last executing test programs: 13m30.944205255s ago: executing program 2 (id=3057): syz_usb_connect(0x0, 0x24, 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r2, 0x0, 0x0) (async) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, 0x0) (async, rerun: 32) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async, rerun: 32) syz_open_dev$dri(0x0, 0x1ff, 0x0) (async, rerun: 32) unshare(0x2c020400) (async, rerun: 32) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) (async) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r3 = openat$dsp(0xffffff9c, &(0x7f0000000080), 0x82040, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(r3, 0xc0044dff, &(0x7f0000000100)=0x9) (async) unshare(0x6020480) (async) timer_settime(0x0, 0x5, 0x0, 0x0) (async) read$snddsp(0xffffffffffffffff, 0x0, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) (async, rerun: 64) ioperm(0x40, 0x9, 0x81) (rerun: 64) syz_usb_connect(0x6, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="4f05e8150e2d9887dcfc9356a1b55fe80cc66d2abe89512007b697cee7e839dcdd8d9b5c525f12172a7be7076c2719ce0707a008f8774d3bb594d06e24c2fba5ffd9f62944694a8974712036b0f242d2226a58dc3446f3d09944c3a9506aa6a3d4bf926bb2ad6ca9eb9bf8163d4316f0ea29320fc49ed9aa45fab0b6f57ce3f2d47cb6180efb7b17810f8b1bae1500284ca297"], 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x33) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f00000001c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 13m29.799558621s ago: executing program 2 (id=3061): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x83, 0x0, 0x0) 13m29.588353124s ago: executing program 2 (id=3063): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x103381) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$sock_bt_hci(r2, 0x400448e1, &(0x7f0000000000)="afab90b125a508a4e25afb80651ec756a382c12bd995f48196de54049578603591a3533e15ce6f3f1fe9597bce42b57de096223b9d3490585bb289abdc04d4659625143283f1b5afc6fe07de5523c8e55f09b691f2953da8bc16d2b3d9c955475cf70e7ff6d38958c39af955cf0b1a2eefc59631ccbef3") getsockopt$inet6_tcp_int(r2, 0x6, 0x1e, 0x0, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00']) 13m29.257634251s ago: executing program 2 (id=3065): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000180)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000000)="38000300010003", 0x7) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, &(0x7f0000000200)={0x0, 0xfffffa45, 0x1, 0x863e, 0x8, 0xebc, 0x2}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a1", 0xa}], 0x1}, 0x0) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0xd) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0x1}) io_uring_enter(0xffffffffffffffff, 0x62a, 0x4be, 0x56, 0x0, 0x0) r5 = syz_open_dev$evdev(0x0, 0x0, 0x0) syz_usb_disconnect(r5) keyctl$update(0x2, 0x0, &(0x7f0000001080)="e1", 0x1) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) ioctl$EVIOCRMFF(r5, 0x4004550d, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) io_uring_register$IORING_REGISTER_FILES2(0xffffffffffffffff, 0xd, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x4002) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) open(&(0x7f0000000300)='.\x00', 0x0, 0x0) 13m28.104591696s ago: executing program 2 (id=3071): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) dup(r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0xd357, 0x10, 0x6, 0x210}, &(0x7f0000000100)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x20000800}, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r7 = syz_open_dev$media(&(0x7f0000000140), 0x200, 0x2) ioctl$MEDIA_IOC_REQUEST_ALLOC(r7, 0x80047c05, &(0x7f0000000040)=0xffffffffffffffff) r9 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) read$FUSE(r6, &(0x7f0000006100)={0x2020, 0x0, 0x0, 0x0}, 0x2020) quotactl_fd$Q_GETINFO(r9, 0xffffffff80000500, r10, &(0x7f0000000380)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r8, 0x7c81, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r11, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r11, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x24, 0x2007, @fd_index=0x4, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) io_uring_enter(r3, 0x47ba, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r3, 0x18, &(0x7f0000000280)={0x0, r11, 0xd, {0x7, 0x9}, 0x2}, 0x1) mount$9p_rdma(&(0x7f0000000180), &(0x7f0000001400)='.\x00', &(0x7f0000001440), 0x1008840, &(0x7f0000000840)={'trans=rdma,', {'port', 0x3d, 0x4e24}, 0x2c, {[{@timeout}]}}) 13m25.471732428s ago: executing program 2 (id=3076): r0 = socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) getsockname$qrtr(r0, &(0x7f00000001c0), &(0x7f0000000240)=0xc) close_range(r0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000600), 0x14, 0x40080) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205647, &(0x7f0000000000)={0x980000, 0x0, 0x81, 0xffffffffffffffff, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x4, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_u}]}}) write$P9_RVERSION(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="150000006bffff"], 0x15) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x103381) ioctl$USBDEVFS_FREE_STREAMS(r5, 0x8008551d, &(0x7f0000000100)={0x7f1, 0x1, [{0x1, 0x1}]}) 13m8.962668356s ago: executing program 32 (id=3076): r0 = socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) getsockname$qrtr(r0, &(0x7f00000001c0), &(0x7f0000000240)=0xc) close_range(r0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000600), 0x14, 0x40080) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205647, &(0x7f0000000000)={0x980000, 0x0, 0x81, 0xffffffffffffffff, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x4, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_u}]}}) write$P9_RVERSION(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="150000006bffff"], 0x15) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x103381) ioctl$USBDEVFS_FREE_STREAMS(r5, 0x8008551d, &(0x7f0000000100)={0x7f1, 0x1, [{0x1, 0x1}]}) 1m12.748295249s ago: executing program 3 (id=5543): syz_open_procfs$namespace(0x0, &(0x7f0000000740)='ns/ipc\x00') socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r4, 0x9c3fa077fa966179, 0x12, 0x0, {{0x7e}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000072000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000000"], 0x0}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x11, 0x4, 0x4, 0xa}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1830000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fanotify_init(0x4, 0x40000) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x10) 1m10.764165912s ago: executing program 3 (id=5550): syz_io_uring_setup(0x669d, &(0x7f0000000440)={0x0, 0x41f7, 0x4000, 0xfffffffe, 0x213}, &(0x7f0000000040)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, 0x0, 0x0, 0x4) syz_open_dev$vbi(0x0, 0x1, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x1, 0x0) r1 = syz_usb_connect(0x0, 0x5a, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000060f94d100d05020027230102030109024840020000000009047d04031d5abf0009050400005539000009050b00000000000009050200000005000009047d01013481af0009a00e00230000690009047dbe"], 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x81) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xb3}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000ffffff00b00000370757a800"/28], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000340)="88de125c", &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r2, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) ioctl$AUTOFS_IOC_ASKUMOUNT(0xffffffffffffffff, 0x80049370, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x2002, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x88400) r5 = syz_open_dev$dri(&(0x7f0000000540), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x2, 0x5, 0x3}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000240)={0x7, 0x1fd, 0x101c3c}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000280)={r6}) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x91) r7 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000000)={0x8, 0x2, 0x7}) 1m7.347830366s ago: executing program 3 (id=5562): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x24, 0x12, 0xa01, 0x0, 0x0, {0xa}, [@typed={0x8, 0x0, 0x0, 0x0, @ipv4=@dev}, @typed={0x8, 0x0, 0x0, 0x0, @ipv4}]}, 0x24}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x4e24, 0x4, @dev={0xfe, 0x80, '\x00', 0x14}, 0x3}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000180)={r2, 0x3, 0x1, "1a"}, 0x9) socket$inet6_sctp(0xa, 0x5, 0x84) (async) shutdown(r0, 0x0) (async) socket(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x24, 0x12, 0xa01, 0x0, 0x0, {0xa}, [@typed={0x8, 0x0, 0x0, 0x0, @ipv4=@dev}, @typed={0x8, 0x0, 0x0, 0x0, @ipv4}]}, 0x24}}, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x4e24, 0x4, @dev={0xfe, 0x80, '\x00', 0x14}, 0x3}]}, &(0x7f0000000440)=0x10) (async) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000180)={r2, 0x3, 0x1, "1a"}, 0x9) (async) 1m7.200112035s ago: executing program 3 (id=5566): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0xff05, 0x2000000, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0x0, 0x8110}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_BRIDGE={0x4}]}]}, 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x137b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10000800}, 0x40800) 1m6.858092354s ago: executing program 3 (id=5568): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0xb, &(0x7f0000000640)=ANY=[], &(0x7f00000004c0)='GPL\x00', 0xb86, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000340)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x20000005, 0xba, &(0x7f0000000200)=""/186, 0x0, 0x42, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40039}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mkdirat(0xffffffffffffff9c, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) r0 = userfaultfd(0x80800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x2e8}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x7, 0xca352c92cb699c71, 0xffffffffffffffff, 0xd0a55000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setrlimit(0x8, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102384, 0x18ff0) prlimit64(0x0, 0xe, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='minix\x00', 0x800044, &(0x7f0000000100)) r2 = syz_genetlink_get_family_id$SEG6(0x0, 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f00000000c0)={0x0, 0x28, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYRES16=r2, @ANYBLOB="0d022abd7000fedbdf25010000000500060002000000050005000400000008000300060000000800040026000000"], 0x34}, 0x1, 0x0, 0x0, 0x404c095}, 0x4000) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000030000000060a010200000000000000000200000508000a400000000314000580080001400000810008000140a5a70073140000001100010000000083a7ae83000000000a4cda92fa99dfc61130aa27c7174782b244cf14b85e5234d5c3fb59753b12e0689d74de24548ac3bc92939505e0f20030e800000000"], 0x78}, 0x1, 0x0, 0x0, 0xa638d17b4ee5e357}, 0x8000000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000da9000/0x1000)=nil, 0x1000, 0x1) mlock(&(0x7f0000bff000/0x400000)=nil, 0x400000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) 1m5.04271119s ago: executing program 3 (id=5571): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x2, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) keyctl$search(0xa, 0x0, &(0x7f0000000040)='logon\x00', &(0x7f0000000380)={'syz', 0x2}, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@e={0xff, 0xa}) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) read$sequencer(r2, &(0x7f0000000100)=""/10, 0xa) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/ip6_tables_names\x00') fcntl$dupfd(r4, 0x406, r0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES16=r3, @ANYBLOB="01980000000000002000128008000100736974001406000e000600000008000100000000", @ANYRES64=r1], 0x40}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000003c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000f4ff00006a0a00fe000000008500000027000000b70000000000000095000000000000009cc6b3fcd62c7d37623802000000505f80fc88943c4f0cf0dd467b597811638883f6f698caf503a22f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b6d0e196bf02f46c7953ab1abda45cbe8d0d24b5069f8a98f3dc8f76b74635fc9f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193105000000b100400600e1ffff88208a2f7d25c32aac1c5d5b5be399f6609876b5887437a172fbc02a74067529194e533583412dff048f0000000000000000b2728a0481e9d6da43bb6cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13caec04a347903420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bd0339454c13ad3e328a100000000b515a1000000000000000eb2e9c15b6c8f6198282df27badac8507bc7d202e0990e0000000008919b3efce02a602b4ad38098774d1feaf5f277a4462a2fff2d6ff4780f9a30a2a5f5f284c00ad35e0a6f6a0f9dae214546d24ef6a9b8ced90b508dc3b55a8259614b731af86503e5849dc87ab86ec0f6a48f0d32f0d4a5f6a03c33612320bb44f2d80363dee9163424ac31469266877942abdbbb3729fd59c0ff048ed5ab58c81b74ef4e159d4594396864a65422fe5f8c8181309becc88091dd6641c2d7e5a68ecbe778f2aae1742b92dc6854de98da66f8e38d1eca95809b738c8ddcf4cf1693c7b1c2ae0a9c27bd1a6f1738f8ba2908139fd653908ca0105e72550fbb1f1543a9bcd48de441c364f1cdb53a1ed4169434fc8f705e262fb793cf25bcd60310991f0b0634fa08308c7100000834cba801f76f820ed6def799116ce2336cd308544fbd3b74e0093968fce3c425729a77ecb090000654680e715f4ce5c1ad2b75aab390700000000000000ed7ebe34db25cbe169138c15a6013220bba55923f62849392cf4fb0327877e22a4dc617a5541a7fb89223888c76d65850dd99997e727557a477a1131d06f6f7360cfcf137ccd2e0d516bb31be413b0c7bd1bd24d3dc2d8e3f4cdfa872b66d89332e313934e9e9a3471f7170832a775bb2a8e4aa6321b1a6546a56e4121231380b04eb55337c7edc66d6e3400b06fcb31b659be19cff61cfac6f1b771967aa7bfcf7dba26e279ab9bef181cc917fca8941819445dd6fd171c4065a526c7000000000000ef570531e36dd9cf4da9a269b71e05463dfadff8401bc3202a9c393e9658d15dc20655abad7f9c54fc89176071bf7645d221696fa24e1310598f1f0bbd6ea058fdec63fab905ac925b16bd5cedf4ea2775d897897473dce8a339e340519df5dc3c8ab91b6b96b10cb05637dc6f4f24b2b0ba824028fa0fa29c9cf80443de08b3fc140082c8aa79d6324e9c609b0d9c2eeba3accb49fe851b6f56a425f70b3157443d2b05a883700b554738fd8453ed2ba5af37121ff47dc759000000000000000000000000000000000d78287bf7833841f7d49160b8bf2bd448e49c9ce544f0fafba633b694965606fa98f10c1c9f55eee1aaf03d30e61c9a468758c151ebf809efcda19b880c534bce505e14b65bb4185bf0614f23c38d106f77e407cac3cdff686370d091d453f7b8f8731eb70c3053fbb1a7d1ec764f9436489e84941336e56ccdba860901290a3d27b6330b85d52095c3b28718"], &(0x7f0000000340)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0xffff0000, 0xf0, 0x0, &(0x7f0000001a40)="2b206d074843b397737ea49da2aa", 0x0, 0xf000, 0x720e, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54220002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62646c95c7", 0x2c, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r3, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) socket$packet(0x11, 0x3, 0x300) (async) socket(0x10, 0x2, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) keyctl$search(0xa, 0x0, &(0x7f0000000040)='logon\x00', &(0x7f0000000380)={'syz', 0x2}, 0x0) (async) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@e={0xff, 0xa}) (async) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) (async) read$sequencer(r2, &(0x7f0000000100)=""/10, 0xa) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/ip6_tables_names\x00') (async) fcntl$dupfd(r4, 0x406, r0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES16=r3, @ANYBLOB="01980000000000002000128008000100736974001406000e000600000008000100000000", @ANYRES64=r1], 0x40}}, 0x0) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x0) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000003c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000f4ff00006a0a00fe000000008500000027000000b70000000000000095000000000000009cc6b3fcd62c7d37623802000000505f80fc88943c4f0cf0dd467b597811638883f6f698caf503a22f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b6d0e196bf02f46c7953ab1abda45cbe8d0d24b5069f8a98f3dc8f76b74635fc9f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193105000000b100400600e1ffff88208a2f7d25c32aac1c5d5b5be399f6609876b5887437a172fbc02a74067529194e533583412dff048f0000000000000000b2728a0481e9d6da43bb6cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13caec04a347903420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bd0339454c13ad3e328a100000000b515a1000000000000000eb2e9c15b6c8f6198282df27badac8507bc7d202e0990e0000000008919b3efce02a602b4ad38098774d1feaf5f277a4462a2fff2d6ff4780f9a30a2a5f5f284c00ad35e0a6f6a0f9dae214546d24ef6a9b8ced90b508dc3b55a8259614b731af86503e5849dc87ab86ec0f6a48f0d32f0d4a5f6a03c33612320bb44f2d80363dee9163424ac31469266877942abdbbb3729fd59c0ff048ed5ab58c81b74ef4e159d4594396864a65422fe5f8c8181309becc88091dd6641c2d7e5a68ecbe778f2aae1742b92dc6854de98da66f8e38d1eca95809b738c8ddcf4cf1693c7b1c2ae0a9c27bd1a6f1738f8ba2908139fd653908ca0105e72550fbb1f1543a9bcd48de441c364f1cdb53a1ed4169434fc8f705e262fb793cf25bcd60310991f0b0634fa08308c7100000834cba801f76f820ed6def799116ce2336cd308544fbd3b74e0093968fce3c425729a77ecb090000654680e715f4ce5c1ad2b75aab390700000000000000ed7ebe34db25cbe169138c15a6013220bba55923f62849392cf4fb0327877e22a4dc617a5541a7fb89223888c76d65850dd99997e727557a477a1131d06f6f7360cfcf137ccd2e0d516bb31be413b0c7bd1bd24d3dc2d8e3f4cdfa872b66d89332e313934e9e9a3471f7170832a775bb2a8e4aa6321b1a6546a56e4121231380b04eb55337c7edc66d6e3400b06fcb31b659be19cff61cfac6f1b771967aa7bfcf7dba26e279ab9bef181cc917fca8941819445dd6fd171c4065a526c7000000000000ef570531e36dd9cf4da9a269b71e05463dfadff8401bc3202a9c393e9658d15dc20655abad7f9c54fc89176071bf7645d221696fa24e1310598f1f0bbd6ea058fdec63fab905ac925b16bd5cedf4ea2775d897897473dce8a339e340519df5dc3c8ab91b6b96b10cb05637dc6f4f24b2b0ba824028fa0fa29c9cf80443de08b3fc140082c8aa79d6324e9c609b0d9c2eeba3accb49fe851b6f56a425f70b3157443d2b05a883700b554738fd8453ed2ba5af37121ff47dc759000000000000000000000000000000000d78287bf7833841f7d49160b8bf2bd448e49c9ce544f0fafba633b694965606fa98f10c1c9f55eee1aaf03d30e61c9a468758c151ebf809efcda19b880c534bce505e14b65bb4185bf0614f23c38d106f77e407cac3cdff686370d091d453f7b8f8731eb70c3053fbb1a7d1ec764f9436489e84941336e56ccdba860901290a3d27b6330b85d52095c3b28718"], &(0x7f0000000340)='GPL\x00'}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0xffff0000, 0xf0, 0x0, &(0x7f0000001a40)="2b206d074843b397737ea49da2aa", 0x0, 0xf000, 0x720e, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) (async) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54220002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62646c95c7", 0x2c, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r3, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (async) 48.821394279s ago: executing program 33 (id=5571): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x2, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) keyctl$search(0xa, 0x0, &(0x7f0000000040)='logon\x00', &(0x7f0000000380)={'syz', 