uring_enter(r3, 0x1, 0x1, 0x1, 0x0, 0x0) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x42043, 0x0) ioctl$IOMMU_GET_HW_INFO(r8, 0x3b8a, &(0x7f00000003c0)={0x28, 0x0, 0x0, 0x0, 0x0}) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) connect$netlink(r9, &(0x7f0000000240)=@proc={0x10, 0x0, 0x25dfdbfe, 0x40}, 0xc) r10 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r10, &(0x7f0000000e80)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="9a", 0x1}], 0x1}}, {{&(0x7f00000003c0)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000400)="af", 0x1}], 0x1}}], 0x2, 0x4000000) r11 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r11, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r10, 0x84, 0x7b, &(0x7f0000000080)={r12}, 0x8) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 5 (id=7125): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff00000000017c0000040042800c0001800682237b3663"], 0x34}, 0x1, 0x0, 0x0, 0x4004095}, 0xc080) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff0000000003"], 0x34}, 0x1, 0x0, 0x0, 0x4000895}, 0xc000) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r3 = accept4$alg(r1, 0x0, 0x0, 0x0) io_setup(0x20000000001005, &(0x7f0000000880)=0x0) sendmmsg(r3, &(0x7f0000007dc0), 0x4000000000001d6, 0x0) io_submit(r4, 0x1, &(0x7f0000000580)=[&(0x7f00000000c0)={0x5000000, 0x0, 0xd, 0x0, 0x0, r3, &(0x7f0000000080)='=', 0x11}]) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000002300090025bd7000ffd3df2501000000080001007f00000108000b00", @ANYRES32=0x0, @ANYBLOB="8b3eb9a02d8931322f8be7492cccbe51dd0c0000078c9c256d6077df496e"], 0x24}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x45, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) kernel console output (not intermixed with test programs): 576][T26646] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1335.638385][T14132] usb 4-1: Manufacturer: syz [ 1335.646388][T14132] usb 4-1: SerialNumber: syz [ 1335.656163][T26646] bond3: left promiscuous mode [ 1335.674794][T14132] r8152-cfgselector 4-1: Unknown version 0x0000 [ 1335.684955][T14132] r8152-cfgselector 4-1: config 0 descriptor?? [ 1336.380511][T26661] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6397'. [ 1336.924468][T26672] __nla_validate_parse: 1 callbacks suppressed [ 1336.924494][T26672] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6398'. [ 1337.133310][T26679] binder: 26677:26679 ioctl c0306201 2000000003c0 returned -14 [ 1337.235612][T26673] No such timeout policy "syz1" [ 1337.746714][T26662] delete_channel: no stack [ 1337.887413][T26681] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1337.896666][T26681] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1337.904053][T26681] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1337.910488][T26681] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1337.916727][T26681] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1339.303210][T26709] fuse: Bad value for 'fd' [ 1340.150621][ T5828] Bluetooth: hci1: command 0x0c1a tx timeout [ 1340.191112][ T5828] Bluetooth: hci5: command 0x0c1a tx timeout [ 1340.197260][ T5828] Bluetooth: hci4: command 0x0c1a tx timeout [ 1340.197298][T24637] Bluetooth: hci0: command 0x0406 tx timeout [ 1340.203368][ T5828] Bluetooth: hci2: command 0x0406 tx timeout [ 1340.240623][T26720] binder: 26717:26720 ioctl c0306201 2000000003c0 returned -14 [ 1340.457482][T26723] netlink: 48 bytes leftover after parsing attributes in process `syz.6.6414'. [ 1340.980524][T26737] netlink: 92 bytes leftover after parsing attributes in process `syz.4.6419'. [ 1341.257179][T14117] r8152-cfgselector 4-1: USB disconnect, device number 90 [ 1341.370547][T26746] tipc: Failed to remove unknown binding: 66,1,1/0:4029947/4029949 [ 1342.130661][T26752] loop7: detected capacity change from 0 to 16384 [ 1342.145414][T26754] binder: 26753:26754 ioctl c0306201 2000000003c0 returned -14 [ 1342.542652][T26752] loop7: detected capacity change from 16384 to 0 [ 1342.542714][ C0] blk_print_req_error: 10 callbacks suppressed [ 1342.542731][ C0] I/O error, dev loop7, sector 4224 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 2 [ 1343.777254][T26768] syzkaller0: entered promiscuous mode [ 1343.782771][T26768] syzkaller0: entered allmulticast mode [ 1343.953885][T26768] tipc: Started in network mode [ 1343.961760][T26768] tipc: Node identity fa0c80d3b133, cluster identity 4711 [ 1343.969727][T26768] tipc: Enabled bearer , priority 0 [ 1344.043920][T26767] tipc: Resetting bearer [ 1344.318993][T26767] tipc: Disabling bearer [ 1344.423177][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 1344.423198][ T30] audit: type=1800 audit(1776198148.998:3226): pid=26759 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.6426" name="bus" dev="ramfs" ino=123013 res=0 errno=0 [ 1344.803715][T26785] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6437'. [ 1344.818975][T26784] binder: 26781:26784 ioctl c0306201 2000000003c0 returned -14 [ 1344.916404][T26787] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6435'. [ 1345.000783][T26788] No such timeout policy "syz1" [ 1345.385760][T26801] blktrace: Concurrent blktraces are not allowed on loop4 [ 1345.567498][T14117] usb 3-1: new full-speed USB device number 102 using dummy_hcd [ 1346.023507][T14117] usb 3-1: config 150 has an invalid interface number: 204 but max is 2 [ 1346.032632][T14117] usb 3-1: config 150 has an invalid descriptor of length 0, skipping remainder of the config [ 1346.058230][T14117] usb 3-1: config 150 has 1 interface, different from the descriptor's value: 3 [ 1346.237793][T26780] delete_channel: no stack [ 1346.457203][T14117] usb 3-1: config 150 has no interface number 0 [ 1346.494107][T26818] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6444'. [ 1346.507188][T14117] usb 3-1: config 150 interface 204 has no altsetting 0 [ 1346.524928][T14117] usb 3-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 1346.536925][T14117] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.545371][T14117] usb 3-1: Product: syz [ 1346.550111][T14117] usb 3-1: Manufacturer: syz [ 1346.554921][T14117] usb 3-1: SerialNumber: syz [ 1346.833299][T26829] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6449'. [ 1346.868027][T26798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1346.888754][T26798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1347.041157][T14117] usb 3-1: USB disconnect, device number 102 [ 1347.099026][T26834] binder: 26833:26834 ioctl c0306201 2000000003c0 returned -14 [ 1347.460532][T26850] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6455'. [ 1348.186922][ T24] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 1348.291874][T26872] binder: 26871:26872 ioctl c0306201 2000000003c0 returned -14 [ 1348.354669][ T24] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 1348.555288][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1348.581715][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 1348.609382][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1348.641824][ T24] usb 5-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 1348.656888][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1348.664938][ T24] usb 5-1: Product: syz [ 1348.689905][T26880] netlink: 92 bytes leftover after parsing attributes in process `syz.3.6466'. [ 1348.699039][ T24] usb 5-1: Manufacturer: syz [ 1348.711037][ T24] usb 5-1: SerialNumber: syz [ 1348.747739][ T24] usb 5-1: config 0 descriptor?? [ 1348.777853][T26884] macsec1: entered promiscuous mode [ 1348.784140][ T24] iguanair 5-1:0.0: failed to get version [ 1348.793356][T26884] erspan0: entered promiscuous mode [ 1348.815295][ T24] iguanair 5-1:0.0: probe with driver iguanair failed with error -90 [ 1348.827064][T26884] erspan0: left promiscuous mode [ 1348.956943][T26864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1348.966322][T26864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1348.995266][T26864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1349.014674][T26864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1349.034562][T26864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1349.072674][T26864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1349.102963][T26890] syzkaller0: entered promiscuous mode [ 1349.113160][T26864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1349.132490][T26890] syzkaller0: entered allmulticast mode [ 1349.143158][T26864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1349.183095][T26864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1349.236449][T26864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1349.278728][ T24] usb 5-1: USB disconnect, device number 109 [ 1349.605705][T26898] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1349.735518][T26894] netlink: 136 bytes leftover after parsing attributes in process `syz.2.6472'. [ 1350.844846][T26917] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6480'. [ 1350.901378][T26912] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6475'. [ 1351.913626][T26917] hsr0: entered promiscuous mode [ 1352.696467][T26940] 8021q: VLANs not supported on ipvlan1 [ 1353.012778][T26948] binder_alloc: binder_alloc_mmap_handler: 26947 200000ffd000-200000fff000 already mapped failed -16 [ 1353.267409][T14117] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 1353.412873][ T30] audit: type=1326 audit(1776198157.988:3227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26955 comm="syz.3.6494" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7facc0d9c819 code=0x0 [ 1353.436445][T26956] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6492'. [ 1353.437677][T14117] usb 5-1: Using ep0 maxpacket: 16 [ 1353.490242][T14117] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 1353.498758][T14117] usb 5-1: config 0 has no interface number 0 [ 1353.505088][T14117] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1353.524234][T14117] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1353.537931][T14117] usb 5-1: config 0 interface 41 has no altsetting 0 [ 1353.551361][T14117] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1353.563834][T14117] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.572430][T14117] usb 5-1: Product: syz [ 1353.592345][T14117] usb 5-1: Manufacturer: syz [ 1353.602476][T14117] usb 5-1: SerialNumber: syz [ 1353.611499][T26960] netlink: 136 bytes leftover after parsing attributes in process `syz.2.6495'. [ 1353.623021][T26960] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1353.627875][T14117] usb 5-1: config 0 descriptor?? [ 1353.647569][T26950] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1353.655905][T26950] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1353.736258][T26966] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6496'. [ 1353.869219][T26950] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1353.876726][T26950] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1354.088289][T14117] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -32 [ 1354.391781][T26971] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6499'. [ 1354.820173][T14116] usb 5-1: USB disconnect, device number 110 [ 1354.858363][T14117] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1355.023942][T14117] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1355.034450][T14117] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1355.044931][T14117] usb 6-1: New USB device found, idVendor=08b7, idProduct=8000, bcdDevice= 0.00 [ 1355.058268][T14117] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1355.067225][T14117] usb 6-1: SerialNumber: syz [ 1355.207031][T14116] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 1355.292803][T14117] usb 6-1: 0:2 : does not exist [ 1355.369103][T14116] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1355.385841][T14117] usb 6-1: USB disconnect, device number 64 [ 1355.396949][T14116] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1355.414188][T14116] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1355.420397][T26990] syzkaller0: entered promiscuous mode [ 1355.428846][T14116] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1355.439840][T26990] syzkaller0: entered allmulticast mode [ 1355.445991][T14116] usb 5-1: config 0 descriptor?? [ 1355.461726][ T6654] udevd[6654]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1355.471090][T26990] tipc: Enabled bearer , priority 0 [ 1355.517665][T26990] tipc: Resetting bearer [ 1355.594329][T26990] tipc: Disabling bearer [ 1355.723238][T26996] netlink: 164 bytes leftover after parsing attributes in process `syz.2.6507'. [ 1355.741712][T26996] netlink: 12296 bytes leftover after parsing attributes in process `syz.2.6507'. [ 1355.754029][T26996] netlink: 164 bytes leftover after parsing attributes in process `syz.2.6507'. [ 1355.827315][T25915] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1355.928502][ T30] audit: type=1400 audit(1776198160.498:3228): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A273A02 pid=27001 comm="syz.2.6510" [ 1355.956972][T25915] usb 4-1: device descriptor read/64, error -71 [ 1356.216926][T25915] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1356.286668][T27015] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6503'. [ 1356.333100][T27015] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6503'. [ 1356.346951][T25915] usb 4-1: device descriptor read/64, error -71 [ 1356.386928][ T24] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1356.449207][T27018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1356.463235][T27018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1356.468649][T25915] usb usb4-port1: attempt power cycle [ 1356.528524][ T24] usb 3-1: device descriptor read/64, error -71 [ 1356.766932][ T24] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 1356.816917][T25915] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1356.852602][T25915] usb 4-1: device descriptor read/8, error -71 [ 1356.896988][ T24] usb 3-1: device descriptor read/64, error -71 [ 1357.007444][ T24] usb usb3-port1: attempt power cycle [ 1357.096953][T25915] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 1357.132172][T25915] usb 4-1: device descriptor read/8, error -71 [ 1357.258956][T25915] usb usb4-port1: unable to enumerate USB device [ 1357.356914][ T24] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 1357.396988][ T24] usb 3-1: device descriptor read/8, error -71 [ 1357.666877][ T24] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 1357.687621][ T24] usb 3-1: device descriptor read/8, error -71 [ 1357.797651][ T24] usb usb3-port1: unable to enumerate USB device [ 1358.082087][T14116] usbhid 5-1:0.0: can't add hid device: -71 [ 1358.092969][T14116] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1358.127838][T14116] usb 5-1: USB disconnect, device number 111 [ 1358.409684][ T30] audit: type=1326 audit(1776198162.988:3229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1358.438995][ T30] audit: type=1326 audit(1776198162.988:3230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1358.476623][ T30] audit: type=1326 audit(1776198163.008:3231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1358.536434][ T30] audit: type=1326 audit(1776198163.008:3232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1358.597032][ T30] audit: type=1326 audit(1776198163.098:3233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1358.648031][ T30] audit: type=1326 audit(1776198163.098:3234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1358.880002][ T30] audit: type=1326 audit(1776198163.098:3235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1358.928184][ T30] audit: type=1326 audit(1776198163.148:3236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1359.036630][ T30] audit: type=1326 audit(1776198163.148:3237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1359.124705][ T30] audit: type=1326 audit(1776198163.148:3238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1359.165468][ T30] audit: type=1326 audit(1776198163.148:3239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27026 comm="syz.4.6516" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1359.396990][T14132] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1359.527143][T27048] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6523'. [ 1359.600408][T14132] usb 6-1: config 4 has an invalid interface number: 52 but max is 1 [ 1359.629103][T14132] usb 6-1: config 4 contains an unexpected descriptor of type 0x1, skipping [ 1359.664412][T14132] usb 6-1: config 4 has an invalid interface number: 75 but max is 1 [ 1359.687302][T14132] usb 6-1: config 4 has no interface number 0 [ 1359.705053][T14132] usb 6-1: config 4 has no interface number 1 [ 1359.715600][T14132] usb 6-1: config 4 interface 52 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 1359.727631][T14132] usb 6-1: config 4 interface 52 altsetting 3 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1359.739643][T14132] usb 6-1: config 4 interface 52 altsetting 3 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 1359.751623][T14132] usb 6-1: config 4 interface 52 altsetting 3 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1359.763076][T14132] usb 6-1: config 4 interface 52 altsetting 3 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 1359.774885][T14132] usb 6-1: config 4 interface 52 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 1359.801449][T14132] usb 6-1: config 4 interface 52 altsetting 3 has a duplicate endpoint with address 0x3, skipping [ 1359.831926][T14132] usb 6-1: config 4 interface 52 altsetting 3 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 1359.869900][T14132] usb 6-1: config 4 interface 52 altsetting 3 has a duplicate endpoint with address 0x1, skipping [ 1359.915459][T14132] usb 6-1: config 4 interface 52 altsetting 3 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 1359.958553][T14132] usb 6-1: config 4 interface 52 altsetting 3 has a duplicate endpoint with address 0xF, skipping [ 1360.005253][T14132] usb 6-1: config 4 interface 52 altsetting 3 endpoint 0xB has invalid maxpacket 1023, setting to 64 [ 1360.018280][T14132] usb 6-1: config 4 interface 52 has no altsetting 0 [ 1360.025568][T14132] usb 6-1: config 4 interface 75 has no altsetting 0 [ 1360.035968][T14132] usb 6-1: New USB device found, idVendor=050d, idProduct=4b76, bcdDevice=d7.ad [ 1360.049955][T14132] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.071910][T14132] usb 6-1: Product: ᐄ [ 1360.079090][T14132] usb 6-1: Manufacturer: 婆鯑㋎㡶➔庽饼黧掁п痍᥷쾷쨞᪓퀔磖밵ᣐ撪㴅縱࿛㧁攼殱粃鮝䒫ṫⴴغ콲좛ᵴ諛뵦๓퍤怉ᑍ쁥멬靼㗘犗陵浕蠈Ǯ朝椃뼭랉룵竻槉ꎇ난힀䍙ꖝ訍ￗ኱蝖㌬꼮掜臥㭳謘ꀔ囄죙ҋ曖ꯟ뙠䀴坡⊒褍땫롧袴䍉կ讖┓웡䍴 [ 1360.154089][T27059] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1360.167210][T14132] usb 6-1: SerialNumber: Ī疐⎠↡┠⌋ꂙ⧞嶕΀﷓浛⚎㲼⣙处타섨㻈狦계◮㽭ㄶ浢鿃楃旯ﱝ굟ﻋⅡ볪슁᧬㠫敷寫젏ᤸ蓌囜羼鵮䪀뫔簪ᎎ⾏䇰쒛虑∰珽㌶廣Ǩ牶큑靈⮹淬 [ 1360.509784][T14132] usb 6-1: USB disconnect, device number 65 [ 1360.977207][T27077] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6533'. [ 1361.859417][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.865814][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.120363][T27097] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6537'. [ 1362.140350][T27097] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 1362.336951][T27097] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 1362.814995][T27106] netlink: 92 bytes leftover after parsing attributes in process `syz.6.6541'. [ 1363.186944][ T24] usb 4-1: new full-speed USB device number 95 using dummy_hcd [ 1363.483122][ T24] usb 4-1: device descriptor read/64, error -71 [ 1363.567290][T14116] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1363.747452][ T24] usb 4-1: new full-speed USB device number 96 using dummy_hcd [ 1363.778018][T14116] usb 3-1: Using ep0 maxpacket: 16 [ 1363.788582][T14116] usb 3-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 1363.799165][T14116] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1363.807523][T14116] usb 3-1: Product: syz [ 1363.811957][T14116] usb 3-1: Manufacturer: syz [ 1363.820068][T14116] usb 3-1: SerialNumber: syz [ 1363.834011][T14116] usb 3-1: config 0 descriptor?? [ 1363.854142][T14116] visor 3-1:0.0: Sony Clie 3.5 converter detected [ 1363.887589][ T24] usb 4-1: device descriptor read/64, error -71 [ 1364.009567][ T24] usb usb4-port1: attempt power cycle [ 1364.366897][ T24] usb 4-1: new full-speed USB device number 97 using dummy_hcd [ 1364.391477][ T24] usb 4-1: device descriptor read/8, error -71 [ 1364.412602][T27122] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6545'. [ 1364.607950][T27124] xt_bpf: check failed: parse error [ 1364.721497][ T24] usb 4-1: new full-speed USB device number 98 using dummy_hcd [ 1364.758766][ T24] usb 4-1: device descriptor read/8, error -71 [ 1364.875799][ T24] usb usb4-port1: unable to enumerate USB device [ 1364.950745][T27126] Cannot find add_set index 12800 as target [ 1366.034815][T14116] usb 3-1: clie_3_5_startup: get interface number failed: -71 [ 1366.275499][T14116] visor 3-1:0.0: probe with driver visor failed with error -71 [ 1366.291750][T14116] usb 3-1: USB disconnect, device number 107 [ 1366.696668][T27152] loop2: detected capacity change from 0 to 7 [ 1366.705277][T27152] loop2: [ 1366.708510][T27152] loop2: partition table partially beyond EOD, truncated [ 1366.891243][T27156] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6557'. [ 1367.177210][T27160] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6559'. [ 1367.210009][T27163] loop8: detected capacity change from 0 to 8 [ 1367.234428][T27163] Dev loop8: unable to read RDB block 8 [ 1367.260512][T27163] loop8: unable to read partition table [ 1367.266454][T27163] loop8: partition table beyond EOD, truncated [ 1367.322651][T27163] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1367.717539][T27179] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6565'. [ 1367.866889][T25915] usb 3-1: new low-speed USB device number 108 using dummy_hcd [ 1367.998244][T25915] usb 3-1: device descriptor read/64, error -71 [ 1368.058015][T27185] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.6567'. [ 1368.172802][T27186] openvswitch: netlink: Invalid VLAN frame [ 1368.266970][T14116] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 1368.347650][T25915] usb 3-1: new low-speed USB device number 109 using dummy_hcd [ 1368.374346][T27192] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6568'. [ 1368.387969][T27192] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1368.407034][T14116] usb 5-1: device descriptor read/64, error -71 [ 1368.488294][T27192] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1368.500333][T25915] usb 3-1: device descriptor read/64, error -71 [ 1368.523365][T27196] Cannot find add_set index 16128 as target [ 1368.627280][T25915] usb usb3-port1: attempt power cycle [ 1368.696920][T14116] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 1368.847021][T14116] usb 5-1: device descriptor read/64, error -71 [ 1368.968920][T14116] usb usb5-port1: attempt power cycle [ 1368.987338][T25915] usb 3-1: new low-speed USB device number 110 using dummy_hcd [ 1369.017557][T25915] usb 3-1: device descriptor read/8, error -71 [ 1369.276890][T25915] usb 3-1: new low-speed USB device number 111 using dummy_hcd [ 1369.292142][ C1] sd 0:0:1:0: [sda] tag#86 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 1369.298320][T25915] usb 3-1: device descriptor read/8, error -71 [ 1369.302574][ C1] sd 0:0:1:0: [sda] tag#86 CDB: Write(6) 0a 00 0e 22 00 00 00 00 00 00 00 00 [ 1369.356910][T14116] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 1369.379168][T14116] usb 5-1: device descriptor read/8, error -71 [ 1369.417691][T25915] usb usb3-port1: unable to enumerate USB device [ 1369.627140][T14116] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 1369.737430][T14116] usb 5-1: device descriptor read/8, error -71 [ 1369.847416][T14116] usb usb5-port1: unable to enumerate USB device [ 1369.857775][T27213] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1369.865533][T27213] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1369.872091][T27213] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1369.878420][T27213] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1369.884562][T27213] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1370.040347][T27222] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6577'. [ 1370.105969][T27222] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6577'. [ 1370.117577][T27222] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1370.138788][T27222] macvlan2: entered promiscuous mode [ 1370.144229][T27222] macvlan2: entered allmulticast mode [ 1370.152179][T27222] bond2: entered promiscuous mode [ 1370.158596][T27222] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1370.170544][T27222] bond2: left promiscuous mode [ 1370.170928][T27227] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6580'. [ 1370.365207][T27234] binder: 27233:27234 ioctl c0306201 2000000003c0 returned -14 [ 1370.528430][T27238] xt_hashlimit: max too large, truncated to 1048576 [ 1370.549811][T27240] macsec1: entered promiscuous mode [ 1370.555090][T27240] erspan0: entered promiscuous mode [ 1370.583031][T27240] erspan0: left promiscuous mode [ 1370.988455][T27255] binder: 27247:27255 unknown command 0 [ 1370.994109][T27255] binder: 27247:27255 ioctl c0306201 200000000080 returned -22 [ 1371.127720][T24569] Bluetooth: hci2: command 0x0406 tx timeout [ 1371.964513][T24569] Bluetooth: hci1: command 0x0c1a tx timeout [ 1371.974681][T24637] Bluetooth: hci5: command 0x0c1a tx timeout [ 1371.975300][ T5828] Bluetooth: hci4: command 0x0c1a tx timeout [ 1371.980862][T24637] Bluetooth: hci0: command 0x0406 tx timeout [ 1372.332718][T24569] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 1372.618170][T27273] binder: 27272:27273 ioctl c0306201 2000000003c0 returned -14 [ 1372.917303][T27277] syzkaller0: entered promiscuous mode [ 1372.969949][T27277] syzkaller0: entered allmulticast mode [ 1373.089712][T27280] tipc: Enabled bearer , priority 0 [ 1373.101939][T27286] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 1373.101939][T27286] The task syz.2.6599 (27286) triggered the difference, watch for misbehavior. [ 1373.121446][T27276] tipc: Resetting bearer [ 1373.204293][T27288] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6599'. [ 1373.269835][T27288] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6599'. [ 1373.316369][T27276] tipc: Disabling bearer [ 1373.757429][T27306] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6606'. [ 1373.944051][T27296] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6602'. [ 1373.953103][T27306] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1374.037370][T25915] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 1374.062351][T27309] netlink: 132 bytes leftover after parsing attributes in process `syz.5.6607'. [ 1374.233235][T25915] usb 4-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1374.243602][T25915] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1374.273484][T27311] netlink: 'syz.5.6609': attribute type 1 has an invalid length. [ 1374.281559][T25915] usb 4-1: Product: syz [ 1374.285757][T25915] usb 4-1: Manufacturer: syz [ 1374.298358][T25915] usb 4-1: SerialNumber: syz [ 1374.317579][T25915] usb 4-1: config 0 descriptor?? [ 1374.332782][T25915] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1374.349069][T25915] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1374.370088][T25915] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 1374.380232][T25915] usb 4-1: media controller created [ 1374.411608][T25915] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1374.535133][T27302] dvb-usb: bulk message failed: -22 (7/0) [ 1374.537766][T27311] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 1374.553662][T27317] binder: 27315:27317 ioctl c0306201 2000000003c0 returned -14 [ 1374.628841][T25915] DVB: Unable to find symbol mt352_attach() [ 1374.717141][T27321] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6610'. [ 1374.729211][T25915] DVB: Unable to find symbol nxt6000_attach() [ 1374.735449][T25915] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 1374.829118][T25915] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input109 [ 1374.904754][T25915] dvb-usb: schedule remote query interval to 1000 msecs. [ 1374.947036][T25915] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 1374.976110][T25915] dvb-usb: bulk message failed: -22 (7/0) [ 1374.996982][T25915] dvb-usb: bulk message failed: -22 (7/0) [ 1375.486122][T25915] usb 4-1: USB disconnect, device number 99 [ 1376.003170][T25915] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 1376.419600][T27359] loop8: detected capacity change from 0 to 8 [ 1376.431082][T27359] Dev loop8: unable to read RDB block 8 [ 1376.444624][T27359] loop8: unable to read partition table [ 1376.475287][T27359] loop8: partition table beyond EOD, truncated [ 1376.502027][T27359] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1377.045831][T27367] fuse: Bad value for 'fd' [ 1377.217528][T27370] netlink: 'syz.6.6626': attribute type 10 has an invalid length. [ 1377.585684][T27380] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6630'. [ 1378.617317][ T795] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1378.811954][ T795] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1378.824485][ T795] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 75, changing to 7 [ 1378.867997][ T795] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 129, changing to 7 [ 1378.922206][ T795] usb 3-1: New USB device found, idVendor=1235, idProduct=8014, bcdDevice= 0.40 [ 1378.944648][ T795] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1378.971067][ T795] usb 3-1: Product: syz [ 1378.985545][ T795] usb 3-1: Manufacturer: К [ 1379.000935][ T795] usb 3-1: SerialNumber: syz [ 1379.249277][ T795] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1379.276061][ T795] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1379.388296][ T795] usb 3-1: USB disconnect, device number 112 [ 1379.506001][ T6654] udevd[6654]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1379.727467][T14116] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 1379.888952][T14116] usb 5-1: Using ep0 maxpacket: 32 [ 1379.898960][T14116] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1379.910292][T14116] usb 5-1: config 0 has no interfaces? [ 1379.915826][T14116] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1379.931327][T25915] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 1379.957951][T14116] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1379.976648][T14116] usb 5-1: config 0 descriptor?? [ 1380.013611][T27459] netlink: 'syz.5.6657': attribute type 10 has an invalid length. [ 1380.107015][T25915] usb 4-1: Using ep0 maxpacket: 8 [ 1380.116929][T25915] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1380.131867][T27463] tipc: Enabled bearer , priority 0 [ 1380.141313][T25915] usb 4-1: config 4 has an invalid interface number: 133 but max is 0 [ 1380.141464][T27463] syzkaller0: entered promiscuous mode [ 1380.160710][T27463] syzkaller0: entered allmulticast mode [ 1380.170983][T25915] usb 4-1: config 4 has no interface number 0 [ 1380.182770][T25915] usb 4-1: New USB device found, idVendor=12d1, idProduct=8b88, bcdDevice=f3.59 [ 1380.198076][T14116] usb 5-1: USB disconnect, device number 116 [ 1380.210700][T25915] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1380.219485][T25915] usb 4-1: Product: syz [ 1380.224028][T25915] usb 4-1: Manufacturer: syz [ 1380.229112][T25915] usb 4-1: SerialNumber: syz [ 1380.296313][T27463] tipc: Resetting bearer [ 1380.336912][T27462] tipc: Resetting bearer [ 1380.385288][T27462] tipc: Disabling bearer [ 1380.455038][T25915] huawei_cdc_ncm 4-1:4.133: CDC Union missing and no IAD found [ 1380.464782][T25915] huawei_cdc_ncm 4-1:4.133: bind() failure [ 1380.495740][T25915] usb 4-1: USB disconnect, device number 100 [ 1380.624226][T27471] macsec1: entered promiscuous mode [ 1380.642194][T27471] erspan0: entered promiscuous mode [ 1380.663504][T27471] erspan0: left promiscuous mode [ 1380.905296][T27477] x_tables: duplicate underflow at hook 4 [ 1381.820188][T27482] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6664'. [ 1382.236992][ T795] usb 5-1: new full-speed USB device number 117 using dummy_hcd [ 1382.620738][ T795] usb 5-1: not running at top speed; connect to a high speed hub [ 1382.640597][ T795] usb 5-1: config 7 has an invalid interface number: 251 but max is 0 [ 1382.666045][ T795] usb 5-1: config 7 has an invalid descriptor of length 1, skipping remainder of the config [ 1382.770410][ T795] usb 5-1: config 7 has no interface number 0 [ 1382.780813][ T795] usb 5-1: config 7 interface 251 altsetting 10 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 1382.808994][ T795] usb 5-1: config 7 interface 251 altsetting 10 endpoint 0xA has invalid maxpacket 1056, setting to 64 [ 1382.831520][ T795] usb 5-1: config 7 interface 251 altsetting 10 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 1382.861600][ T795] usb 5-1: config 7 interface 251 has no altsetting 0 [ 1382.892491][ T795] usb 5-1: New USB device found, idVendor=0bda, idProduct=317f, bcdDevice=ca.35 [ 1382.903505][ T795] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1382.920105][ T795] usb 5-1: Product: syz [ 1382.929161][ T795] usb 5-1: Manufacturer: syz [ 1382.940362][ T795] usb 5-1: SerialNumber: syz [ 1383.215960][ T795] usb 5-1: USB disconnect, device number 117 [ 1383.289450][T27499] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6671'. [ 1383.613282][T27503] loop2: detected capacity change from 0 to 7 [ 1383.651502][T27503] loop2: [ 1383.655117][T27503] loop2: partition table partially beyond EOD, truncated [ 1383.951882][T27509] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6676'. [ 1384.224167][T27519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6680'. [ 1384.252438][ T24] usb 3-1: new full-speed USB device number 113 using dummy_hcd [ 1384.257493][T27519] hsr0: entered promiscuous mode [ 1384.411171][ T24] usb 3-1: not running at top speed; connect to a high speed hub [ 1384.565535][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1384.597540][ T24] usb 3-1: New USB device found, idVendor=0582, idProduct=000c, bcdDevice= 0.40 [ 1384.610416][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1384.628125][ T24] usb 3-1: Product: syz [ 1384.636464][ T24] usb 3-1: Manufacturer: syz [ 1384.646224][ T24] usb 3-1: SerialNumber: syz [ 1385.008210][T27514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1385.105169][T27539] tipc: Failed to remove unknown binding: 66,1,1/2886997007:1485436931/1485436933 [ 1385.271569][T27514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1385.283820][T27514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1385.323540][T27514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1385.427926][T27514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1385.467482][T27514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1385.501145][T27514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1385.538064][T27514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1385.538233][T27541] Cannot find add_set index 40191 as target [ 1385.573341][T27514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1385.622637][T27514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1386.253249][ T24] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1386.334725][ T24] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1386.460106][ T24] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 1386.626750][T27561] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6690'. [ 1386.644909][ T24] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1386.669954][T27561] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6690'. [ 1386.730766][ T24] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1386.934736][ T24] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 1387.014112][ T24] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1387.038271][ T24] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1387.118410][T27570] syzkaller0: entered promiscuous mode [ 1387.143436][T27570] syzkaller0: entered allmulticast mode [ 1387.364486][ T24] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 1387.378033][ T24] usb 3-1: USB disconnect, device number 113 [ 1387.404541][T27577] tipc: Enabled bearer , priority 0 [ 1387.438796][ T5954] udevd[5954]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1387.700276][T27582] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6698'. [ 1387.726726][T27568] tipc: Resetting bearer [ 1387.815626][T27568] tipc: Disabling bearer [ 1388.052047][T27585] fuse: Unknown parameter 'f&57md{W0x0000000000000004' [ 1388.180996][T27592] gretap0: refused to change device tx_queue_len [ 1388.244655][T27595] loop2: detected capacity change from 0 to 7 [ 1388.265790][T27595] loop2: [ 1388.274018][T27595] loop2: partition table partially beyond EOD, truncated [ 1388.386488][T25915] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1388.482727][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 1388.482742][ T30] audit: type=1800 audit(1776198193.058:3257): pid=27594 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.6700" name="file0" dev="fuse" ino=3 res=0 errno=0 [ 1388.580080][T25915] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1389.206083][T25915] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1389.386183][T25915] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1389.405762][T25915] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1389.473993][T25915] usb 3-1: config 0 descriptor?? [ 1389.683134][T27617] binder: 27616:27617 ioctl c0306201 2000000003c0 returned -14 [ 1389.869949][T25915] usbhid 3-1:0.0: can't add hid device: -71 [ 1389.876135][T25915] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1389.910520][T25915] usb 3-1: USB disconnect, device number 114 [ 1390.397741][T27630] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6714'. [ 1390.406709][T27630] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1390.766299][T27645] binder: 27643:27645 ioctl c0306201 2000000003c0 returned -14 [ 1391.267916][T27666] loop2: detected capacity change from 0 to 7 [ 1391.282061][T27666] loop2: [ 1391.298720][T27666] loop2: partition table partially beyond EOD, truncated [ 1391.341235][T27662] gretap0: refused to change device tx_queue_len [ 1391.476958][ T24] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1391.648378][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 1391.685036][ T24] usb 6-1: config index 0 descriptor too short (expected 164, got 36) [ 1391.697869][ T795] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 1391.753101][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1391.764626][T14132] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1391.783317][T27674] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6730'. [ 1391.794476][ T24] usb 6-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 1391.845463][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1391.898036][ T795] usb 5-1: config 0 has an invalid interface number: 33 but max is 0 [ 1391.906219][ T795] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1391.930166][T14132] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 1391.943561][ T24] usb 6-1: config 0 descriptor?? [ 1391.951695][ T795] usb 5-1: config 0 has no interface number 0 [ 1391.998788][ T795] usb 5-1: config 0 interface 33 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1023 [ 1392.010114][T14132] usb 3-1: New USB device found, idVendor=0b05, idProduct=1abe, bcdDevice= 0.00 [ 1392.019646][T14132] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.037349][ T795] usb 5-1: config 0 interface 33 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1392.050034][ T795] usb 5-1: config 0 interface 33 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 1392.062377][T14132] usb 3-1: config 0 descriptor?? [ 1392.073237][T27670] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1392.107332][ T795] usb 5-1: New USB device found, idVendor=2040, idProduct=4901, bcdDevice=68.64 [ 1392.144211][ T795] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1392.164414][ T795] usb 5-1: Product: syz [ 1392.174535][ T795] usb 5-1: Manufacturer: syz [ 1392.282361][ T795] usb 5-1: SerialNumber: syz [ 1392.301858][ T795] usb 5-1: config 0 descriptor?? [ 1392.310747][T27668] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1392.401203][ T795] hdpvr 5-1:0.33: Could not find bulk-in endpoint [ 1392.426261][ T795] hdpvr 5-1:0.33: probe with driver hdpvr failed with error -12 [ 1392.670926][ T24] logitech 0003:046D:C29C.0047: hidraw0: USB HID v0.00 Device [HID 046d:c29c] on usb-dummy_hcd.5-1/input0 [ 1392.722213][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1392.729536][ T795] usb 5-1: USB disconnect, device number 118 [ 1392.750235][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1392.781023][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1392.808236][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1392.853901][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1392.877501][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1392.905411][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1392.935177][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1392.944823][T27670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1392.958657][T27670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1393.004749][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1393.024882][T14132] asus 0003:0B05:1ABE.0048: unknown main item tag 0x0 [ 1393.035367][T14132] asus 0003:0B05:1ABE.0048: unexpected long global item [ 1393.055742][T14132] asus 0003:0B05:1ABE.0048: Asus hid parse failed: -22 [ 1393.078393][T14132] asus 0003:0B05:1ABE.0048: probe with driver asus failed with error -22 [ 1393.122703][T27670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1393.143184][T27670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1393.239279][T27670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1393.250729][T27670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1393.285447][T25915] usb 3-1: USB disconnect, device number 115 [ 1394.225583][T27696] loop9: detected capacity change from 0 to 524287936 [ 1394.291763][ T24] logitech 0003:046D:C29C.0047: no inputs found [ 1394.351480][ T24] usb 6-1: USB disconnect, device number 66 [ 1395.167014][ T24] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1395.190539][T27724] gretap0: refused to change device tx_queue_len [ 1395.338910][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1395.351407][T27726] loop8: detected capacity change from 0 to 7 [ 1395.368642][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1395.382117][T27726] Dev loop8: unable to read RDB block 7 [ 1395.389787][T27728] netlink: 'syz.5.6749': attribute type 3 has an invalid length. [ 1395.397062][T27726] loop8: unable to read partition table [ 1395.405797][ T24] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1395.417526][T27726] loop8: partition table beyond EOD, truncated [ 1395.424267][ T24] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 1395.442052][ T24] usb 3-1: Manufacturer: syz [ 1395.452531][T27726] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1395.466137][ T24] usb 3-1: config 0 descriptor?? [ 1396.289937][ T24] uclogic 0003:256C:006D.0049: interface is invalid, ignoring [ 1396.499479][T27720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1396.572372][T27720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1396.619312][ T24] usb 3-1: USB disconnect, device number 116 [ 1396.652404][T27743] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6756'. [ 1396.954051][T27752] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6759'. [ 1396.982061][T27753] netlink: 104 bytes leftover after parsing attributes in process `syz.5.6757'. [ 1397.308157][T25915] usb 6-1: new low-speed USB device number 67 using dummy_hcd [ 1397.470038][T25915] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 1397.486871][T25915] usb 6-1: config 0 has no interface number 0 [ 1397.622818][T25915] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1397.749565][T25915] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1397.762164][T25915] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1397.776958][T25915] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 1397.790023][T25915] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1397.814119][T25915] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1397.875583][T27779] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6769'. [ 1398.017733][T25915] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1398.056688][T25915] usb 6-1: config 0 descriptor?? [ 1398.067513][T27753] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1398.075637][T27753] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1398.104989][T25915] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1398.731997][T27788] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6772'. [ 1398.786010][T27792] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6770'. [ 1398.796949][T27792] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6770'. [ 1398.898862][T14132] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1399.327043][T14116] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 1399.346894][T14132] usb 4-1: Using ep0 maxpacket: 32 [ 1399.372504][T14132] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1399.385083][T14132] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1399.413297][T14132] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1399.472190][T14132] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1399.487404][T14116] usb 5-1: Using ep0 maxpacket: 16 [ 1399.501013][T14132] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1399.501051][T14116] usb 5-1: config 0 has no interfaces? [ 1399.502418][T14116] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1399.564039][T14116] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1399.567364][T14132] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1399.593775][T14116] usb 5-1: Manufacturer: syz [ 1399.596914][T14132] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1399.624133][T14132] usb 4-1: Product: syz [ 1399.638892][T14132] usb 4-1: Manufacturer: syz [ 1399.665884][T14132] usb 4-1: SerialNumber: syz [ 1399.675939][T14116] usb 5-1: config 0 descriptor?? [ 1399.729387][T14132] usb 4-1: config 0 descriptor?? [ 1400.093081][T25915] usb 6-1: USB disconnect, device number 67 [ 1400.105306][T25915] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 1400.541421][T14132] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 1400.547805][T14132] input input110: Device does not respond to id packet P [ 1400.656730][T14132] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 1400.682170][T14132] input input110: Device does not respond to id packet B [ 1400.698840][T27814] netlink: 136 bytes leftover after parsing attributes in process `syz.5.6779'. [ 1400.711971][T14132] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 1400.721135][T27814] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1400.737407][T14132] input input110: Device does not respond to id packet N [ 1400.774797][T14132] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 1400.790259][T14132] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 1400.808329][T14132] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 1400.817487][T14132] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 1400.960976][T14132] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input110 [ 1401.345826][T27823] xt_ecn: cannot match TCP bits for non-tcp packets [ 1401.360559][T27823] xt_ecn: cannot match TCP bits for non-tcp packets [ 1401.502009][T14132] usb 4-1: USB disconnect, device number 101 [ 1401.511453][T25915] usb 5-1: USB disconnect, device number 119 [ 1401.524369][T27823] xt_ecn: cannot match TCP bits for non-tcp packets [ 1401.869605][T27831] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6785'. [ 1401.988069][T27836] netlink: 'syz.6.6787': attribute type 10 has an invalid length. [ 1402.039043][T27837] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6785'. [ 1402.184538][T27837] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1402.286935][T14132] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1402.318255][T27841] macvlan3: entered promiscuous mode [ 1402.323637][T27841] macvlan3: entered allmulticast mode [ 1402.353182][T27841] bond3: entered promiscuous mode [ 1402.359393][T27841] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1402.370046][T27841] bond3: left promiscuous mode [ 1402.447752][T14132] usb 6-1: Using ep0 maxpacket: 16 [ 1402.458709][T14132] usb 6-1: too many endpoints for config 253 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 1402.486908][T14132] usb 6-1: config 253 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 1402.507025][T14132] usb 6-1: config 253 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1402.525798][T14132] usb 6-1: config 253 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 1402.546252][T14132] usb 6-1: config 253 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 1402.576956][ T24] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 1402.602839][T14132] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1402.619485][T14132] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1402.646489][T14132] usb 6-1: SerialNumber: syz [ 1402.670529][T27834] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1402.680769][T27834] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1402.691588][T27834] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1402.747014][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 1402.758917][ T24] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1402.787401][ T24] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1402.807915][ T24] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1402.837116][ T24] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1402.869603][ T24] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1402.892354][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1402.947105][T25915] usb 4-1: new full-speed USB device number 102 using dummy_hcd [ 1402.987101][ T24] usb 5-1: Product: syz [ 1402.991548][ T24] usb 5-1: Manufacturer: syz [ 1402.996203][ T24] usb 5-1: SerialNumber: syz [ 1403.029809][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1403.039319][ T24] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input111 [ 1403.121498][T25915] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1403.307014][T25915] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1403.307100][ T24] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1403.315298][T25915] usb 4-1: Product: syz [ 1403.329857][T25915] usb 4-1: Manufacturer: syz [ 1403.334498][T25915] usb 4-1: SerialNumber: syz [ 1403.437105][ T24] (id 0x00) [ 1403.442513][T25915] usb 4-1: config 0 descriptor?? [ 1403.615426][T14132] usb 6-1: USB disconnect, device number 68 [ 1403.637360][ T24] rc_core: IR keymap rc-imon-pad not found [ 1403.651101][ T24] Registered IR keymap rc-empty [ 1403.663607][T25915] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1403.679611][ T24] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1403.715006][ T24] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1403.759941][ T24] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 1403.786741][ T24] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input112 [ 1403.809085][T27865] fuse: Bad value for 'fd' [ 1403.856547][T27867] 9p: p9: multiple sources not supported [ 1403.870850][ T24] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:120> initialized [ 1404.421216][T27874] netlink: 132 bytes leftover after parsing attributes in process `syz.5.6800'. [ 1404.735337][T24637] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1404.750958][T24637] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1404.760971][T24637] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1404.772906][T24637] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1404.784894][T24637] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1404.803094][T27879] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6802'. [ 1404.837072][T27879] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6802'. [ 1405.099877][T25915] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1405.157110][T25915] usb 4-1: USB disconnect, device number 102 [ 1405.186154][T27882] syzkaller0: entered promiscuous mode [ 1405.196996][T27882] syzkaller0: entered allmulticast mode [ 1405.325095][T11383] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1405.573704][T11383] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1405.595606][T27892] netlink: 572 bytes leftover after parsing attributes in process `syz.2.6806'. [ 1405.605085][T27880] chnl_net:caif_netlink_parms(): no params data found [ 1405.637159][T27892] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6806'. [ 1405.649026][T14132] usb 5-1: USB disconnect, device number 120 [ 1405.794335][T11383] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1405.804736][T27899] SET target dimension over the limit! [ 1405.808582][T27898] loop8: detected capacity change from 0 to 7 [ 1405.821328][T27898] Dev loop8: unable to read RDB block 7 [ 1405.827262][T27898] loop8: unable to read partition table [ 1405.839577][T27898] loop8: partition table beyond EOD, truncated [ 1405.845902][T27898] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1405.902550][T27901] gretap0: refused to change device tx_queue_len [ 1405.912965][T25915] usb 3-1: new full-speed USB device number 117 using dummy_hcd [ 1406.031260][T11383] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1406.062034][T27903] macsec1: entered promiscuous mode [ 1406.069992][T27903] erspan0: entered promiscuous mode [ 1406.078137][T27903] erspan0: left promiscuous mode [ 1406.132128][T25915] usb 3-1: too many configurations: 18, using maximum allowed: 8 [ 1406.167344][T25915] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1406.181215][T25915] usb 3-1: can't read configurations, error -61 [ 1406.281079][T27914] loop8: detected capacity change from 0 to 8 [ 1406.289447][T27914] Dev loop8: unable to read RDB block 8 [ 1406.295122][T27914] loop8: unable to read partition table [ 1406.303400][T27914] loop8: partition table beyond EOD, truncated [ 1406.347488][T25915] usb 3-1: new full-speed USB device number 118 using dummy_hcd [ 1406.347669][T27914] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1406.493499][T27880] bridge0: port 1(bridge_slave_0) entered blocking state [ 1406.520071][T27880] bridge0: port 1(bridge_slave_0) entered disabled state [ 1406.538532][T25915] usb 3-1: too many configurations: 18, using maximum allowed: 8 [ 1406.549147][T27880] bridge_slave_0: entered allmulticast mode [ 1406.549680][T25915] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1406.564233][T25915] usb 3-1: can't read configurations, error -61 [ 1406.565284][T27880] bridge_slave_0: entered promiscuous mode [ 1406.610544][T25915] usb usb3-port1: attempt power cycle [ 1406.658046][T27880] bridge0: port 2(bridge_slave_1) entered blocking state [ 1406.682806][T27880] bridge0: port 2(bridge_slave_1) entered disabled state [ 1406.716362][T27880] bridge_slave_1: entered allmulticast mode [ 1406.734279][T27880] bridge_slave_1: entered promiscuous mode [ 1406.881945][T27880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1406.900135][T24637] Bluetooth: hci3: command tx timeout [ 1406.940845][T27880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1406.998500][T11383] bridge_slave_1: left allmulticast mode [ 1406.998617][T25915] usb 3-1: new full-speed USB device number 119 using dummy_hcd [ 1407.039731][T25915] usb 3-1: too many configurations: 18, using maximum allowed: 8 [ 1407.053878][T11383] bridge_slave_1: left promiscuous mode [ 1407.054493][T25915] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1407.078008][T25915] usb 3-1: can't read configurations, error -61 [ 1407.080075][T11383] bridge0: port 2(bridge_slave_1) entered disabled state [ 1407.119534][T11383] bridge_slave_0: left allmulticast mode [ 1407.138377][T11383] bridge_slave_0: left promiscuous mode [ 1407.161345][T11383] bridge0: port 1(bridge_slave_0) entered disabled state [ 1407.258871][T25915] usb 3-1: new full-speed USB device number 120 using dummy_hcd [ 1407.741739][T27918] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1407.753340][T25915] usb 3-1: too many configurations: 18, using maximum allowed: 8 [ 1407.765395][T25915] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 1407.785679][T25915] usb 3-1: can't read configurations, error -61 [ 1407.799483][T25915] usb usb3-port1: unable to enumerate USB device [ 1407.820887][T27918] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1407.828982][T27918] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1407.845897][T27918] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1407.876482][T27918] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1407.969735][T11383] ip6gretap0 (unregistering): left promiscuous mode [ 1408.178094][T27918] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1408.276614][T27918] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1408.518938][T11383] gretap0 (unregistering): left promiscuous mode [ 1408.783232][T27936] netlink: 'syz.2.6822': attribute type 10 has an invalid length. [ 1408.821660][T24569] Bluetooth: hci0: command 0x0406 tx timeout [ 1409.098156][T27941] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6821'. [ 1409.139420][T11383] bond1 (unregistering): Released all slaves [ 1409.212163][T11383] bond2 (unregistering): Released all slaves [ 1409.235167][T11383] bond3 (unregistering): Released all slaves [ 1409.318045][T11383] bond0 (unregistering): left promiscuous mode [ 1409.369465][T11383] bond0 (unregistering): Released all slaves [ 1409.440318][T11383] bond4 (unregistering): Released all slaves [ 1409.482061][T11383] bond5 (unregistering): Released all slaves [ 1409.651286][T11383] bond6 (unregistering): Released all slaves [ 1409.670350][T11383] bond7 (unregistering): Released all slaves [ 1409.712279][T11383] bond8 (unregistering): Released all slaves [ 1409.857024][T24569] Bluetooth: hci5: command 0x0c1a tx timeout [ 1409.858256][T24637] Bluetooth: hci4: command 0x0c1a tx timeout [ 1409.867128][T27956] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6826'. [ 1409.897109][T11383] tipc: Left network mode [ 1409.923761][T27947] syzkaller0: entered promiscuous mode [ 1409.929459][T24637] Bluetooth: hci3: command 0x040f tx timeout [ 1409.929651][T24569] Bluetooth: hci1: command 0x0c1a tx timeout [ 1409.966131][T27947] syzkaller0: entered allmulticast mode [ 1410.013051][T27960] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6826'. [ 1410.029016][T27880] team0: Port device team_slave_0 added [ 1410.191361][T27959] netlink: 136 bytes leftover after parsing attributes in process `syz.2.6827'. [ 1410.204336][T27959] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1410.436450][T27960] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1410.468214][T27880] team0: Port device team_slave_1 added [ 1410.491258][T27965] macvlan3: entered promiscuous mode [ 1410.498049][T27965] macvlan3: entered allmulticast mode [ 1410.525471][T27965] bond4: entered promiscuous mode [ 1410.531845][T27965] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1410.641602][T27965] bond4: left promiscuous mode [ 1411.181986][T27880] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1411.240050][T27880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1411.325460][T27996] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6832'. [ 1411.362293][T27880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1411.538213][T27999] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6834'. [ 1411.551531][T27986] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1411.557921][T27986] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1411.565353][T27986] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1411.575234][T27999] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6834'. [ 1411.607265][T27986] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1411.617171][T27986] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1411.693089][T27880] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1411.723103][T27880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1411.936856][T27880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1412.169188][T27880] hsr_slave_0: entered promiscuous mode [ 1412.237456][T27880] hsr_slave_1: entered promiscuous mode [ 1412.257903][T27880] debugfs: 'hsr0' already exists in 'hsr' [ 1412.276833][T27880] Cannot create hsr debugfs directory [ 1412.276875][T14132] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 1412.303858][T11383] hsr_slave_0: left promiscuous mode [ 1412.323451][T11383] hsr_slave_1: left promiscuous mode [ 1412.368132][T11383] hsr0: left promiscuous mode [ 1412.387346][T11383] veth1_macvtap: left promiscuous mode [ 1412.396963][T11383] veth0_macvtap: left promiscuous mode [ 1412.562623][T14132] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1412.574731][T14132] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1412.601279][T14132] usb 5-1: Product: syz [ 1412.612005][T14132] usb 5-1: Manufacturer: syz [ 1412.626973][T14132] usb 5-1: SerialNumber: syz [ 1412.658756][T14132] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1412.723387][ T24] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1412.945510][T14117] usb 5-1: USB disconnect, device number 121 [ 1412.977146][T24569] Bluetooth: hci0: command 0x0406 tx timeout [ 1413.019841][T11383] team0 (unregistering): Port device batadv0 removed [ 1413.032650][T28016] netlink: 92 bytes leftover after parsing attributes in process `syz.2.6839'. [ 1413.470396][T11383] team0 (unregistering): Port device team_slave_1 removed [ 1413.552686][T11383] team0 (unregistering): Port device team_slave_0 removed [ 1413.609895][T24569] Bluetooth: hci5: command 0x0c1a tx timeout [ 1413.616153][T24637] Bluetooth: hci1: command 0x0c1a tx timeout [ 1413.616359][T18251] Bluetooth: hci4: command 0x0c1a tx timeout [ 1413.688202][T18251] Bluetooth: hci3: command 0x040f tx timeout [ 1413.766931][ T24] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 1413.777734][ T24] ath9k_htc: Failed to initialize the device [ 1413.784865][T14117] usb 5-1: ath9k_htc: USB layer deinitialized [ 1414.142662][T28016] kthread_run failed with err -4 [ 1414.226885][T14117] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 1414.358731][T28034] loop8: detected capacity change from 0 to 7 [ 1414.376636][T28034] Dev loop8: unable to read RDB block 7 [ 1414.402783][T28034] loop8: unable to read partition table [ 1414.415463][T28034] loop8: partition table beyond EOD, truncated [ 