0x2}, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@e={0xff, 0xa}) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) read$sequencer(r2, &(0x7f0000000100)=""/10, 0xa) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/ip6_tables_names\x00') fcntl$dupfd(r4, 0x406, r0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES16=r3, @ANYBLOB="01980000000000002000128008000100736974001406000e000600000008000100000000", @ANYRES64=r1], 0x40}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000003c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000f4ff00006a0a00fe000000008500000027000000b70000000000000095000000000000009cc6b3fcd62c7d37623802000000505f80fc88943c4f0cf0dd467b597811638883f6f698caf503a22f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b6d0e196bf02f46c7953ab1abda45cbe8d0d24b5069f8a98f3dc8f76b74635fc9f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193105000000b100400600e1ffff88208a2f7d25c32aac1c5d5b5be399f6609876b5887437a172fbc02a74067529194e533583412dff048f0000000000000000b2728a0481e9d6da43bb6cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13caec04a347903420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bd0339454c13ad3e328a100000000b515a1000000000000000eb2e9c15b6c8f6198282df27badac8507bc7d202e0990e0000000008919b3efce02a602b4ad38098774d1feaf5f277a4462a2fff2d6ff4780f9a30a2a5f5f284c00ad35e0a6f6a0f9dae214546d24ef6a9b8ced90b508dc3b55a8259614b731af86503e5849dc87ab86ec0f6a48f0d32f0d4a5f6a03c33612320bb44f2d80363dee9163424ac31469266877942abdbbb3729fd59c0ff048ed5ab58c81b74ef4e159d4594396864a65422fe5f8c8181309becc88091dd6641c2d7e5a68ecbe778f2aae1742b92dc6854de98da66f8e38d1eca95809b738c8ddcf4cf1693c7b1c2ae0a9c27bd1a6f1738f8ba2908139fd653908ca0105e72550fbb1f1543a9bcd48de441c364f1cdb53a1ed4169434fc8f705e262fb793cf25bcd60310991f0b0634fa08308c7100000834cba801f76f820ed6def799116ce2336cd308544fbd3b74e0093968fce3c425729a77ecb090000654680e715f4ce5c1ad2b75aab390700000000000000ed7ebe34db25cbe169138c15a6013220bba55923f62849392cf4fb0327877e22a4dc617a5541a7fb89223888c76d65850dd99997e727557a477a1131d06f6f7360cfcf137ccd2e0d516bb31be413b0c7bd1bd24d3dc2d8e3f4cdfa872b66d89332e313934e9e9a3471f7170832a775bb2a8e4aa6321b1a6546a56e4121231380b04eb55337c7edc66d6e3400b06fcb31b659be19cff61cfac6f1b771967aa7bfcf7dba26e279ab9bef181cc917fca8941819445dd6fd171c4065a526c7000000000000ef570531e36dd9cf4da9a269b71e05463dfadff8401bc3202a9c393e9658d15dc20655abad7f9c54fc89176071bf7645d221696fa24e1310598f1f0bbd6ea058fdec63fab905ac925b16bd5cedf4ea2775d897897473dce8a339e340519df5dc3c8ab91b6b96b10cb05637dc6f4f24b2b0ba824028fa0fa29c9cf80443de08b3fc140082c8aa79d6324e9c609b0d9c2eeba3accb49fe851b6f56a425f70b3157443d2b05a883700b554738fd8453ed2ba5af37121ff47dc759000000000000000000000000000000000d78287bf7833841f7d49160b8bf2bd448e49c9ce544f0fafba633b694965606fa98f10c1c9f55eee1aaf03d30e61c9a468758c151ebf809efcda19b880c534bce505e14b65bb4185bf0614f23c38d106f77e407cac3cdff686370d091d453f7b8f8731eb70c3053fbb1a7d1ec764f9436489e84941336e56ccdba860901290a3d27b6330b85d52095c3b28718"], &(0x7f0000000340)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0xffff0000, 0xf0, 0x0, &(0x7f0000001a40)="2b206d074843b397737ea49da2aa", 0x0, 0xf000, 0x720e, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54220002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62646c95c7", 0x2c, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r3, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) socket$packet(0x11, 0x3, 0x300) (async) socket(0x10, 0x2, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) keyctl$search(0xa, 0x0, &(0x7f0000000040)='logon\x00', &(0x7f0000000380)={'syz', 0x2}, 0x0) (async) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000080)=@e={0xff, 0xa}) (async) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) (async) read$sequencer(r2, &(0x7f0000000100)=""/10, 0xa) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/ip6_tables_names\x00') (async) fcntl$dupfd(r4, 0x406, r0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES16=r3, @ANYBLOB="01980000000000002000128008000100736974001406000e000600000008000100000000", @ANYRES64=r1], 0x40}}, 0x0) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x0) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000003c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000f4ff00006a0a00fe000000008500000027000000b70000000000000095000000000000009cc6b3fcd62c7d37623802000000505f80fc88943c4f0cf0dd467b597811638883f6f698caf503a22f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b6d0e196bf02f46c7953ab1abda45cbe8d0d24b5069f8a98f3dc8f76b74635fc9f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193105000000b100400600e1ffff88208a2f7d25c32aac1c5d5b5be399f6609876b5887437a172fbc02a74067529194e533583412dff048f0000000000000000b2728a0481e9d6da43bb6cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13caec04a347903420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bd0339454c13ad3e328a100000000b515a1000000000000000eb2e9c15b6c8f6198282df27badac8507bc7d202e0990e0000000008919b3efce02a602b4ad38098774d1feaf5f277a4462a2fff2d6ff4780f9a30a2a5f5f284c00ad35e0a6f6a0f9dae214546d24ef6a9b8ced90b508dc3b55a8259614b731af86503e5849dc87ab86ec0f6a48f0d32f0d4a5f6a03c33612320bb44f2d80363dee9163424ac31469266877942abdbbb3729fd59c0ff048ed5ab58c81b74ef4e159d4594396864a65422fe5f8c8181309becc88091dd6641c2d7e5a68ecbe778f2aae1742b92dc6854de98da66f8e38d1eca95809b738c8ddcf4cf1693c7b1c2ae0a9c27bd1a6f1738f8ba2908139fd653908ca0105e72550fbb1f1543a9bcd48de441c364f1cdb53a1ed4169434fc8f705e262fb793cf25bcd60310991f0b0634fa08308c7100000834cba801f76f820ed6def799116ce2336cd308544fbd3b74e0093968fce3c425729a77ecb090000654680e715f4ce5c1ad2b75aab390700000000000000ed7ebe34db25cbe169138c15a6013220bba55923f62849392cf4fb0327877e22a4dc617a5541a7fb89223888c76d65850dd99997e727557a477a1131d06f6f7360cfcf137ccd2e0d516bb31be413b0c7bd1bd24d3dc2d8e3f4cdfa872b66d89332e313934e9e9a3471f7170832a775bb2a8e4aa6321b1a6546a56e4121231380b04eb55337c7edc66d6e3400b06fcb31b659be19cff61cfac6f1b771967aa7bfcf7dba26e279ab9bef181cc917fca8941819445dd6fd171c4065a526c7000000000000ef570531e36dd9cf4da9a269b71e05463dfadff8401bc3202a9c393e9658d15dc20655abad7f9c54fc89176071bf7645d221696fa24e1310598f1f0bbd6ea058fdec63fab905ac925b16bd5cedf4ea2775d897897473dce8a339e340519df5dc3c8ab91b6b96b10cb05637dc6f4f24b2b0ba824028fa0fa29c9cf80443de08b3fc140082c8aa79d6324e9c609b0d9c2eeba3accb49fe851b6f56a425f70b3157443d2b05a883700b554738fd8453ed2ba5af37121ff47dc759000000000000000000000000000000000d78287bf7833841f7d49160b8bf2bd448e49c9ce544f0fafba633b694965606fa98f10c1c9f55eee1aaf03d30e61c9a468758c151ebf809efcda19b880c534bce505e14b65bb4185bf0614f23c38d106f77e407cac3cdff686370d091d453f7b8f8731eb70c3053fbb1a7d1ec764f9436489e84941336e56ccdba860901290a3d27b6330b85d52095c3b28718"], &(0x7f0000000340)='GPL\x00'}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0xffff0000, 0xf0, 0x0, &(0x7f0000001a40)="2b206d074843b397737ea49da2aa", 0x0, 0xf000, 0x720e, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) (async) sendto$packet(r0, &(0x7f0000000600)="05d936277c6f54220002097844ffcf8bd1846f7f83477ca1b278e3e4018a34844b9d62cbd7cd2a62646c95c7", 0x2c, 0x8c1, &(0x7f00000000c0)={0x11, 0x86dd, r3, 0x1, 0x4, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) (async) 12.051587868s ago: executing program 6 (id=5755): syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100015ae4c41096050100f5050100030109021b0001000000000904d60001b5e1450009058313"], 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0xffc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x14, r4, 0x321, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4044811}, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) 9.256225495s ago: executing program 6 (id=5762): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f00000003c0)={{&(0x7f0000c67000/0x4000)=nil, 0x40fe}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="ed2809b5a74423b844b46d0a80fb412038dc320c2836b93ac0ef9ba97f1359efddf7354f73c012df48f23cf52a5f244cb0b2f2f66fe53ce129ffbf6919b984d571a860eea0442389c8167b5181300ea64ee168ea0e46b770fda1812825c4f6100ae62afc4ddff1d7664e5a491ed74103e2faacdf5999cfd73f91bc621929d16b5f8ed32a550ed85a8cdbb34b6b5cb8d30f5191cdb20e10a590"]) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="3d00000000000000000000000000f1901dcdbc86a0b1a7e73d8acc4886766cfb4d061d7f8c2ea80fae6863073e47c28a1f432351ac33000000008a6d581fc7030cc35c9816e4bdd25f82e32e3dabc1fe77c94709a6c3b91c395dd0c5c01dcb0c1fcdc2ce8863e5c29bf9218d0da326f7b648c4c84d9f2dc4778a717713eb46d14db92509c3817aac9999749dd1fa91ec60b08e12d304233a3ff5551bf1784811b554504e94625c062db50f3d513ebb677154bf9cf91483f051c6acfeb48a615328093c9d0000", @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) r3 = openat(r1, &(0x7f0000004d00)='./file1\x00', 0x351142, 0x1cd) quotactl_fd$Q_GETNEXTQUOTA(r3, 0xffffffff80000900, 0x0, 0x0) (async) quotactl_fd$Q_GETNEXTQUOTA(r3, 0xffffffff80000900, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390d41e00000001090224c555909a76960718500001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) (async) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390d41e00000001090224c555909a76960718500001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="0d01"], 0x0) syz_usb_ep_write$ath9k_ep2(r4, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) (async) syz_usb_ep_write$ath9k_ep2(r4, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) 7.522229462s ago: executing program 4 (id=5766): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x200006, 0x8, &(0x7f0000006680)) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x5, 