1414.447844][T14117] usb 5-1: Using ep0 maxpacket: 8 [ 1414.454322][T28034] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1414.471940][T14117] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 1414.504124][T14117] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 1414.534658][T14117] usb 5-1: Product: syz [ 1414.539644][T14117] usb 5-1: Manufacturer: syz [ 1414.544532][T14117] usb 5-1: SerialNumber: syz [ 1414.634743][T14117] usb 5-1: config 0 descriptor?? [ 1414.690947][T28042] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6846'. [ 1414.697552][T28046] FAULT_INJECTION: forcing a failure. [ 1414.697552][T28046] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1414.734952][T28046] CPU: 1 UID: 0 PID: 28046 Comm: syz.2.6848 Tainted: G L syzkaller #0 PREEMPT(full) [ 1414.734985][T28046] Tainted: [L]=SOFTLOCKUP [ 1414.734993][T28046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1414.735005][T28046] Call Trace: [ 1414.735013][T28046] [ 1414.735021][T28046] dump_stack_lvl+0xe8/0x150 [ 1414.735056][T28046] should_fail_ex+0x412/0x560 [ 1414.735082][T28046] _copy_from_user+0x2d/0xb0 [ 1414.735107][T28046] ___sys_sendmsg+0x1c6/0x360 [ 1414.735140][T28046] ? __pfx____sys_sendmsg+0x10/0x10 [ 1414.735201][T28046] ? __fget_files+0x2a/0x420 [ 1414.735228][T28046] ? __fget_files+0x3a0/0x420 [ 1414.735266][T28046] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1414.735299][T28046] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1414.735335][T28046] ? __pfx_ksys_write+0x10/0x10 [ 1414.735365][T28046] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1414.735386][T28046] do_syscall_64+0x15f/0xf80 [ 1414.735405][T28046] ? trace_irq_disable+0x3b/0x150 [ 1414.735432][T28046] ? clear_bhb_loop+0x40/0x90 [ 1414.735454][T28046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1414.735473][T28046] RIP: 0033:0x7f99e979c819 [ 1414.735494][T28046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1414.735510][T28046] RSP: 002b:00007f99ea5e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1414.735531][T28046] RAX: ffffffffffffffda RBX: 00007f99e9a15fa0 RCX: 00007f99e979c819 [ 1414.735544][T28046] RDX: 0000000000008410 RSI: 0000200000000000 RDI: 0000000000000004 [ 1414.735557][T28046] RBP: 00007f99ea5e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1414.735569][T28046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1414.735581][T28046] R13: 00007f99e9a16038 R14: 00007f99e9a15fa0 R15: 00007f99e9b3fa48 [ 1414.735611][T28046] [ 1415.205871][T14117] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 1415.221998][T14117] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -5 [ 1415.304636][T14117] usb 5-1: USB disconnect, device number 122 [ 1415.766919][T18251] Bluetooth: hci3: command 0x040f tx timeout [ 1415.842092][T28052] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1415.871601][T28052] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1415.943724][T28052] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1416.060480][T28052] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1416.077842][T28052] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1416.323900][T27880] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1416.338788][T28075] loop9: detected capacity change from 0 to 524287936 [ 1416.347587][T14117] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 1416.357846][ T24] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1416.372826][T27880] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1416.434044][T27880] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1416.501026][T27880] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1416.501239][T14117] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1416.527920][T28082] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6854'. [ 1416.572414][T14117] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1416.575157][ T24] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1416.595571][T14117] usb 5-1: config 0 descriptor?? [ 1416.656125][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1416.711080][ T24] usb 3-1: Product: syz [ 1416.715317][ T24] usb 3-1: Manufacturer: syz [ 1416.737737][ T24] usb 3-1: SerialNumber: syz [ 1416.779837][ T24] usb 3-1: config 0 descriptor?? [ 1416.859242][T14117] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1417.169387][T28055] syzkaller0: entered promiscuous mode [ 1417.175402][T28055] syzkaller0: entered allmulticast mode [ 1417.239018][ T24] usb 3-1: Firmware: major: 0, minor: 49, hardware type: ATUSB (0) [ 1417.393937][T14117] [drm:udl_init] *ERROR* Selecting channel failed [ 1417.454643][ T24] usb 3-1: failed to fetch extended address, random address set [ 1417.479570][T14117] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 1417.504608][T14117] [drm] Initialized udl on minor 2 [ 1417.523579][T14117] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1417.546360][T14117] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 1417.592167][T25915] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1417.608307][T25915] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 1417.617625][T14117] usb 5-1: USB disconnect, device number 123 [ 1417.629841][T27880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1417.658213][ T24] usb 3-1: USB disconnect, device number 121 [ 1417.848903][T18251] Bluetooth: hci0: command 0x0406 tx timeout [ 1417.926867][T18251] Bluetooth: hci4: command 0x0c1a tx timeout [ 1417.976609][T27880] 8021q: adding VLAN 0 to HW filter on device team0 [ 1417.994723][T28112] gretap0: refused to change device tx_queue_len [ 1418.008474][T18251] Bluetooth: hci5: command 0x0c1a tx timeout [ 1418.087307][T18251] Bluetooth: hci3: command 0x040f tx timeout [ 1418.087414][T24569] Bluetooth: hci1: command 0x0c1a tx timeout [ 1418.112825][ T1150] bridge0: port 1(bridge_slave_0) entered blocking state [ 1418.120081][ T1150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1418.187008][ T1150] bridge0: port 2(bridge_slave_1) entered blocking state [ 1418.194360][ T1150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1418.501851][T27880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1418.836169][T28135] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6864'. [ 1418.864279][T27880] veth0_vlan: entered promiscuous mode [ 1418.954067][T27880] veth1_vlan: entered promiscuous mode [ 1419.225061][T27880] veth0_macvtap: entered promiscuous mode [ 1419.291018][T27880] veth1_macvtap: entered promiscuous mode [ 1419.349993][T28146] vlan2: entered promiscuous mode [ 1419.355144][T28146] team0: entered promiscuous mode [ 1419.440671][T28152] loop9: detected capacity change from 0 to 524287936 [ 1419.477501][T28153] IPVS: length: 4096 != 24 [ 1419.574079][T27880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1419.652634][T27880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1419.767217][T25543] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1419.776124][T25543] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1419.900053][T28162] SET target dimension over the limit! [ 1420.177057][T24569] Bluetooth: hci3: command 0x040f tx timeout [ 1420.249474][T11383] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1420.273305][T11383] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1420.377363][T28175] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 1420.388300][T28175] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6873'. [ 1420.431124][T28153] syzkaller1: entered promiscuous mode [ 1420.436686][T28153] syzkaller1: entered allmulticast mode [ 1420.530574][T28172] macsec1: entered promiscuous mode [ 1420.560148][T28172] erspan0: entered promiscuous mode [ 1420.594689][T28172] erspan0: left promiscuous mode [ 1420.860105][T28180] loop8: detected capacity change from 0 to 7 [ 1420.908248][T28180] Dev loop8: unable to read RDB block 7 [ 1420.932573][T28180] loop8: unable to read partition table [ 1420.953705][T28180] loop8: partition table beyond EOD, truncated [ 1420.986206][T28180] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1421.145982][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1421.154113][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1421.307942][T11351] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1421.338807][T11351] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1421.681392][T28191] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6877'. [ 1421.816631][T28193] FAULT_INJECTION: forcing a failure. [ 1421.816631][T28193] name failslab, interval 1, probability 0, space 0, times 0 [ 1421.836428][T28193] CPU: 0 UID: 0 PID: 28193 Comm: syz.5.6801 Tainted: G L syzkaller #0 PREEMPT(full) [ 1421.836461][T28193] Tainted: [L]=SOFTLOCKUP [ 1421.836468][T28193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1421.836480][T28193] Call Trace: [ 1421.836488][T28193] [ 1421.836497][T28193] dump_stack_lvl+0xe8/0x150 [ 1421.836530][T28193] should_fail_ex+0x412/0x560 [ 1421.836556][T28193] should_failslab+0xa8/0x100 [ 1421.836589][T28193] ? sctp_chunkify+0x5a/0x260 [ 1421.836615][T28193] kmem_cache_alloc_noprof+0x87/0x650 [ 1421.836646][T28193] sctp_chunkify+0x5a/0x260 [ 1421.836676][T28193] _sctp_make_chunk+0x122/0x290 [ 1421.836704][T28193] sctp_make_abort_user+0x97/0x630 [ 1421.836729][T28193] ? sctp_transport_put+0xd2/0x150 [ 1421.836757][T28193] ? __pfx_sctp_make_abort_user+0x10/0x10 [ 1421.836779][T28193] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 1421.836819][T28193] sctp_sendmsg_check_sflags+0x1cb/0x330 [ 1421.836853][T28193] sctp_sendmsg+0xc13/0x2c10 [ 1421.836895][T28193] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1421.836927][T28193] ? aa_sk_perm+0x6d5/0x900 [ 1421.836964][T28193] ? __pfx_aa_sk_perm+0x10/0x10 [ 1421.836995][T28193] ? sock_rps_record_flow+0x19/0x400 [ 1421.837018][T28193] ? inet_sendmsg+0x2f4/0x370 [ 1421.837036][T28193] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1421.837060][T28193] ____sys_sendmsg+0x80a/0x9f0 [ 1421.837100][T28193] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1421.837138][T28193] ? import_iovec+0x73/0xa0 [ 1421.837168][T28193] ___sys_sendmsg+0x2a5/0x360 [ 1421.837199][T28193] ? __pfx____sys_sendmsg+0x10/0x10 [ 1421.837232][T28193] ? kstrtouint+0x6e/0xe0 [ 1421.837275][T28193] ? __fget_files+0x2a/0x420 [ 1421.837301][T28193] ? __fget_files+0x3a0/0x420 [ 1421.837340][T28193] __sys_sendmmsg+0x27c/0x4e0 [ 1421.837367][T28193] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1421.837383][T28193] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1421.837433][T28193] ? ksys_write+0x242/0x270 [ 1421.837458][T28193] ? __pfx_ksys_write+0x10/0x10 [ 1421.837486][T28193] __x64_sys_sendmmsg+0xa0/0xc0 [ 1421.837504][T28193] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1421.837525][T28193] do_syscall_64+0x15f/0xf80 [ 1421.837544][T28193] ? trace_irq_disable+0x3b/0x150 [ 1421.837582][T28193] ? clear_bhb_loop+0x40/0x90 [ 1421.837605][T28193] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1421.837624][T28193] RIP: 0033:0x7fc07df9c819 [ 1421.837645][T28193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1421.837660][T28193] RSP: 002b:00007fc07ee51028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1421.837682][T28193] RAX: ffffffffffffffda RBX: 00007fc07e215fa0 RCX: 00007fc07df9c819 [ 1421.837696][T28193] RDX: 0000000000000001 RSI: 00002000000032c0 RDI: 0000000000000004 [ 1421.837709][T28193] RBP: 00007fc07ee51090 R08: 0000000000000000 R09: 0000000000000000 [ 1421.837721][T28193] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1421.837732][T28193] R13: 00007fc07e216038 R14: 00007fc07e215fa0 R15: 00007fc07e33fa48 [ 1421.837765][T28193] [ 1422.515907][T28197] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6879'. [ 1422.556947][T28197] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1423.307951][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.316330][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.423124][T28229] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6889'. [ 1423.543134][T28232] netlink: 'syz.2.6890': attribute type 10 has an invalid length. [ 1423.707841][T14116] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1423.855576][T28241] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1423.886917][ T24] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 1423.897356][T14116] usb 6-1: Using ep0 maxpacket: 32 [ 1423.906378][T14116] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1423.907087][T28240] syzkaller0: entered promiscuous mode [ 1423.922802][T14116] usb 6-1: config 0 has no interfaces? [ 1423.923218][T28240] syzkaller0: entered allmulticast mode [ 1423.939557][T14116] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1423.960561][T14116] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1423.979697][T14116] usb 6-1: config 0 descriptor?? [ 1424.056895][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 1424.065383][ T24] usb 5-1: config 0 has an invalid interface number: 223 but max is 0 [ 1424.139164][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1424.171290][T28247] openvswitch: netlink: Invalid VLAN frame [ 1424.182692][ T24] usb 5-1: config 0 has no interface number 0 [ 1424.200490][ T24] usb 5-1: config 0 interface 223 altsetting 1 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 1424.241422][ T24] usb 5-1: config 0 interface 223 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1424.270810][T14124] usb 6-1: USB disconnect, device number 69 [ 1424.280167][ T24] usb 5-1: config 0 interface 223 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1424.312246][ T24] usb 5-1: config 0 interface 223 has no altsetting 0 [ 1424.322185][ T24] usb 5-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 1424.332498][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.345462][ T24] usb 5-1: Product: syz [ 1424.353214][ T24] usb 5-1: Manufacturer: syz [ 1424.360788][ T24] usb 5-1: SerialNumber: syz [ 1424.374847][ T24] usb 5-1: config 0 descriptor?? [ 1424.556965][T14127] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 1424.711955][T14127] usb 3-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 1424.722547][T14127] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.738429][T14127] usb 3-1: Product: syz [ 1424.742665][T14127] usb 3-1: Manufacturer: syz [ 1424.747690][T14127] usb 3-1: SerialNumber: syz [ 1424.754583][T14127] usb 3-1: config 0 descriptor?? [ 1424.762706][T14127] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 1424.932931][T14116] usb 5-1: USB disconnect, device number 124 [ 1425.556930][T14124] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1425.727371][T14124] usb 6-1: Using ep0 maxpacket: 8 [ 1425.739808][T14124] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1425.759565][T14124] usb 6-1: config 4 interface 0 has no altsetting 0 [ 1425.780575][T14124] usb 6-1: string descriptor 0 read error: -22 [ 1425.787023][T14124] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1425.800621][T14124] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 1425.810094][T14116] usb 3-1: USB disconnect, device number 122 [ 1425.855979][T14124] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1425.884818][T28265] netlink: 'syz.4.6903': attribute type 1 has an invalid length. [ 1425.889879][T14124] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1425.917753][T14124] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1425.925129][T14124] usb 6-1: media controller created [ 1425.949779][T14124] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1425.978184][T28267] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6903'. [ 1426.023814][T28265] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1426.154311][T28267] bond4: (slave bridge1): making interface the new active one [ 1426.169644][T28267] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 