0xfa, 0x2019}}}, 0x7) set_robust_list(0x0, 0x0) r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r0, 0x0) request_key(&(0x7f00000000c0)='asymmetric\x00', 0x0, 0x0, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @local}, 0xc) syz_usb_connect(0x2, 0x51, &(0x7f0000000000)=ANY=[@ANYBLOB="120101024cf1c50863070210845f0102030109023f0001000000000904000005ff87e7000905880f02000000000905030048521dd70009050cfeffff01060209050f0000000000000905"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x800) r1 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0x7, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x3c, r2, 0x1, 0x0, 0x0, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0x6, 0xa8, @random='8\x00'}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}}, 0x0) 5.672584811s ago: executing program 5 (id=5771): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x2000c450) sendmsg$NFT_BATCH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x402, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0xe0}}, 0x0) close(0x3) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x7, 0xd, 0x0, 0xffdffffc, 0x6, "0000100000000000000000004000"}) write$binfmt_aout(r2, &(0x7f0000000400)=ANY=[], 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000580)={0x0, 0x0, 0x3, 0x0, 0x1b, "00000000000000000000ffff00"}) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, 0x0) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r2, 0x0) read$FUSE(r4, &(0x7f000000a380)={0x2020}, 0x2020) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) read$watch_queue(r4, 0x0, 0x0) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0xf0f05e, 0xf030000, '\x00', @p_u32=0x0}}) 5.660685575s ago: executing program 1 (id=5772): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x5, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0x1, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x0, 0x3, 0xc, 0x3, 0xba55, 0x8da8, 0x2, 0x200, 0x2, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x199d, 0x6, 0x2, 0x9, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x8, 0x7fff, 0x72c, 0x1c32, 0x3, 0x5, 0x10000, 0x400, 0x7ffd, 0x3, 0x3, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffffffff, 0x6, 0x2000008, 0x800, 0xffff, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x200, 0x3], [0x401, 0x8000c584, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x1, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x3, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x6, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x3, 0x3, 0x88, 0x2, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x402, 0x1, 0x5, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x3, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a5, 0x86, 0x44, 0x409, 0x6, 0x4, 0x4, 0xe, 0x4, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff8, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x101, 0xf, 0xf, 0x136, 0x6]}, 0x45c) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) mremap(&(0x7f0000ff1000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ffb000/0x4000)=nil) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, 0x0}, 0x4000000) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000500)=ANY=[], 0x24, 0x3) flistxattr(0xffffffffffffffff, 0x0, 0x5) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002abd7000fcdbdf252800000008000200", @ANYRES32=0x0, @ANYBLOB="0575bd928a1dd7cf"], 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x4000840) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, 0x0, 0x40010) close(0x3) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r2, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25, 0x8, 0x0, 0x0}}, 0x10) write$dsp(0xffffffffffffffff, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) 5.640217665s ago: executing program 5 (id=5773): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000a00), 0x0, 0x0, 0x188}}], 0x1, 0x810) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xcf6, 0x20493859, 0x0, 0x0, 0xffffffff, 0x0, 0x80000000, 0x0, 0x1}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000100)={0x400, 0x40, 0x3e000000, 0x800, 0xbbba, 0x2, 0x18, 0x0, {0x0, 0x2007}, {0x9, 0x3, 0xfffffffe}, {0x0, 0xffff0000}, {0x1000000, 0x0, 0x20001}, 0x0, 0x0, 0xa, 0x4d612, 0x0, 0x0, 0x0, 0x4000008, 0xfffffffd, 0x0, 0x0, 0x0, 0x39, 0x100, 0x1, 0x1}) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) pwritev(0xffffffffffffffff, &(0x7f0000000d80)=[{&(0x7f0000000780)="42ebe7f5d8dde5f3e9c5c7e7bc09d8d80f373ae4dc85e6cb597bd32266", 0x1d}, {0x0}, {&(0x7f0000000a80)}, {&(0x7f0000000d00)="7cedc13b1cbf2308b2000d3d62b333c7c3b9f321", 0x14}, {&(0x7f0000000ac0)}], 0x5, 0x4d9e, 0x8) pwritev(r2, &(0x7f0000000300)=[{&(0x7f0000000e00)="545456aaca66a06ed89e676f97244e73fdef2c4e0e9908a9ae18d3edaee292b26418c7951dad9d46f36db1eebad39c223195e88141843cbc65ffe078fcde20453c60f3f6f733e2ce489c5d6b594a687d47fc433e62511888fabf8a13d8f97d253ff2f10bfcabe5e3dc26f6d8fb594e53de1031ab32a900c951328857024807455b2421f9b87776b96fbfe85280da7237391eb0810d01c419707f1d76dc7e292874440eebd46a4f272092bef765c697968613a5858fe0544603bbf9c65cd8a21985755fc20def7e6e6c949242709cadfc9b8cb77179735797c656acff93bf772782823cc71939f295d4b5317e832933a90be05b9157392470dab1d30424555f", 0xff}, {&(0x7f0000000880)="ff83bffdd1f4828b21f97bfb9940a94f3600d85f12df214732c443800a73983dfaf6de4c374f0430f40f8c9f23cea42a1929bb54c905bfd614893fe2bbfe9a38d0524352a1ac9251e7569869bf3baee47afb50cb4030870b0065d0eb2dcec756e8c33e660f62a5dd4df32d499f758f93808e65071d1c9a4336effbaa73d2ebd7375c0c0a41d106174888647715ff2d162210a4a9c2", 0x95}, {&(0x7f0000000a80)="d14780f76141f88b8e37361c51910b20695a4cfb5a96f3a2716a92a7d1294e0777f665eddaced14e561bf05c6a64ce16fa1d43994ccccca85827f41dd9e8cb01ff39f940fefc7511", 0x48}], 0x3, 0x46, 0x3) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5.20023178s ago: executing program 5 (id=5774): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000003400000034000000020000000000000002000004000000000000000002000000000fffff0000000002000000000000000100000000000012"], 0x0, 0x4e, 0x0, 0x1}, 0x28) 5.108955482s ago: executing program 5 (id=5775): openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, 0x0, 0x0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x8882, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f0000000440)=0xc) prlimit64(r2, 0xe, &(0x7f0000000700)={0x4, 0xf4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) accept4$tipc(r1, 0x0, 0x0, 0x400) pread64(r4, &(0x7f00000002c0)=""/75, 0x4b, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f0000000140)={0xf, 0x0, 0x2, 0x80}) socket$packet(0x11, 0x3, 0x300) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="81242513574550eaa34573e7e93f81613aba54adb7fca55fbac6813c766cf7a9d4a757cdde8dd9beeb2703a26e966c73e1f57556fefdd62e853485de8d98bbd6d64f", @ANYRES16, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800080000fcbefd770e090000000000080011000000000008000e008000000008", @ANYRES64], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000380)={'tunl0\x00', &(0x7f0000000340)={'syztnl2\x00', 0x0, 0x700, 0x80, 0x1, 0x4, {{0x6, 0x4, 0x0, 0x1, 0x18, 0x65, 0x0, 0xff, 0x29, 0x0, @remote, @remote, {[@noop]}}}}}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xbc}, 0x1, 0x0, 0x0, 0xd9}, 0x0) 5.009710406s ago: executing program 5 (id=5776): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x20, r0, 0xb15, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}, 0x1, 0x0, 0x0, 0x2600c8c0}, 0x4) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYRES8=0x0, @ANYRES64, @ANYRESOCT=r1, @ANYRESOCT=0x0, @ANYRES16=r1, @ANYBLOB="d9411093cecf2b849087abf9b78ea378959eb66e7688ccbed8eea293cdac7efc814f00c9907b32c6911880804147ad41fac060cc7ed2461a2ab54c1d8cafd6c6d3a58843b93b2cb3fd1e014e063a75eeb13617cb07ea4cedfa1afc3c1dacb6ccec98f5179eb1eda0cd7b0847d724a41f222361d13dee697ff0fe95bafd043431d8abda1bd1d1c465881cd4371cf4d9d29a4fa7966de6bfd858ab89a331e4c78a3d37c257c57967e0989a70c859a0a3d506062925a785494415ad3f1283c76b"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) (async) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYRES8=0x0, @ANYRES64, @ANYRESOCT=r1, @ANYRESOCT=0x0, @ANYRES16=r1, @ANYBLOB="d9411093cecf2b849087abf9b78ea378959eb66e7688ccbed8eea293cdac7efc814f00c9907b32c6911880804147ad41fac060cc7ed2461a2ab54c1d8cafd6c6d3a58843b93b2cb3fd1e014e063a75eeb13617cb07ea4cedfa1afc3c1dacb6ccec98f5179eb1eda0cd7b0847d724a41f222361d13dee697ff0fe95bafd043431d8abda1bd1d1c465881cd4371cf4d9d29a4fa7966de6bfd858ab89a331e4c78a3d37c257c57967e0989a70c859a0a3d506062925a785494415ad3f1283c76b"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 4.685145644s ago: executing program 1 (id=5777): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x51) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) keyctl$dh_compute(0x17, 0x0, &(0x7f0000000480)=""/82, 0x52, 0x0) socket(0x1d, 0x2, 0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd000000"], 0x24}, 0x1, 0x0, 0x0, 0x100}, 0x4014) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="24000000010401013100000000000000"], 0x24}}, 0x0) close(0x3) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000002e80), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r5, &(0x7f0000001d80)='.