1426.196263][T28267] netlink: 'syz.4.6903': attribute type 12 has an invalid length. [ 1426.402948][T28271] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6904'. [ 1427.099197][T28298] netlink: 'syz.4.6915': attribute type 15 has an invalid length. [ 1427.117020][T28298] IPv6: NLM_F_CREATE should be specified when creating new route [ 1427.146935][T25915] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1427.154883][T14124] usb 6-1: USB disconnect, device number 70 [ 1427.316961][T25915] usb 4-1: Using ep0 maxpacket: 8 [ 1427.327404][T25915] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1427.337520][T25915] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1427.345652][T25915] usb 4-1: Product: syz [ 1427.350258][T25915] usb 4-1: Manufacturer: syz [ 1427.355065][T25915] usb 4-1: SerialNumber: syz [ 1427.368290][T25915] usb 4-1: config 0 descriptor?? [ 1427.376939][ T24] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 1427.544168][T28313] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6920'. [ 1427.580963][ T24] usb 5-1: New USB device found, idVendor=0403, idProduct=f850, bcdDevice=a4.46 [ 1427.598433][ T24] usb 5-1: New USB device strings: Mfr=133, Product=2, SerialNumber=0 [ 1427.627063][ T24] usb 5-1: Product: syz [ 1427.631300][ T24] usb 5-1: Manufacturer: syz [ 1427.671941][ T24] usb 5-1: config 0 descriptor?? [ 1427.692041][ T24] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 1427.712892][ T24] ftdi_sio ttyUSB0: unknown device type: 0xa446 [ 1427.953504][T28298] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1427.962699][T28298] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1428.383969][T28329] netlink: 28 bytes leftover after parsing attributes in process `syz.6.6926'. [ 1428.424060][T25915] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -110 [ 1428.440435][T25915] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 1428.455327][T28331] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6927'. [ 1428.471882][T28331] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1428.751514][T28341] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6930'. [ 1429.699034][T28359] tipc: Started in network mode [ 1429.704107][T28359] tipc: Node identity 7f000001, cluster identity 4711 [ 1429.711982][T28359] tipc: Enabling of bearer rejected, failed to enable media [ 1429.727285][T28359] netlink: 39 bytes leftover after parsing attributes in process `syz.5.6934'. [ 1429.737576][T28359] netlink: 1 bytes leftover after parsing attributes in process `syz.5.6934'. [ 1429.925317][ T24] usb 4-1: USB disconnect, device number 103 [ 1430.029244][T25915] usb 5-1: USB disconnect, device number 125 [ 1430.052655][T25915] ftdi_sio 5-1:0.0: device disconnected [ 1430.094408][T28356] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1430.101504][T28356] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1430.107985][T28356] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1430.114083][T28356] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1430.229659][T28356] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1430.350895][T28368] netlink: 256 bytes leftover after parsing attributes in process `syz.4.6938'. [ 1430.683762][T28378] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6940'. [ 1431.069866][T28395] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6946'. [ 1431.456917][T14124] usb 6-1: new low-speed USB device number 71 using dummy_hcd [ 1431.527057][T18251] Bluetooth: hci0: command 0x0406 tx timeout [ 1431.611029][T14124] usb 6-1: device descriptor read/64, error -71 [ 1431.996890][T14124] usb 6-1: new low-speed USB device number 72 using dummy_hcd [ 1432.162666][T14124] usb 6-1: device descriptor read/64, error -71 [ 1432.169539][T18251] Bluetooth: hci1: command 0x0c1a tx timeout [ 1432.175800][T24569] Bluetooth: hci5: command 0x0c1a tx timeout [ 1432.181958][T24637] Bluetooth: hci4: command 0x0c1a tx timeout [ 1432.248785][T18251] Bluetooth: hci3: command 0x040f tx timeout [ 1432.340248][T28422] netlink: 9 bytes leftover after parsing attributes in process `syz.6.6955'. [ 1432.360018][T14124] usb usb6-port1: attempt power cycle [ 1432.403033][T28423] netlink: 5 bytes leftover after parsing attributes in process `syz.6.6955'. [ 1432.443981][T28410] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1432.450413][T28410] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1432.487864][T28410] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1432.497873][T28410] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1432.512194][T28422] gretap0: entered promiscuous mode [ 1432.556938][T28410] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1432.558792][T28423] 0{X: renamed from gretap0 [ 1432.575430][T28423] 0{X: left promiscuous mode [ 1432.608542][T28423] 0{X: entered allmulticast mode [ 1432.650311][T28423] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 1432.813331][T28427] macsec1: entered promiscuous mode [ 1432.818797][T14124] usb 6-1: new low-speed USB device number 73 using dummy_hcd [ 1432.830078][T28427] erspan0: entered promiscuous mode [ 1432.858991][T28427] erspan0: left promiscuous mode [ 1432.871916][T14124] usb 6-1: device descriptor read/8, error -71 [ 1433.018271][ T24] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 1433.133376][T14124] usb 6-1: new low-speed USB device number 74 using dummy_hcd [ 1433.178248][T14124] usb 6-1: device descriptor read/8, error -71 [ 1433.185214][ T24] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1433.204712][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1433.217187][ T24] usb 5-1: Product: syz [ 1433.221406][ T24] usb 5-1: Manufacturer: syz [ 1433.233145][ T24] usb 5-1: SerialNumber: syz [ 1433.241586][ T24] usb 5-1: config 0 descriptor?? [ 1433.289026][T14124] usb usb6-port1: unable to enumerate USB device [ 1433.494735][ T24] usb 5-1: USB disconnect, device number 126 [ 1433.714739][T28439] xt_bpf: check failed: parse error [ 1433.732880][T28444] 8021q: VLANs not supported on lo [ 1433.991649][T14124] usb 4-1: new full-speed USB device number 104 using dummy_hcd [ 1434.006894][T18251] Bluetooth: hci0: command 0x0406 tx timeout [ 1434.162090][T14124] usb 4-1: config 3 has an invalid interface number: 112 but max is 0 [ 1434.178137][T14124] usb 4-1: config 3 has no interface number 0 [ 1434.184460][T14124] usb 4-1: config 3 interface 112 has no altsetting 0 [ 1434.194831][T14124] usb 4-1: New USB device found, idVendor=07fa, idProduct=0846, bcdDevice=42.d9 [ 1434.222677][T14124] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1434.244528][T14124] usb 4-1: Product: syz [ 1434.255050][T14124] usb 4-1: Manufacturer: syz [ 1434.260131][T14124] usb 4-1: SerialNumber: syz [ 1434.353807][T28454] Cannot find del_set index 0 as target [ 1434.470686][T28456] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6969'. [ 1434.487166][T18251] Bluetooth: hci4: command 0x0c1a tx timeout [ 1434.564292][T14124] HFC-S_USB 4-1:3.112: probe with driver HFC-S_USB failed with error -5 [ 1434.573259][T18251] Bluetooth: hci3: command 0x040f tx timeout [ 1434.579722][T24569] Bluetooth: hci1: command 0x0c1a tx timeout [ 1434.585764][T24637] Bluetooth: hci5: command 0x0c1a tx timeout [ 1434.611444][T28461] bridge_slave_0: left allmulticast mode [ 1434.627794][T14124] usb 4-1: USB disconnect, device number 104 [ 1434.638522][T28461] bridge0: port 1(bridge_slave_0) entered disabled state [ 1434.689238][T28461] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1435.585486][T28466] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1435.591939][T28466] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1435.598620][T28466] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1435.604859][T28466] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1435.611044][T28466] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1435.987280][T14132] usb 5-1: new full-speed USB device number 127 using dummy_hcd [ 1436.510437][T14132] usb 5-1: config 3 has an invalid interface number: 112 but max is 1 [ 1436.528202][T14132] usb 5-1: config 3 has an invalid interface number: 33 but max is 1 [ 1436.552291][T14132] usb 5-1: config 3 has no interface number 0 [ 1436.568997][T14132] usb 5-1: config 3 has no interface number 1 [ 1436.598931][T14132] usb 5-1: config 3 interface 112 altsetting 7 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1436.622886][T14132] usb 5-1: config 3 interface 33 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 1436.635915][T14132] usb 5-1: config 3 interface 112 has no altsetting 0 [ 1436.643343][T14132] usb 5-1: config 3 interface 33 has no altsetting 0 [ 1436.643852][T28492] FAULT_INJECTION: forcing a failure. [ 1436.643852][T28492] name failslab, interval 1, probability 0, space 0, times 0 [ 1436.664136][T28492] CPU: 1 UID: 0 PID: 28492 Comm: syz.5.6981 Tainted: G L syzkaller #0 PREEMPT(full) [ 1436.664169][T28492] Tainted: [L]=SOFTLOCKUP [ 1436.664177][T28492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1436.664195][T28492] Call Trace: [ 1436.664204][T28492] [ 1436.664213][T28492] dump_stack_lvl+0xe8/0x150 [ 1436.664248][T28492] should_fail_ex+0x412/0x560 [ 1436.664276][T28492] should_failslab+0xa8/0x100 [ 1436.664305][T28492] __kmalloc_noprof+0xe8/0x760 [ 1436.664328][T28492] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 1436.664358][T28492] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 1436.664387][T28492] genl_family_rcv_msg_doit+0xd9/0x330 [ 1436.664415][T28492] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1436.664441][T28492] ? __pfx_genl_get_cmd+0x10/0x10 [ 1436.664458][T28492] ? __pfx_tcp_metrics_nl_cmd_get+0x10/0x10 [ 1436.664491][T28492] ? __pfx_tcp_metrics_nl_dump+0x10/0x10 [ 1436.664528][T28492] genl_rcv_msg+0x61c/0x7a0 [ 1436.664557][T28492] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1436.664576][T28492] ? __pfx_tcp_metrics_nl_cmd_get+0x10/0x10 [ 1436.664600][T28492] ? __lock_acquire+0x6b5/0x2cf0 [ 1436.664638][T28492] netlink_rcv_skb+0x232/0x4b0 [ 1436.664665][T28492] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1436.664686][T28492] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1436.664730][T28492] ? down_read+0x272/0x2e0 [ 1436.664747][T28492] ? genl_rcv+0xd/0x40 [ 1436.664769][T28492] genl_rcv+0x28/0x40 [ 1436.664786][T28492] netlink_unicast+0x80f/0x9b0 [ 1436.664819][T28492] ? __pfx_netlink_unicast+0x10/0x10 [ 1436.664845][T28492] ? netlink_sendmsg+0x650/0xb40 [ 1436.664869][T28492] ? skb_put+0x11b/0x210 [ 1436.664902][T28492] netlink_sendmsg+0x813/0xb40 [ 1436.664938][T28492] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1436.664967][T28492] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1436.664988][T28492] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1436.665015][T28492] ____sys_sendmsg+0x972/0x9f0 [ 1436.665054][T28492] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1436.665091][T28492] ? import_iovec+0x73/0xa0 [ 1436.665113][T28492] ___sys_sendmsg+0x2a5/0x360 [ 1436.665141][T28492] ? __pfx____sys_sendmsg+0x10/0x10 [ 1436.665193][T28492] ? __fget_files+0x2a/0x420 [ 1436.665215][T28492] ? __fget_files+0x3a0/0x420 [ 1436.665246][T28492] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1436.665271][T28492] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1436.665302][T28492] ? __pfx_ksys_write+0x10/0x10 [ 1436.665326][T28492] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1436.665343][T28492] do_syscall_64+0x15f/0xf80 [ 1436.665358][T28492] ? trace_irq_disable+0x3b/0x150 [ 1436.665381][T28492] ? clear_bhb_loop+0x40/0x90 [ 1436.665400][T28492] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1436.665415][T28492] RIP: 0033:0x7fc07df9c819 [ 1436.665430][T28492] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1436.665444][T28492] RSP: 002b:00007fc07ee51028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1436.665462][T28492] RAX: ffffffffffffffda RBX: 00007fc07e215fa0 RCX: 00007fc07df9c819 [ 1436.665481][T28492] RDX: 0000000000008410 RSI: 0000200000000000 RDI: 0000000000000004 [ 1436.665491][T28492] RBP: 00007fc07ee51090 R08: 0000000000000000 R09: 0000000000000000 [ 1436.665501][T28492] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1436.665511][T28492] R13: 00007fc07e216038 R14: 00007fc07e215fa0 R15: 00007fc07e33fa48 [ 1436.665537][T28492] [ 1437.017301][T24637] Bluetooth: hci0: command 0x0406 tx timeout [ 1437.077048][T14132] usb 5-1: New USB device found, idVendor=07fa, idProduct=0846, bcdDevice=42.d9 [ 1437.086193][T14132] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1437.094505][T14132] usb 5-1: Product: syz [ 1437.098782][T14132] usb 5-1: Manufacturer: syz [ 1437.103441][T14132] usb 5-1: SerialNumber: syz [ 1437.374938][T28476] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1437.386402][T28476] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1437.407774][T28476] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1437.428622][T25543] netdevsim netdevsim6 netdevsim0: set [1, 1] type 2 family 0 port 20001 - 0 [ 1437.443645][T25543] netdevsim netdevsim6 netdevsim1: set [1, 1] type 2 family 0 port 20001 - 0 [ 1437.498176][T25543] netdevsim netdevsim6 netdevsim2: set [1, 1] type 2 family 0 port 20001 - 0 [ 1437.556914][T25543] netdevsim netdevsim6 netdevsim3: set [1, 1] type 2 family 0 port 20001 - 0 [ 1437.687053][T24637] Bluetooth: hci3: command 0x040f tx timeout [ 1437.693351][T18251] Bluetooth: hci1: command 0x0c1a tx timeout [ 1437.693621][T24569] Bluetooth: hci5: command 0x0c1a tx timeout [ 1437.700175][T18251] Bluetooth: hci4: command 0x0c1a tx timeout [ 1437.837752][T28506] loop8: detected capacity change from 0 to 7 [ 1437.937727][T28506] Dev loop8: unable to read RDB block 7 [ 1437.991411][T14132] HFC-S_USB 5-1:3.112: probe with driver HFC-S_USB failed with error -5 [ 1438.004242][T28506] loop8: unable to read partition table [ 1438.022542][T14132] HFC-S_USB 5-1:3.33: probe with driver HFC-S_USB failed with error -5 [ 1438.051329][T14132] usb 5-1: USB disconnect, device number 127 [ 1438.068520][T28506] loop8: partition table beyond EOD, truncated [ 1438.159184][T28506] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1438.591058][T28519] netlink: 'syz.6.6989': attribute type 21 has an invalid length. [ 1438.616355][T28519] IPv6: NLM_F_CREATE should be specified when creating new route [ 1438.954015][T28512] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1438.960354][T28512] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1438.966738][T28512] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1438.973034][T28512] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1439.007937][T28529] loop9: detected capacity change from 0 to 524287936 [ 1439.056512][T28512] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1439.330405][T28536] netlink: 92 bytes leftover after parsing attributes in process `syz.4.6992'. [ 1440.202250][T28543] hsr0: left promiscuous mode [ 1440.500396][T28562] netlink: 72 bytes leftover after parsing attributes in process `syz.2.7000'. [ 1440.661475][T24637] Bluetooth: hci0: command 0x0406 tx timeout [ 1440.967150][T24637] Bluetooth: hci4: command 0x0c1a tx timeout [ 1440.992842][T25532] netdevsim netdevsim6 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1441.007076][T25532] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1441.018948][T25532] netdevsim netdevsim6 netdevsim0: unset [1, 1] type 2 family 0 port 20001 - 0 [ 1441.029499][T25532] netdevsim netdevsim6 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1441.047114][T24637] Bluetooth: hci1: command 0x0c1a tx timeout [ 1441.053337][T18251] Bluetooth: hci5: command 0x0c1a tx timeout [ 1441.060179][T25532] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1441.075334][T25532] netdevsim netdevsim6 