\x00', 0x0, &(0x7f0000001dc0)={0xb, 0x2}, 0x20) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @local}}, {0x14, 0x2, @in={0x2, 0x0, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x54, r7, 0x1, 0xfffffffe, 0x10000, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x0) 4.448875428s ago: executing program 4 (id=5778): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (rerun: 64) r0 = getpid() (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) (async) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async, rerun: 32) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) (async, rerun: 32) socket$can_raw(0x1d, 0x3, 0x1) (async, rerun: 64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) (async, rerun: 64) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r4, 0x2285, 0x0) (async) r5 = fcntl$dupfd(r4, 0x0, r4) (async) r6 = socket$inet(0x2b, 0x801, 0x0) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x48f, &(0x7f0000000000)={0x1, @broadcast, 0x4e23, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) (async) write$sndseq(r5, &(0x7f0000000180)=[{0x0, 0x4b, 0xd, 0x0, @tick=0xdf, {0x0, 0xff}, {0x10, 0x9}, @note={0xa, 0x8, 0xb0, 0x9, 0x3}}, {0x0, 0x0, 0x0, 0x0, @tick=0x46f, {}, {0x80, 0x1}, @connect={{0x40, 0x7}, {0x80, 0xf6}}}], 0x38) read$snapshot(r5, 0x0, 0xffffffbf) syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), 0xffffffffffffffff) (async) openat$cuse(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r5, 0x0, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 32) close_range(r3, 0xffffffffffffffff, 0x0) (rerun: 32) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x7, 0xfd}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async, rerun: 32) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (rerun: 32) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122"], 0x0) (async) socket$alg(0x26, 0x5, 0x0) 4.388280757s ago: executing program 5 (id=5779): socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x16, &(0x7f0000000280)={@local, @broadcast, @void, {@llc={0x4, {@snap={0xaa, 0x0, "bb", "ff80f4", 0x6007}}}}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000000104030000000004000000000300000a050001000400000005000100030000000a000200ff"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20) 4.301026826s ago: executing program 6 (id=5780): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000340)=0x15) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f00000005c0)={0x0, 0x0, {}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) lseek(0xffffffffffffffff, 0x4, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f00000000c0)={0x1d, r3}, 0x18) connect$can_j1939(r2, &(0x7f0000000140)={0x1d, r3, 0x0, {0x1, 0xf1, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) sendmmsg(r2, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) socket$inet(0x2b, 0xa, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r7, 0x29, 0x3c, 0x0, 0x0) setsockopt$SO_TIMESTAMP(r7, 0x1, 0x23, &(0x7f0000000040)=0x2c1, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x5e20, 0x3, @mcast2}, 0x1c) recvmmsg(r7, 0x0, 0x0, 0x40000000, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) 3.936333603s ago: executing program 4 (id=5782): socket$inet6(0xa, 0x1, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x1}) r1 = userfaultfd(0x1) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2a8, 0xffffffff, 0x9e8, 0x9e8, 0x8d8, 0xffffffff, 0xffffffff, 0xa90, 0xa90, 0xa90, 0xffffffff, 0x5, 0x0, {[{{@uncond, 0x74000002, 0x70, 0xd0, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x0, 0x6, 0x6, 0x0, 0x6, 0x4], 0x6, 0x1}, {0x0, [0x8, 0xa, 0x0, 0x6, 0x7, 0x5], 0x1}}}}, {{@uncond, 0x287, 0x70, 0x98}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0xa8}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x4}, {0x0, 0x4, 0x1}, {0xffffffffffffffff, 0x6, 0x1}, 0x3, 0xa}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x308) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f00000000c0)={&(0x7f0000128000/0x3000)=nil, 0x3000}) ioctl$IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r0, 0x7b0, &(0x7f0000000040)={@my=0x1, 0x2}) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000170000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000009b00000095"], 0x0, 0xffffffff}, 0x94) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b400000000000000dd0a00000000000278735188b7cebb63000100950000000000000046d7761b25ac860f0f657d14d7a263b0dcc17f5558a62ceb4e3318f17e6bde7cb4b1c92cda17965abd7a3193afdab1d0d065756d63c1ba875072dcc564c47a90c7e61637b539a402fac528bc87fed2b6b89050a2994c6a5da0ebf80276bfd356aceb1dc32e1cc952d4bb07e7b896d9aa42273b918ae4cbbf730f73ba27bd641fa80857df109bbd2b21b24ff05d34342563cbd7d9cf00785aaf39946bff460ada85a12c595c9deb279dd5e913e6c895e4a0387efceac198c5ef3cbad71e86d26925834785ef7be69cd215de67c5"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x3}, 0x8}, 0x94) syz_emit_vhci(&(0x7f0000000440)=ANY=[@ANYBLOB="040e04050520"], 0x7) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r3, 0xc4c85512, &(0x7f0000000780)={{0x8, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x4, 0x0, 0x40000000000, 0xffffffffffffffff, 0xffffffeffffffffe, 0x0, 0x4, 0x0, 0x7, 0x4, 0x0, 0x0, 0xfffffeffbfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000003, 0x3, 0x0, 0x0, 0x4, 0x0, 0x6, 0x1, 0x40, 0x0, 0xfffffffffffffffd, 0x100200000, 0xb, 0x6, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000, 0x1000, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffdfffffffff, 0xfffffffffffffffc, 0x3, 0x0, 0x7, 0x10000, 0x7785, 0x0, 0x4, 0x4, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x80000002000, 0xb, 0x4, 0x0, 0xfffffffffffffffe, 0x0, 0x7ff, 0x0, 0xfffffffffffffffe, 0x9, 0x1000000000, 0x0, 0x80000000000002, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x2000, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2c5, 0x0, 0x100, 0x81, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x9, 0x100000000000, 0x4000000000, 0x3, 0x2, 0x0, 0x7, 0xc0c0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0xd, 0xffffffffffeffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000, 0x0, 0x20000000, 0x0, 0x80]}) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r6, 0x5b01, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x5f) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b609000faeb4bd2a5592ea54c7beef915d564c90c200", 0x18) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x2000000000000) setsockopt$inet_int(r2, 0x0, 0xb, &(0x7f0000000340)=0x4, 0x4) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x3, 0xc, &(0x7f0000000380)=ANY=[@ANYRESOCT=r3, @ANYRES8=r5, @ANYRESOCT=r7, @ANYRES64=r3], &(0x7f0000000080)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_genetlink_get_family_id$gtp(&(0x7f0000000b40), 0xffffffffffffffff) 3.292570003s ago: executing program 0 (id=5783): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000000000)=""/46, &(0x7f0000000040)=0x2e) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff"], 0x15) socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000840)='{', 0x1}], 0x1}, 0x20048843) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e1301"], 0x16) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$netlink(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x406}}}, 0x7) ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYRES8=r2, @ANYRES32=0x0, @ANYBLOB="35030700231a05001c00128009000100626f6e64000000000c00028008000700ffffffff", @ANYRES32=r9], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) 2.520310761s ago: executing program 1 (id=5784): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="940000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000004aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000800074000000008"], 0x94}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x98, 0x0, 0x1, 0x401, 0x0, 0x8000000, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0x98}}, 0x8884) 2.511383674s ago: executing program 6 (id=5785): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x400, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0xe0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}, {0xfff3, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x842}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x3}]}}]}, 0x44}}, 0x4044080) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 2.40661895s ago: executing program 6 (id=5786): openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000007d80), 0x0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, 0x0, 0x8882, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f0000000440)=0xc) prlimit64(r2, 0xe, &(0x7f0000000700)={0x4, 0xf4}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) accept4$tipc(r1, 0x0, 0x0, 0x400) pread64(r4, &(0x7f00000002c0)=""/75, 0x4b, 0x0) ioctl$VIDIOC_EXPBUF(r4, 0xc0405610, &(0x7f0000000140)={0xf, 0x0, 0x2, 0x80}) socket$packet(0x11, 0x3, 0x300) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="81242513574550eaa34573e7e93f81613aba54adb7fca55fbac6813c766cf7a9d4a757cdde8dd9beeb2703a26e966c73e1f57556fefdd62e853485de8d98bbd6d64f", @ANYRES16, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800080000fcbefd770e090000000000080011000000000008000e008000000008", @ANYRES64], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000380)={'tunl0\x00', &(0x7f0000000340)={'syztnl2\x00', 0x0, 0x700, 0x80, 0x1, 0x4, {{0x6, 0x4, 0x0, 0x1, 0x18, 0x65, 0x0, 0xff, 0x29, 0x0, @remote, @remote, {[@noop]}}}}}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xbc}, 0x1, 0x0, 0x0, 0xd9}, 0x0) 2.403546838s ago: executing program 1 (id=5787): r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udp\x00') pread64(r1, &(0x7f0000000180)=""/115, 0x73, 0xf) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0), 0x49) r2 = syz_open_dev$vim2m(&(0x7f0000000100), 0xffffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x8, 0x81, {}, {0x4, 0x8, 0x0, 0x5, 0x29, 0x9, "0adb3f09"}, 0x5, 0x1, {}, 0x4}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f0000000680)=@multiplanar_mmap={0x1, 0x1, 0x4, 0x2, 0x5, {}, {0x5, 0x0, 0x7, 0x1, 0x6, 0xa, "23a7bcee"}, 0x0, 0x1, {0x0}, 0x1}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000080)=@mangle={'mangle\x00', 0x44, 0x6, 0xc80, 0x98, 0x9b0, 0x9b0, 0x0, 0x138, 0xbe8, 0xbe8, 0xbe8, 0xbe8, 0xbe8, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'xfrm0\x00', 'nr0\x00'}, 0x0, 0x850, 0x878, 0x0, {}, [@common=@unspec=@u32={{0x7e0}, {[{[{0x8}, {0x6, 0x1}, {0x9, 0x3}, {0x9, 0x1}, {}, {0x11}, {0x400, 0x2}, {0x7, 0x2}, {0x1, 0x1}, {0x4, 0x3}, {0x10, 0x1}], [{0x7fff, 0x9}, {0x4, 0x3}, {0xd, 0xb}, {0x6, 0x5}, {0x0, 0xfffff228}, {0x6, 0x8}, {0xfffffffc, 0xe000}, {0x5, 0x6}, {0x948, 0x37}, {0x101, 0x7}, {0x2, 0x6}], 0x0, 0xc}, {[{0x2, 0x2}, {0x9}, {0x8, 0x1}, {0x80, 0x2}, {0x4, 0x2}, {0x2, 0x2}, {0x2, 0x2}, {0x80000001, 0x2}, {0xe7e, 0x1}, {0x7fffffff, 0x3}, {0x7, 0x2}], [{0x373d, 0x7}, {0x7fffffff, 0xa}, {0x5, 0xfffff000}, {0xc771, 0x10}, {0x81, 0x3}, {0x3}, {0x3, 0x9}, {0x8, 0x10001}, {0x3, 0x7}, {0xecb, 0x5d2}, {0x9, 0x1}], 0x1, 0x9}, {[{0x4, 0x2}, {0x4, 0x2}, {0x8000, 0x2}, {0x7, 0x2}, {0x3ff, 0x1}, {0x8000, 0x3}, {0x3ff, 0x2}, {0x6, 0x2}, {0xc2, 0x2}, {0x1, 0x1}, {0x6e898bc6, 0x2}], [{0xd, 0x2}, {0x10000, 0x6bd}, {0x8000, 0x2}, {0x4, 0x2}, {0x6, 0x5}, {0x0, 0x2}, {0xd9, 0x9}, {0x7f, 0x5410}, {0x7, 0x9}, {0x2eb, 0x1}, {0x2, 0x5}], 0x8, 0x7}, {[{0x5, 0x2}, {0x3}, {0x6, 0x1}, {0xaa, 0x1}, {0xaeb6}, {0x7}, {0x81, 0x2}, {0x80000001, 0x1}, {0x7}, {0x100, 0x1}, {0x64}], [{0x0, 0x6}, {0x3, 0x55a}, {0x709d, 0x328c}, {0x1, 0x4}, {0x8000, 0x6}, {0x471f, 0x8171}, {0x1, 0x1}, {0x0, 0x400}, {0x7fff, 0x5}, {0x7fff, 0x4}, {0x800, 0x3c69}], 0x9, 0x8}, {[{0x13, 0x1}, {0x4, 0x3}, {0x81, 0x2}, {0x2, 0x1}, {0x7e}, {0x82c7, 0x2}, {0x3ff, 0x3}, {0x0, 0x3}, {0x2, 0x2}, {0x8000, 0x1}, {0x1000, 0x1}], [{0x800, 0x5}, {0x0, 0x7ff}, {0x31cec858, 0xc73}, {0x2, 0x3}, {0x9, 0x100}, {0x6, 0x7}, {0x101, 0x101}, {0xfffffff7, 0xfffffffc}, {0x8d2d2a6, 0x8000}, {0x3e43}, {0x7fff, 0x4}], 0x7, 0x6}, {[{0x1, 0x1}, {0xc, 0x1}, {0x1, 0x2}, {0x9, 0x3}, {0x2}, {0xffffffff, 0x2}, {0x7}, {0x5, 0x2}, {0x7}, {0xfee}, {0x6, 0x1}], [{0x80, 0x21a2}, {0x2, 0x4}, {0x8000, 0x8}, {0x3, 0x4}, {0x1, 0x8}, {0x7, 0x2b1}, {0x5, 0x9}, {0x3, 0x1}, {0x4, 0x7ff}, {0x9, 0x48c2}, {0x10001, 0x5}], 0x7, 0x3}, {[{0x1, 0x1}, {0x3, 0x3}, {0x84, 0x3}, {0x400, 0x3}, {0x6e31, 0x1}, {0x2, 0x3}, {0x9, 0x2}, {0x4, 0x2}, {0x8, 0x1}, {0x9, 0x3}, {0x3914}], [{0x5, 0x2f35}, {0x3, 0x8}, {0x6, 0x6870}, {0xfffffff9}, {0x8e3, 0x200}, {0x6, 0xbfd5}, {0x7, 0x226}, {0x0, 0xfffffffd}, {0xffffffa5, 0x3d}, {0x3, 0x6}, {0x5, 0x3}], 0x3, 0x1}, {[{0x5, 0x2}, {0x85f, 0x2}, {0x5}, {0xfff, 0x3}, {0x80000001, 0x3}, {0xb58, 0x3}, {0x10, 0x1}, {0x53, 0x3}, {0x40}, {0x5c, 0x3}, {0x474f, 0x2}], [{0x3, 0x183}, {0x8, 0x5efb5271}, {0x4, 0x1ff}, {0x9, 0x5}, {0x3, 0x1}, {0x10, 0x1}, {0x0, 0x4}, {0x2000006, 0x4}, {0x0, 0x5}, {0xe79f, 0x2}, {0x10, 0x2}], 0x5, 0x6}, {[{0x21b1, 0x1}, {0x200}, {}, {0x159d2f81, 0x3}, {0x8}, {0x80}, {0x296, 0x3}, {0x7, 0x1ddaba58ff2d2f41}, {}, {0xe, 0x1}, {0x4, 0x3}], [{0xfffffe18, 0xffffffff}, {0x80, 0x8}, {0x7, 0x6}, {0x85, 0x7}, {0x3, 0x2acb}, {0x3, 0x3}, {0x0, 0xffffffff}, {0x1, 0x8}, {0x1f, 0x1000}, {0x3, 0x4}], 0x5, 0x3}, {[{0xeca5, 0x3}, {0x1, 0x3}, {0x9, 0x3}, {0x2, 0x2}, {0xaf27, 0x3}, {0x9}, {0xa9e, 0x1}, {0x8c96}, {0x101}, {0x4}, {0x7, 0x3}], [{0x4, 0xdcc}, {0x1000, 0x8}, {0x8, 0x4}, {0x4, 0x4}, {0xc8, 0x9}, {0x8, 0x3}, {0xcbf, 0x24}, {0x7, 0xf5}, {0x7, 0x4}, {0x2, 0x5}, {0x3329, 0xcf7}], 0x4, 0x9}, {[{0xfffffff9, 0x3}, {0x2, 0x2}, {0x1}, {0x6}, {0x7, 0x1}, {0x8001, 0x2}, {0x4, 0x2}, {0xffff, 0x2}, {0xfffffffe, 0x2}, {0x2, 0x1}, {0xf, 0x2}], [{0xfffffff9, 0xff}, {0xbe03, 0x6}, {0xee0, 0x7fffffff}, {0x9, 0x8}, {0x1, 0xffffffff}, {0x2, 0x9}, {0xfffffffe, 0x11400}, {0x7, 0x1}, {0x5a6, 0x4}, {0x1, 0x3}, {0x7}], 0xb, 0xb}], 0x8}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xce0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r3) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r5, &(0x7f0000000e40)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d80)={0x68, r6, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'caif0\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x804) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)={0x4c, r0, 0x1, 0x70bd2a, 0x0, {0x41}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xffffffffffffff2c}, {0x8, 0x87, 0x1}}, {@nsim={{}, {0x0, 0x2, {'netdevsim', 0x0}}}, {}, {0x58, 0x83, 0x1}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008080}, 0x0) 1.981970483s ago: executing program 0 (id=5788): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = gettid() process_vm_writev(r0, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0x7ffff000}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x20040005) r4 = syz_io_uring_setup(0x495, &(0x7f0000000540)={0x0, 0xe140, 0x0, 0x0, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_UNLINKAT={0x24, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0}) (async) io_uring_enter(r4, 0x3516, 0x100000, 0x0, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa7ae6000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x9841, 0x0) execveat(r7, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={[&(0x7f00000000c0)='\x00', &(0x7f0000000100)='\x00', &(0x7f0000000140)='\x00']}, &(0x7f0000000300)={[&(0x7f00000001c0)='[\x00', &(0x7f0000000200)='\x00', &(0x7f0000000240)='\x00']}, 0x100) (async) connect$inet6(0xffffffffffffffff, 0x0, 0x0) 1.288757942s ago: executing program 0 (id=5789): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, 0x0, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) (async) r4 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) pwritev(r4, &(0x7f0000000200)=[{0x0}, {&(0x7f0000000180)="dc8ab6", 0x3}], 0x2, 0x7f, 0x3) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) (async) r7 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r7, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) (async) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adbaa402}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r6, &(0x7f0000000b00)={@val={0xa}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @remote, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\a\x00', 0x8, 0x11, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, {[], {0x4f19, 0x4e20, 0x8}}}}}}}, 0x42) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="140100003b00015300000000fcdbdf2501"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x8}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000140)={r9, 0xc0, &(0x7f0000000380)=[@in6={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, @in6={0xa, 0x4e22, 0x2, @mcast1, 0x7f}, @in6={0xa, 0x4e22, 0x3, @local, 0x7}, @in6={0xa, 0x4e20, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}, 0x889}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3c}}, @in={0x2, 0x4e24, @rand_addr=0x64010102}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3e}}]}, &(0x7f0000000180)=0x10) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x3, 0x9}, 0x20) (async) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f0000000300)=ANY=[@ANYBLOB="9000000000000006d418b64000"], 0x8) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000001a40)=[@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, @in={0x2, 0x0, @local}, @in={0x2, 0x0, @multicast1}], 0x30) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x1, 0x0) (async) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000240), 0x4) syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_complete={{0x3, 0xb}, {0x0, 0x15b, @any, 0x1, 0x1}}}, 0xe) 1.236118995s ago: executing program 6 (id=5790): r0 = syz_open_dev$vbi(&(0x7f0000000140), 0x3, 0x2) mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x197, 0x0) r1 = syz_io_uring_setup(0x22f, &(0x7f0000000080)={0x0, 0x5325, 0x10000, 0x0, 0x100002ce}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000005580)=""/102392, 0x18ff8) mount(&(0x7f0000000200)=@rnullb, &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='aufs\x00', 0x9010, &(0x7f0000000300)='eth0\x00') madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000e56000/0x4000)=nil, 0x4000, 0x11) ioctl$VIDIOC_SUBDEV_S_SELECTION(0xffffffffffffffff, 0xc040563e, &(0x7f0000000180)={0x0, 0x0, 0x102, 0x6, {0x5, 0x9, 0xd, 0x58}}) syz_io_uring_submit(r2, r3, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) r5 = socket(0x10, 0x3, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xe000, &(0x7f0000000200)=[{&(0x7f0000000240)="d8000000180081064e81f782db4cb904021d0800fd027c05e8fe55a10a0006000140020203600e41b0000900ac00060311000000a4000500000080200004015c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d3a6823a45f28fcb1d", 0xd8}], 0x1}, 0x40) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) io_uring_enter(r1, 0x7a98, 0x0, 0x0, 0x0, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x3d, 0x79, 0x40, 0x1ac7, 0x1, 0xcc19, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1}}]}}, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000040)={0x5, @pix_mp={0x8, 0x4000000, 0x55595659, 0x0, 0x3, [{0x1, 0x7}, {0x6}, {0x2, 0x6}, {0x101, 0x80007fff}, {0xffffff80, 0x9}, {0x2, 0x100003}, {0x6, 0xfff}, {0xa, 0x3ff}], 0xce, 0x1, 0x6, 0x3}}) 1.235658268s ago: executing program 1 (id=5791): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000001c000000bca30000000000002403000020feffff620a00fef8ffffff71a400fe000000001f03000000000000e5000600000000002604fdffff02000006010000033800001d13fcff000000007a0a00fe0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000100), 0xffffffffffffff97, 0x10, &(0x7f00000000c0)={0x0, 0x3}, 0xfffffffffffffd27, 0x0, 0xffffffffffffffff, 0x1a}, 0x48) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000100), &(0x7f0000000400)=ANY=[@ANYBLOB="00fba9044a1bc37fff6950acc6f11ca5a6ba544a41e5923cee1c3b89f0ec025f1317f4763515cd7691bd5c3ae68e5e8facc75968e96ad0875ad9f5bbe2fd3e9b6b4f3def9490c450782ee99cefc71004a5fdfd66614ae6e2500278ea83e49926308d550d4acb4d3a472624f4ad0529d39c31e070698daee193e3997365625fc67aefd09c2a911552001a5b8fdb33d3f1fc63450400000000000000054cceb9e49880a65cef0b2df73a40fdd6b89ce96cd8c634abbc47ed4f0d7691dffd476d1845efe0503de20aeca06a7958498a0edff42054de16795c1d1acae4075ddfdd3946e195976e4261b0d9e1a98522ee31325820cec17244cd0441a986265500"/263], 0xa9, 0x1) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x14}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x42, 0x0) read$FUSE(r2, &(0x7f0000006380)={0x2020}, 0x2020) 477.285065ms ago: executing program 4 (id=5792): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$llc_int(r1, 0x10c, 0x5, &(0x7f0000000000), &(0x7f0000000180)=0x4) sendto$inet(r0, &(0x7f0000000040)='\f\x00', 0xffeb, 0x0, &(0x7f0000000340), 0x10) open(&(0x7f0000000080)='./file0\x00', 0x101000, 0xe) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x200100, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) close_range(r0, r2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000140)=0x8b) 448.729256ms ago: executing program 0 (id=5793): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1, 0xffffffffffffffff, 0xfffffffe}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) (async) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012"], 0x3c}}, 0x0) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x2250) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240"], 0xc4}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240"], 0xc4}}, 0x0) sched_setattr(0x0, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000480)=[@nested_amd_vmload={0x182, 0x18, 0x3}, @wr_drn={0x68, 0x20, {0x3, 0xc7}}, @nested_amd_invlpga={0x17d, 0x20, {0x0, 0xdaae}}, @out_dx={0x6a, 0x28, {0x1581, 0x0, 0x1}}, @uexit={0x0, 0x18, 0x2}, @enable_nested={0x12c, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x56, 0x2, 0x4, 0x2}}], 0xe8}) ioctl$KVM_RUN(r5, 0xae80, 0x0) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) (async) syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) r6 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) fcntl$dupfd(r6, 0x0, r6) (async) r7 = fcntl$dupfd(r6, 0x0, r6) r8 = msgget(0x0, 0x1a) msgctl$IPC_INFO(r8, 0x3, &(0x7f0000000100)=""/59) ioctl$USBDEVFS_SUBMITURB(r7, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0xfff7, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$USBDEVFS_REAPURB(r7, 0x4008550c, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, &(0x7f0000000140), &(0x7f0000000000)=""/48}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r0, &(0x7f0000000140), &(0x7f0000000000)=""/48}, 0x20) 140.413414ms ago: executing program 4 (id=5794): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0xa, 0x300) setsockopt$sock_int(r1, 0x1, 0x28, &(0x7f0000000000)=0x1, 0x4) recvmsg(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x2) ioctl$SIOCGSTAMPNS(r1, 0x8907, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1303}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x25}}, @IFLA_IPTUN_6RD_PREFIXLEN={0x6, 0xd, 0xa}]}}}]}, 0x40}}, 0x0) 127.327075ms ago: executing program 1 (id=5795): r0 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000bda000/0x4000)=nil, 0x4000, 0x1000009, 0x80012, r0, 0x80000000) syz_usb_connect(0x3, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c9d1c40899040a50b7e70102030109024400020000000009049700010dd5ce0008240201000000000905000000000000000705a3f6d2fb5b0904"], 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) 93.804488ms ago: executing program 0 (id=5796): socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) landlock_create_ruleset(&(0x7f0000000080)={0x5001, 0x2, 0x1}, 0x18, 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0x3, &(0x7f0000000900)=ANY=[@ANYBLOB="18b4084f290000000000000000000000060000009500000004000000fe0711b3d46bb2f5006dda4d6aaaf0b49272e51e93cb75dcbf66ef9487f397da279159020e195e2fee8af3f708836a7c557ee14eaf44ae1ecc84572443bf7fca0ffb02044ac52a2f81b061db8733093e7577825ab5f6d6accc7cdc9bd04b6f880767091f3b5bc871f4ebb8f1e0ad69d165197a0a66aa5f0ca4e88fe85ac2f899882a1e98a806005bc70f871d1f3ad055889eaee29ae20f23f78b5c03c8bb44ecf21b2dd87aeadb47f49c70c4d7d9c34106452bba95ace096363b1b0b6f8738b1518b284ed337aa088715581b34fdff12d734d2d2ceb55b2c5226589a7e49e6b6d5e8afaee4da504f71d18f70c18bb6254f675c47857bc64ae80637a2d032f487a2d9929cdfe85f01264549f1c374ea6470a35c3930ea9b02d8c5c59c162a38892f08b0e68908c5f2cbf5516f51137de6cc94078330751a51a6ae1be8a1548cd4f3ef90063f8584fd6b86f9e665c23800a65945fa2b434bd7ef251c3ea7470f6ef82fe0e0e54fc939c6b19bc33bfd227ba04a331b81e396bcec2f23051bb1d127651c228d0873c0bf191e41aa3e78015e33308ba7d1955f69c8166966fa4dd1ca3c6248bf656463f34b38f329b0f16870e2663ef5c762d67f"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032400)=""/102378, 0x18fea) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) (async) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="f8000000190001000000000000000000e0000002000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000700000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000100000144000500200106"], 0xf8}}, 0x0) (async) connect$inet(r5, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) (async) sendmmsg$inet(r5, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) r7 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r7}, &(0x7f00000002c0), &(0x7f0000000300)=r2}, 0x20) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r8}, 0x8) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r9, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140800000f0a010229bd7000fcdbdf2503000005"], 0x14}, 0x1, 0x0, 0x0, 0x4000084}, 0x20000000) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000193c0)={0x100, r3, 0x80000}) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000005000070f00000000000008000700", @ANYRES32=r10], 0x24}, 0x1, 0x0, 0x0, 0x4004810}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000", @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002500000018"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r10, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 409.537µs ago: executing program 4 (id=5797): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) syz_open_dev$cec(&(0x7f0000000540), 0x0, 0x60000) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x6) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000080)={0x2, 0x4}, 0x4) syz_emit_ethernet(0xd2, &(0x7f0000000680)=ANY=[@ANYBLOB="0180c2000003bbbbbbbbbbbb86dd6a400000009c1100fe8000000000000000000000000000a2fe801c3c7b15000000000000000000aa4e1d4e20009c90780100000007000000a098f75bcd9a5516f311a8eaa9ce4a38b90000000000f7df0000000000000000674e20c1c38da0a452bae176e96e2b1e08fcde1ee4805fe36ef556ff6cb46fd595915cb48ef75e34272cb58a0edc78aea033a347974dea840918d802fa5f8a1c7c9a75d450fb18d042893597291d77675a63867fef542bcf00000000a6fdd0ce42426859644124c800000000000080c8032187d6da4bec36f2d7740db6e04c5693ab0195a789ab2681009f80a093abd4078254d75eae1da13cc4351210e1c1e2909af54737412718db5934d5729c0ff64f50138b0e58338319dc24ba9f17c29bb5476a829b6fe3b9df01487f4f76"], 0x0) io_setup(0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0x1, 0x5, 0xff) syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x189802) r5 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r5, 0x29, 0x46, 0x0, 0x0) sendmsg$kcm(r5, &(0x7f0000002dc0)={0x0, 0x0, 0x0}, 0x41) syz_emit_ethernet(0x6e, &(0x7f0000000100)=ANY=[@ANYRES16=0x0], 0x0) setxattr$system_posix_acl(0x0, &(0x7f0000000000)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0x10}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x4c014) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000580)={0x401, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0xffffffff], &(0x7f0000000640)=[r8, r7, r7], &(0x7f0000000340), 0x0, 0xffffffffffffffff}) 0s ago: executing program 0 (id=5798): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000000000)=""/46, &(0x7f0000000040)=0x2e) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff"], 0x15) socket$nl_route(0x10, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000840)='{', 0x1}], 0x1}, 0x20048843) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e1301"], 0x16) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) connect$netlink(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x406}}}, 0x7) ioctl$KVM_CAP_HYPERV_SEND_IPI(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)) kernel console output (not intermixed with test programs): xmit 42 [ 1738.048074][ T2078] syz_tun: tun_net_xmit 42 [ 1738.052610][ T2078] syz_tun: tun_net_xmit 42 [ 1738.057123][ T2078] syz_tun: tun_net_xmit 42 [ 1738.061662][ T2078] syz_tun: tun_net_xmit 42 [ 1738.066152][ T2078] syz_tun: tun_net_xmit 42 [ 1738.070663][ T2078] syz_tun: tun_net_xmit 42 [ 1738.075177][ T2078] syz_tun: tun_net_xmit 42 [ 1738.079680][ T2078] syz_tun: tun_net_xmit 