netdevsim1: unset [1, 1] type 2 family 0 port 20001 - 0 [ 1441.103284][T25532] netdevsim netdevsim6 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1441.127228][T24637] Bluetooth: hci3: command 0x040f tx timeout [ 1441.326564][T25532] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1441.335787][T25532] netdevsim netdevsim6 netdevsim2: unset [1, 1] type 2 family 0 port 20001 - 0 [ 1441.350078][T25532] netdevsim netdevsim6 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1441.363495][T25532] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1441.461854][T25532] netdevsim netdevsim6 netdevsim3: unset [1, 1] type 2 family 0 port 20001 - 0 [ 1441.749443][T28576] xt_hashlimit: size too large, truncated to 1048576 [ 1442.045970][T28588] fuse: Bad value for 'fd' [ 1442.062959][T28588] binder: BINDER_SET_CONTEXT_MGR already set [ 1442.069237][T28588] binder: 28584:28588 ioctl 4018620d 200000004a80 returned -16 [ 1443.284618][T28595] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7010'. [ 1443.532993][T28598] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1443.604486][T28600] binder: 28599:28600 ioctl c0306201 2000000003c0 returned -14 [ 1443.620489][T28600] FAULT_INJECTION: forcing a failure. [ 1443.620489][T28600] name failslab, interval 1, probability 0, space 0, times 0 [ 1443.635625][T28600] CPU: 1 UID: 0 PID: 28600 Comm: syz.2.7012 Tainted: G L syzkaller #0 PREEMPT(full) [ 1443.635651][T28600] Tainted: [L]=SOFTLOCKUP [ 1443.635656][T28600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1443.635666][T28600] Call Trace: [ 1443.635671][T28600] [ 1443.635677][T28600] dump_stack_lvl+0xe8/0x150 [ 1443.635699][T28600] should_fail_ex+0x412/0x560 [ 1443.635714][T28600] ? alloc_inode+0xb8/0x1b0 [ 1443.635730][T28600] should_failslab+0xa8/0x100 [ 1443.635746][T28600] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 1443.635764][T28600] alloc_inode+0xb8/0x1b0 [ 1443.635780][T28600] new_inode+0x22/0x170 [ 1443.635800][T28600] ramfs_get_inode+0x27/0x2c0 [ 1443.635815][T28600] ramfs_mknod+0x50/0x110 [ 1443.635829][T28600] vfs_mknod+0x447/0x610 [ 1443.635848][T28600] unix_bind+0x548/0x1230 [ 1443.635866][T28600] ? tomoyo_socket_bind_permission+0x1ae/0x290 [ 1443.635881][T28600] ? __pfx_unix_bind+0x10/0x10 [ 1443.635896][T28600] ? bpf_lsm_socket_bind+0x9/0x20 [ 1443.635911][T28600] __sys_bind+0x2e3/0x410 [ 1443.635928][T28600] ? __pfx___sys_bind+0x10/0x10 [ 1443.635949][T28600] ? __pfx_ksys_write+0x10/0x10 [ 1443.635965][T28600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1443.635978][T28600] __x64_sys_bind+0x7a/0x90 [ 1443.635993][T28600] do_syscall_64+0x15f/0xf80 [ 1443.636005][T28600] ? trace_irq_disable+0x3b/0x150 [ 1443.636023][T28600] ? clear_bhb_loop+0x40/0x90 [ 1443.636037][T28600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1443.636049][T28600] RIP: 0033:0x7f99e979c819 [ 1443.636062][T28600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1443.636072][T28600] RSP: 002b:00007f99ea5e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 1443.636086][T28600] RAX: ffffffffffffffda RBX: 00007f99e9a15fa0 RCX: 00007f99e979c819 [ 1443.636095][T28600] RDX: 000000000000006e RSI: 0000200000000180 RDI: 000000000000000b [ 1443.636102][T28600] RBP: 00007f99ea5e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1443.636109][T28600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1443.636117][T28600] R13: 00007f99e9a16038 R14: 00007f99e9a15fa0 R15: 00007f99e9b3fa48 [ 1443.636135][T28600] [ 1443.636846][T25915] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 1444.045138][T28610] syzkaller0: entered promiscuous mode [ 1444.054786][T28610] syzkaller0: entered allmulticast mode [ 1444.100054][T28610] tipc: Enabled bearer , priority 0 [ 1444.111973][T25915] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1444.123087][T28609] tipc: Resetting bearer [ 1444.129036][T25915] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1444.140887][T25915] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1444.160150][T25915] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1444.175206][T28609] tipc: Disabling bearer [ 1444.192051][T14122] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 1444.203245][T25915] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1444.212523][T25915] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1444.220915][T25915] usb 6-1: Product: syz [ 1444.225078][T25915] usb 6-1: Manufacturer: syz [ 1444.238926][T25915] cdc_wdm 6-1:1.0: skipping garbage [ 1444.256837][T25915] cdc_wdm 6-1:1.0: skipping garbage [ 1444.262685][T25915] cdc_wdm 6-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1444.348935][T14122] usb 5-1: config index 0 descriptor too short (expected 39, got 27) [ 1444.357298][T14122] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1444.377026][T14122] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1444.567112][T14122] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1444.576511][T14122] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1444.593427][T14122] usb 5-1: Product: syz [ 1444.634550][T14122] usb 5-1: Manufacturer: syz [ 1444.692290][T14122] usb 5-1: SerialNumber: syz [ 1444.702169][T14122] usb 5-1: config 0 descriptor?? [ 1444.757712][T14122] hub 5-1:0.0: bad descriptor, ignoring hub [ 1444.763855][T14122] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1444.766935][T14127] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1444.776233][T14122] usb 5-1: selecting invalid altsetting 0 [ 1444.917569][T14127] usb 4-1: device descriptor read/64, error -71 [ 1445.177061][T14127] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1445.596879][T14127] usb 4-1: device descriptor read/64, error -71 [ 1445.708287][T14127] usb usb4-port1: attempt power cycle [ 1445.787921][T28607] usb 5-1: reset high-speed USB device number 2 using dummy_hcd [ 1445.804581][T14122] usb 6-1: USB disconnect, device number 75 [ 1445.966877][T28607] usb 5-1: device firmware changed [ 1445.981883][T14132] usb 5-1: USB disconnect, device number 2 [ 1446.104391][T14127] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 1446.137263][T14127] usb 4-1: device descriptor read/8, error -71 [ 1446.366941][T14132] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1446.417078][T14127] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 1446.438345][T14127] usb 4-1: device descriptor read/8, error -71 [ 1446.530057][T14132] usb 5-1: config index 0 descriptor too short (expected 39, got 27) [ 1446.570348][T14127] usb usb4-port1: unable to enumerate USB device [ 1446.579616][T14132] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1446.711389][T14132] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1446.782476][T14132] usb 5-1: string descriptor 0 read error: -22 [ 1446.805759][T14132] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1446.825308][T14132] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1446.841709][T14132] usb 5-1: config 0 descriptor?? [ 1446.872258][T14132] hub 5-1:0.0: bad descriptor, ignoring hub [ 1446.893884][T14132] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1446.917800][T14132] usb 5-1: selecting invalid altsetting 0 [ 1447.070219][T14132] usb 5-1: USB disconnect, device number 3 [ 1447.468310][ T30] audit: type=1326 audit(1776198252.008:3258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1447.538216][ T30] audit: type=1326 audit(1776198252.008:3259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1447.631140][ T30] audit: type=1326 audit(1776198252.008:3260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1447.732701][ T30] audit: type=1326 audit(1776198252.008:3261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1447.758690][ T30] audit: type=1326 audit(1776198252.008:3262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1447.799391][T28650] --map-set only usable from mangle table [ 1447.901574][ T30] audit: type=1326 audit(1776198252.008:3263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1447.963665][T28652] netlink: 48 bytes leftover after parsing attributes in process `syz.5.7029'. [ 1448.058352][ T30] audit: type=1326 audit(1776198252.008:3264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1448.281508][T28657] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7030'. [ 1448.315233][ T30] audit: type=1326 audit(1776198252.008:3265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1448.387278][ T30] audit: type=1326 audit(1776198252.008:3266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1448.387313][ T30] audit: type=1326 audit(1776198252.008:3267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28639 comm="syz.4.7025" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd74499c819 code=0x7ffc0000 [ 1448.610253][T28663] netlink: 'syz.3.7032': attribute type 61 has an invalid length. [ 1451.645657][T28705] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7046'. [ 1451.677448][T28705] netlink: 'syz.6.7046': attribute type 10 has an invalid length. [ 1451.687058][T28705] netlink: 40 bytes leftover after parsing attributes in process `syz.6.7046'. [ 1451.734700][T28705] team0: entered allmulticast mode [ 1451.769167][T28705] 8021q: adding VLAN 0 to HW filter on device team0 [ 1451.788056][T28705] bridge0: port 1(team0) entered blocking state [ 1451.794531][T28705] bridge0: port 1(team0) entered disabled state [ 1451.819831][T28711] netlink: 80 bytes leftover after parsing attributes in process `syz.5.7048'. [ 1452.339983][T14130] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1452.566961][T14130] usb 6-1: Using ep0 maxpacket: 8 [ 1452.623633][T14130] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1452.638074][T14130] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1452.689207][T14130] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1452.705666][T14130] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1452.736926][T14130] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1452.770104][T14130] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1453.167482][T28724] loop9: detected capacity change from 0 to 524287936 [ 1453.381130][T14130] usb 6-1: GET_CAPABILITIES returned 0 [ 1453.388257][T14130] usbtmc 6-1:16.0: can't read capabilities [ 1453.438573][T14122] usb 6-1: USB disconnect, device number 76 [ 1453.481050][T28733] binder: 28732:28733 ioctl c0306201 2000000003c0 returned -14 [ 1453.515077][T28733] FAULT_INJECTION: forcing a failure. [ 1453.515077][T28733] name failslab, interval 1, probability 0, space 0, times 0 [ 1453.544157][T28733] CPU: 1 UID: 0 PID: 28733 Comm: syz.3.7056 Tainted: G L syzkaller #0 PREEMPT(full) [ 1453.544191][T28733] Tainted: [L]=SOFTLOCKUP [ 1453.544198][T28733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1453.544210][T28733] Call Trace: [ 1453.544219][T28733] [ 1453.544228][T28733] dump_stack_lvl+0xe8/0x150 [ 1453.544263][T28733] should_fail_ex+0x412/0x560 [ 1453.544291][T28733] should_failslab+0xa8/0x100 [ 1453.544318][T28733] ? security_inode_alloc+0x39/0x310 [ 1453.544338][T28733] kmem_cache_alloc_noprof+0x87/0x650 [ 1453.544369][T28733] security_inode_alloc+0x39/0x310 [ 1453.544393][T28733] inode_init_always_gfp+0x9c8/0xda0 [ 1453.544432][T28733] alloc_inode+0x82/0x1b0 [ 1453.544461][T28733] new_inode+0x22/0x170 [ 1453.544496][T28733] ramfs_get_inode+0x27/0x2c0 [ 1453.544523][T28733] ramfs_mknod+0x50/0x110 [ 1453.544549][T28733] vfs_mknod+0x447/0x610 [ 1453.544581][T28733] unix_bind+0x548/0x1230 [ 1453.544625][T28733] ? tomoyo_socket_bind_permission+0x1ae/0x290 [ 1453.544649][T28733] ? __pfx_unix_bind+0x10/0x10 [ 1453.544676][T28733] ? bpf_lsm_socket_bind+0x9/0x20 [ 1453.544704][T28733] __sys_bind+0x2e3/0x410 [ 1453.544733][T28733] ? __pfx___sys_bind+0x10/0x10 [ 1453.544773][T28733] ? __pfx_ksys_write+0x10/0x10 [ 1453.544801][T28733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1453.544824][T28733] __x64_sys_bind+0x7a/0x90 [ 1453.544852][T28733] do_syscall_64+0x15f/0xf80 [ 1453.544872][T28733] ? trace_irq_disable+0x3b/0x150 [ 1453.544902][T28733] ? clear_bhb_loop+0x40/0x90 [ 1453.544926][T28733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1453.544946][T28733] RIP: 0033:0x7facc0d9c819 [ 1453.544966][T28733] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1453.544982][T28733] RSP: 002b:00007facc1bc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 1453.545005][T28733] RAX: ffffffffffffffda RBX: 00007facc1015fa0 RCX: 00007facc0d9c819 [ 1453.545019][T28733] RDX: 000000000000006e RSI: 0000200000000180 RDI: 000000000000000b [ 1453.545032][T28733] RBP: 00007facc1bc4090 R08: 0000000000000000 R09: 0000000000000000 [ 1453.545044][T28733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1453.545056][T28733] R13: 00007facc1016038 R14: 00007facc1015fa0 R15: 00007facc113fa48 [ 1453.545090][T28733] [ 1453.969627][T28750] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7062'. [ 1454.153098][T28759] netlink: 'syz.2.7061': attribute type 23 has an invalid length. [ 1454.839401][T28775] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 1455.196447][T28783] netlink: 48 bytes leftover after parsing attributes in process `syz.4.7074'. [ 1455.302875][T28793] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1455.349172][T28793] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1455.419993][T28796] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7079'. [ 1455.547132][T14122] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1455.702373][T28800] loop6: detected capacity change from 0 to 7 [ 1455.739719][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.749015][ C1] buffer_io_error: 10 callbacks suppressed [ 1455.749034][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1455.765835][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.775103][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1455.779459][T14122] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1455.807701][T14122] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.818205][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.827440][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1455.844016][T14122] usb 5-1: Product: syz [ 1455.853374][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.862651][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1455.864939][T14122] usb 5-1: Manufacturer: syz [ 1455.876358][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.885657][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1455.886983][T14122] usb 5-1: SerialNumber: syz [ 1455.898885][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.908265][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1455.926367][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.935924][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1455.958190][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.967479][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1455.975371][T28800] ldm_validate_partition_table(): Disk read failed. [ 1455.982907][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1455.992195][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 1456.001153][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1456.010408][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 1456.021133][T28800] Dev loop6: unable to read RDB block 0 [ 1456.027738][T28800] loop6: unable to read partition table [ 1456.033777][T28800] loop6: partition table beyond EOD, truncated [ 1456.052198][T28800] loop_reread_partitions: partition scan of loop6 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 1456.336904][T14122] cdc_ncm 5-1:1.0: bind() failure [ 1456.356670][T14122] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 1456.378548][T14122] cdc_ncm 5-1:1.1: bind() failure [ 1456.449288][T14122] usb 5-1: USB disconnect, device number 4 [ 1456.602426][T28812] @: renamed from bond_slave_0 (while UP) [ 1458.389341][T28824] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 1459.152479][T28842] --map-set only usable from mangle table [ 1459.297957][T28844] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7094'. [ 1459.573367][T28844] ipvlan2: entered allmulticast mode [ 1459.603255][T28844] dummy0: entered allmulticast mode [ 1459.930869][T28852] bridge0: entered promiscuous mode [ 1459.957957][T28852] bridge0: entered allmulticast mode [ 1459.986332][T28859] SET target dimension over the limit! [ 1460.338492][T28868] loop8: detected capacity change from 0 to 7 [ 1460.364204][T28868] Dev loop8: unable to read RDB block 7 [ 1460.382996][T28868] loop8: unable to read partition table [ 1460.394517][T28868] loop8: partition table beyond EOD, truncated [ 1460.401046][T28868] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1460.596956][T14122] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 1460.723008][T28871] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7101'. [ 1460.787896][T14122] usb 5-1: not running at top speed; connect to a high speed hub [ 1460.797909][T14122] usb 5-1: config 1 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 55887, setting to 64 [ 1460.817017][T14122] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1460.845827][T14122] usb 5-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 1460.872007][T14122] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1460.900657][T14122] usb 5-1: Product: syz [ 1460.913206][T14122] usb 5-1: Manufacturer: syz [ 1460.933287][T14122] usb 5-1: SerialNumber: syz [ 1460.950991][T28861] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1461.011671][T28877] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7104'. [ 1461.027022][T28875] input: syz0 as /devices/virtual/input/input113 [ 1461.137085][T14130] usb 6-1: new full-speed USB device number 77 using dummy_hcd [ 1461.438972][T14130] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 33437, setting to 64 [ 1461.489092][T14130] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1461.531140][T14130] usb 6-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 1461.541880][T14130] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1461.586709][T14130] usb 6-1: Product: syz [ 1461.616634][T14130] usb 6-1: Manufacturer: syz [ 1461.637973][T28882] loop2: detected capacity change from 0 to 7 [ 1461.648907][T14130] usb 6-1: SerialNumber: syz [ 1461.665762][T28882] loop2: [ 1461.677960][T28882] loop2: partition table partially beyond EOD, truncated [ 1461.685246][T14130] usb 6-1: config 0 descriptor?? [ 1461.686015][T28874] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1461.767945][T14130] port100 6-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 1461.936047][T28874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1461.965660][T28874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1462.006710][T28874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1462.045724][T28874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1462.069766][T28874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1462.113772][T28874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1462.133327][T28874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1462.159347][T28874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1462.189054][T28874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1462.325281][T28874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1462.405064][T14124] usb 6-1: USB disconnect, device number 77 [ 1462.686904][T14132] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 1462.843062][T14132] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1462.879499][T14132] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 1463.000648][T28911] tipc: Failed to remove unknown binding: 66,1,1/0:1338464616/1338464618 [ 1463.191651][T14122] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input114 [ 1463.224350][T14132] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 1463.244376][T14132] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1463.269867][T14132] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1463.332632][ T5179] bcm5974 5-1:1.0: could not read from device [ 1463.395450][ T5179] bcm5974 5-1:1.0: could not read from device [ 1463.428448][T14122] usb 5-1: USB disconnect, device number 5 [ 1463.440731][T14132] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1463.456132][ T5179] bcm5974 5-1:1.0: could not read from device [ 1463.831920][T28921] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7119'. [ 1464.537226][T28925] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1464.543662][T28925] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1464.735686][T28925] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1464.941646][T28925] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1464.957946][T28925] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1465.191776][T14132] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 1465.466556][T25915] usb 4-1: USB disconnect, device number 109 [ 1465.670145][T28934] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7121'. [ 1465.744332][T28937] hsr0: entered promiscuous mode [ 1465.786370][T28937] hsr0: left promiscuous mode [ 1465.927204][T28939] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7123'. [ 1465.970690][T28939] ------------[ cut here ]------------ [ 1465.976194][T28939] memcpy: detected field-spanning write (size 32) of single field "&new->sel" at net/sched/cls_u32.c:855 (size 16) [ 1465.988749][T28939] WARNING: net/sched/cls_u32.c:855 at u32_change+0x1da0/0x2720, CPU#1: syz.4.7123/28939 [ 1465.998820][T28939] Modules linked in: [ 1466.003100][T28939] CPU: 1 UID: 0 PID: 28939 Comm: syz.4.7123 Tainted: G L syzkaller #0 PREEMPT(full) [ 1466.014103][T28939] Tainted: [L]=SOFTLOCKUP [ 1466.018484][T28939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1466.028668][T28939] RIP: 0010:u32_change+0x1daf/0x2720 [ 1466.033985][T28939] Code: 3d e0 dd 41 06 01 75 33 e8 4e 9d 0b f8 eb 50 e8 47 9d 0b f8 48 8d 3d e0 16 67 06 b9 10 00 00 00 4c 89 f6 48 c7 c2 40 e7 e1 8c <67> 48 0f b9 3a e9 af ee ff ff e8 22 9d 0b f8 eb 24 e8 1b 9d 0b f8 [ 1466.053884][T28939] RSP: 0018:ffffc90005b96fc0 EFLAGS: 00010283 [ 1466.060201][T28939] RAX: ffffffff89b9fa89 RBX: ffff8880589fe800 RCX: 0000000000000010 [ 1466.068590][T28939] RDX: ffffffff8ce1e740 RSI: 0000000000000020 RDI: ffffffff90211170 [ 1466.077048][T28939] RBP: ffffc90005b97178 R08: 0000000000000dc0 R09: 00000000ffffffff [ 1466.085225][T28939] R10: dffffc0000000000 R11: fffffbfff2023f57 R12: ffff888011a610e8 [ 1466.094053][T28939] R13: 0000000000000001 R14: 0000000000000020 R15: 0000000000000001 [ 1466.102678][T28939] FS: 00007fd7459096c0(0000) GS:ffff88812554b000(0000) knlGS:0000000000000000 [ 1466.111988][T28939] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1466.118655][T28939] CR2: 0000001b31f20000 CR3: 0000000058458000 CR4: 00000000003526f0 [ 1466.126648][T28939] Call Trace: [ 1466.130011][T28939] [ 1466.132979][T28939] ? __pfx_u32_change+0x10/0x10 [ 1466.137919][T28939] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1466.143605][T28939] tc_new_tfilter+0xff8/0x1780 [ 1466.148517][T28939] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1466.153771][T28939] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1466.159222][T28939] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1466.164211][T28939] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1466.169846][T28939] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1466.175353][T28939] ? ref_tracker_free+0x693/0x840 [ 1466.180571][T28939] ? __copy_skb_header+0xa3/0x4a0 [ 1466.185710][T28939] ? __pfx_ref_tracker_free+0x10/0x10 [ 1466.191663][T28939] ? __skb_clone+0x63/0x7a0 [ 1466.196385][T28939] netlink_rcv_skb+0x232/0x4b0 [ 1466.201529][T28939] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1466.207343][T28939] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1466.212635][T28939] ? netlink_deliver_tap+0x2e/0x1b0 [ 1466.217878][T28939] netlink_unicast+0x80f/0x9b0 [ 1466.222645][T28939] ? __pfx_netlink_unicast+0x10/0x10 [ 1466.227994][T28939] ? netlink_sendmsg+0x650/0xb40 [ 1466.232990][T28939] ? skb_put+0x11b/0x210 [ 1466.237508][T28939] netlink_sendmsg+0x813/0xb40 [ 1466.242307][T28939] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1466.247677][T28939] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1466.252616][T28939] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1466.258065][T28939] ____sys_sendmsg+0x972/0x9f0 [ 1466.262841][T28939] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1466.268298][T28939] ? import_iovec+0x73/0xa0 [ 1466.272910][T28939] ___sys_sendmsg+0x2a5/0x360 [ 1466.277614][T28939] ? __pfx____sys_sendmsg+0x10/0x10 [ 1466.282870][T28939] ? __pfx_futex_wake_mark+0x10/0x10 [ 1466.288318][T28939] ? __fget_files+0x2a/0x420 [ 1466.293357][T28939] ? __fget_files+0x3a0/0x420 [ 1466.298458][T28939] __sys_sendmmsg+0x27c/0x4e0 [ 1466.303160][T28939] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1466.308440][T28939] ? do_futex+0x333/0x420 [ 1466.312810][T28939] ? __pfx___se_sys_futex+0x10/0x10 [ 1466.318224][T28939] ? fd_install+0x306/0x3d0 [ 1466.322776][T28939] __x64_sys_sendmmsg+0xa0/0xc0 [ 1466.327725][T28939] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1466.333833][T28939] do_syscall_64+0x15f/0xf80 [ 1466.338562][T28939] ? trace_irq_disable+0x3b/0x150 [ 1466.343596][T28939] ? clear_bhb_loop+0x40/0x90 [ 1466.348353][T28939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1466.354271][T28939] RIP: 0033:0x7fd74499c819 [ 1466.358720][T28939] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1466.378387][T28939] RSP: 002b:00007fd745909028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1466.386886][T28939] RAX: ffffffffffffffda RBX: 00007fd744c15fa0 RCX: 00007fd74499c819 [ 1466.395316][T28939] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000007 [ 1466.404284][T28939] RBP: 00007fd744a32c91 R08: 0000000000000000 R09: 0000000000000000 [ 1466.412795][T28939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1466.420880][T28939] R13: 00007fd744c16038 R14: 00007fd744c15fa0 R15: 00007fd744d3fa48 [ 1466.428965][T28939] [ 1466.432137][T28939] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1466.439451][T28939] CPU: 1 UID: 0 PID: 28939 Comm: syz.4.7123 Tainted: G L syzkaller #0 PREEMPT(full) [ 1466.450401][T28939] Tainted: [L]=SOFTLOCKUP [ 1466.454746][T28939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1466.464831][T28939] Call Trace: [ 1466.468122][T28939] [ 1466.471058][T28939] vpanic+0x56c/0xa60 [ 1466.475076][T28939] ? __pfx__printk+0x10/0x10 [ 1466.479673][T28939] ? __pfx_vpanic+0x10/0x10 [ 1466.484195][T28939] ? is_bpf_text_address+0x292/0x2b0 [ 1466.489490][T28939] ? is_bpf_text_address+0x26/0x2b0 [ 1466.494693][T28939] panic+0xc5/0xd0 [ 1466.498419][T28939] ? __pfx_panic+0x10/0x10 [ 1466.502847][T28939] __warn+0x315/0x4f0 [ 1466.506829][T28939] ? u32_change+0x1da0/0x2720 [ 1466.511508][T28939] ? u32_change+0x1da0/0x2720 [ 1466.516289][T28939] __report_bug+0x29a/0x540 [ 1466.520808][T28939] ? ___sys_sendmsg+0x2a5/0x360 [ 1466.525657][T28939] ? __sys_sendmmsg+0x27c/0x4e0 [ 1466.530497][T28939] ? __x64_sys_sendmmsg+0xa0/0xc0 [ 1466.535523][T28939] ? u32_change+0x1da0/0x2720 [ 1466.540197][T28939] ? __pfx___report_bug+0x10/0x10 [ 1466.545250][T28939] report_bug_entry+0x19a/0x290 [ 1466.550138][T28939] ? u32_change+0x1daf/0x2720 [ 1466.554822][T28939] ? u32_change+0x1db4/0x2720 [ 1466.559577][T28939] handle_bug+0xce/0x200 [ 1466.563844][T28939] exc_invalid_op+0x1a/0x50 [ 1466.568361][T28939] asm_exc_invalid_op+0x1a/0x20 [ 1466.573224][T28939] RIP: 0010:u32_change+0x1daf/0x2720 [ 1466.578566][T28939] Code: 3d e0 dd 41 06 01 75 33 e8 4e 9d 0b f8 eb 50 e8 47 9d 0b f8 48 8d 3d e0 16 67 06 b9 10 00 00 00 4c 89 f6 48 c7 c2 40 e7 e1 8c <67> 48 0f b9 3a e9 af ee ff ff e8 22 9d 0b f8 eb 24 e8 1b 9d 0b f8 [ 1466.598289][T28939] RSP: 0018:ffffc90005b96fc0 EFLAGS: 00010283 [ 1466.604389][T28939] RAX: ffffffff89b9fa89 RBX: ffff8880589fe800 RCX: 0000000000000010 [ 1466.612400][T28939] RDX: ffffffff8ce1e740 RSI: 0000000000000020 RDI: ffffffff90211170 [ 1466.620391][T28939] RBP: ffffc90005b97178 R08: 0000000000000dc0 R09: 00000000ffffffff [ 1466.628376][T28939] R10: dffffc0000000000 R11: fffffbfff2023f57 R12: ffff888011a610e8 [ 1466.636371][T28939] R13: 0000000000000001 R14: 0000000000000020 R15: 0000000000000001 [ 1466.644457][T28939] ? u32_change+0x1d99/0x2720 [ 1466.649168][T28939] ? __pfx_u32_change+0x10/0x10 [ 1466.654135][T28939] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1466.659870][T28939] tc_new_tfilter+0xff8/0x1780 [ 1466.664660][T28939] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1466.669899][T28939] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1466.675121][T28939] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1466.680094][T28939] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1466.685255][T28939] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1466.690747][T28939] ? ref_tracker_free+0x693/0x840 [ 1466.695798][T28939] ? __copy_skb_header+0xa3/0x4a0 [ 1466.700824][T28939] ? __pfx_ref_tracker_free+0x10/0x10 [ 1466.706199][T28939] ? __skb_clone+0x63/0x7a0 [ 1466.710738][T28939] netlink_rcv_skb+0x232/0x4b0 [ 1466.715504][T28939] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1466.720979][T28939] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1466.726277][T28939] ? netlink_deliver_tap+0x2e/0x1b0 [ 1466.731482][T28939] netlink_unicast+0x80f/0x9b0 [ 1466.736244][T28939] ? __pfx_netlink_unicast+0x10/0x10 [ 1466.741526][T28939] ? netlink_sendmsg+0x650/0xb40 [ 1466.746484][T28939] ? skb_put+0x11b/0x210 [ 1466.750750][T28939] netlink_sendmsg+0x813/0xb40 [ 1466.755543][T28939] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1466.760855][T28939] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1466.765801][T28939] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1466.771179][T28939] ____sys_sendmsg+0x972/0x9f0 [ 1466.775992][T28939] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1466.781306][T28939] ? import_iovec+0x73/0xa0 [ 1466.785833][T28939] ___sys_sendmsg+0x2a5/0x360 [ 1466.790547][T28939] ? __pfx____sys_sendmsg+0x10/0x10 [ 1466.795763][T28939] ? __pfx_futex_wake_mark+0x10/0x10 [ 1466.801087][T28939] ? __fget_files+0x2a/0x420 [ 1466.805714][T28939] ? __fget_files+0x3a0/0x420 [ 1466.810437][T28939] __sys_sendmmsg+0x27c/0x4e0 [ 1466.815135][T28939] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1466.820385][T28939] ? do_futex+0x333/0x420 [ 1466.824750][T28939] ? __pfx___se_sys_futex+0x10/0x10 [ 1466.829948][T28939] ? fd_install+0x306/0x3d0 [ 1466.834461][T28939] __x64_sys_sendmmsg+0xa0/0xc0 [ 1466.839339][T28939] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1466.845522][T28939] do_syscall_64+0x15f/0xf80 [ 1466.850122][T28939] ? trace_irq_disable+0x3b/0x150 [ 1466.855158][T28939] ? clear_bhb_loop+0x40/0x90 [ 1466.859844][T28939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1466.865850][T28939] RIP: 0033:0x7fd74499c819 [ 1466.870275][T28939] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1466.889892][T28939] RSP: 002b:00007fd745909028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1466.898319][T28939] RAX: ffffffffffffffda RBX: 00007fd744c15fa0 RCX: 00007fd74499c819 [ 1466.906323][T28939] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000007 [ 1466.914329][T28939] RBP: 00007fd744a32c91 R08: 0000000000000000 R09: 0000000000000000 [ 1466.922349][T28939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1466.930322][T28939] R13: 00007fd744c16038 R14: 00007fd744c15fa0 R15: 00007fd744d3fa48 [ 1466.938306][T28939] [ 1466.941807][T28939] Kernel Offset: disabled [ 1466.946237][T28939] Rebooting in 86400 seconds..