42 [ 1738.084201][ T2078] syz_tun: tun_net_xmit 42 [ 1738.088690][ T2078] syz_tun: tun_net_xmit 42 [ 1738.093235][ T2078] syz_tun: tun_net_xmit 42 [ 1738.098146][ T2078] syz_tun: tun_net_xmit 42 [ 1738.102681][ T2078] syz_tun: tun_net_xmit 42 [ 1738.107172][ T2078] syz_tun: tun_net_xmit 42 [ 1738.111659][ T2078] syz_tun: tun_net_xmit 42 [ 1738.116184][ T2078] syz_tun: tun_net_xmit 42 [ 1738.120694][ T2078] syz_tun: tun_net_xmit 42 [ 1738.125207][ T2078] syz_tun: tun_net_xmit 42 [ 1738.129704][ T2078] syz_tun: tun_net_xmit 42 [ 1738.134229][ T2078] syz_tun: tun_net_xmit 42 [ 1738.138718][ T2078] syz_tun: tun_net_xmit 42 [ 1738.143206][ T2078] syz_tun: tun_net_xmit 42 [ 1738.147724][ T2078] syz_tun: tun_net_xmit 42 [ 1738.152223][ T2078] syz_tun: tun_net_xmit 42 [ 1738.156727][ T2078] syz_tun: tun_net_xmit 42 [ 1738.161214][ T2078] syz_tun: tun_net_xmit 42 [ 1738.165719][ T2078] syz_tun: tun_net_xmit 42 [ 1738.170249][ T2078] syz_tun: tun_net_xmit 42 [ 1738.174737][ T2078] syz_tun: tun_net_xmit 42 [ 1738.179246][ T2078] syz_tun: tun_net_xmit 42 [ 1738.183760][ T2078] syz_tun: tun_net_xmit 42 [ 1738.188296][ T2078] syz_tun: tun_net_xmit 42 [ 1738.192785][ T2078] syz_tun: tun_net_xmit 42 [ 1738.197273][ T2078] syz_tun: tun_net_xmit 42 [ 1738.201821][ T2078] syz_tun: tun_net_xmit 42 [ 1738.206743][ T2078] syz_tun: tun_net_xmit 42 [ 1738.211275][ T2078] syz_tun: tun_net_xmit 42 [ 1738.215766][ T2078] syz_tun: tun_net_xmit 42 [ 1738.220361][ T2078] syz_tun: tun_net_xmit 42 [ 1738.224918][ T2078] syz_tun: tun_net_xmit 42 [ 1738.229478][ T2078] syz_tun: tun_net_xmit 42 [ 1738.234048][ T2078] syz_tun: tun_net_xmit 42 [ 1738.238600][ T2078] syz_tun: tun_net_xmit 42 [ 1738.243138][ T2078] syz_tun: tun_net_xmit 42 [ 1738.247645][ T2078] syz_tun: tun_net_xmit 42 [ 1738.252201][ T2078] syz_tun: tun_net_xmit 42 [ 1738.256731][ T2078] syz_tun: tun_net_xmit 42 [ 1738.261225][ T2078] syz_tun: tun_net_xmit 42 [ 1738.265767][ T2078] syz_tun: tun_net_xmit 42 [ 1738.270260][ T2078] syz_tun: tun_net_xmit 42 [ 1738.274812][ T2078] syz_tun: tun_net_xmit 42 [ 1738.279328][ T2078] syz_tun: tun_net_xmit 42 [ 1738.283851][ T2078] syz_tun: tun_net_xmit 42 [ 1738.350051][T13118] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1738.682963][ T5792] usb 6-1: USB disconnect, device number 64 [ 1738.899078][ T2103] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5327'. [ 1738.971265][ T2103] netlink: 'syz.5.5327': attribute type 13 has an invalid length. [ 1738.981289][ T2103] netlink: 'syz.5.5327': attribute type 17 has an invalid length. [ 1739.025218][ T2103] bridge0: left allmulticast mode [ 1739.080179][ T2103] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1739.128405][ T5792] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 1739.389046][ T5792] usb 1-1: Using ep0 maxpacket: 32 [ 1739.396153][ T5792] usb 1-1: config 0 has an invalid interface number: 191 but max is 0 [ 1739.404452][ T5792] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1739.416605][ T5792] usb 1-1: config 0 has no interface number 0 [ 1739.436900][ T5792] usb 1-1: New USB device found, idVendor=0789, idProduct=0160, bcdDevice=2c.d1 [ 1739.447130][ T5792] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1739.457087][ T5792] usb 1-1: Product: syz [ 1739.464762][ T5792] usb 1-1: Manufacturer: syz [ 1739.469530][ T5792] usb 1-1: SerialNumber: syz [ 1739.481988][ T5792] usb 1-1: config 0 descriptor?? [ 1739.491322][ T5792] asix 1-1:0.191: probe with driver asix failed with error -22 [ 1739.887228][ T2097] input: syz1 as /devices/virtual/input/input155 [ 1739.935433][ T2126] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1739.962904][ T5930] syz_tun: tun_net_xmit 110 [ 1739.985194][ T2129] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1740.016096][ T2129] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1740.025617][ T5930] syz_tun: tun_net_xmit 110 [ 1740.141202][ T5930] usb 1-1: USB disconnect, device number 24 [ 1740.575153][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1740.697627][ T2163] tipc: Enabled bearer , priority 0 [ 1740.718247][ T2163] syzkaller0: entered promiscuous mode [ 1740.728087][ T2163] syzkaller0: entered allmulticast mode [ 1740.858984][ T2163] tipc: Resetting bearer [ 1740.877652][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1740.885966][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1741.022932][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1741.031057][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1741.309347][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1741.317461][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1741.335451][ T2162] tipc: Resetting bearer [ 1741.754060][ T2162] tipc: Disabling bearer [ 1742.043971][ T2180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5339'. [ 1742.117282][ T2193] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5343'. [ 1742.185024][ T2193] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1742.227885][ T2193] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1742.314560][ T9] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1742.667615][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 1742.696660][ T2193] .` (unregistering): Released all slaves [ 1742.703219][ T9] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1742.713159][ T9] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1742.723066][ T9] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1742.739463][ T9] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1742.829270][ T9] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1742.868503][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1743.236707][ T2206] netlink: 'syz.0.5346': attribute type 13 has an invalid length. [ 1743.245599][ T2206] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5346'. [ 1743.300485][ T9] usb 6-1: GET_CAPABILITIES returned 0 [ 1743.305977][ T9] usbtmc 6-1:16.0: can't read capabilities [ 1743.362693][ T5792] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1743.469069][ T29] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 1743.648069][ T29] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1743.658340][ T5792] usb 4-1: Using ep0 maxpacket: 32 [ 1743.733187][ T5792] usb 4-1: config 0 has an invalid interface number: 146 but max is 0 [ 1743.733417][ T29] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 1743.759841][ T5792] usb 4-1: config 0 has no interface number 0 [ 1743.774426][ T5792] usb 4-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1743.789500][ T29] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1743.792563][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1743.808519][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1743.817605][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1743.826706][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1743.831641][ T29] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 1743.835792][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1743.857993][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1743.875510][ T5792] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1743.890793][ T5792] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 1743.902653][ T5792] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 1743.912826][ T5792] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 1743.924472][ T5792] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1743.934392][ T5792] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1743.944426][ T5792] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 25391, setting to 1024 [ 1743.955739][ T5792] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1743.965981][ T5792] usb 4-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1743.979469][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1743.987697][ T29] usb 5-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=71.94 [ 1743.988565][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.006934][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.016009][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.025068][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.062156][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.071277][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.080829][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.089930][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.098985][ C0] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1744.117896][ T5792] usb 4-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 1744.127141][ T5792] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1744.135490][ T5792] usb 4-1: Product: syz [ 1744.140718][ T5792] usb 4-1: Manufacturer: syz [ 1744.148763][ T5792] usb 4-1: SerialNumber: syz [ 1744.164630][ T5792] usb 4-1: config 0 descriptor?? [ 1744.166601][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1744.171448][ T2212] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1744.185248][ T2212] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1744.198519][ T5792] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 1744.209389][ T5792] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 1744.250796][ T29] usb 5-1: config 0 descriptor?? [ 1744.285687][ T5792] scsi host1: microtekX6 [ 1744.304364][ T29] ttusbir 5-1:0.0: cannot find expected altsetting [ 1744.568533][ T2195] netlink: 'syz.4.5344': attribute type 1 has an invalid length. [ 1744.580881][ T5792] usb 5-1: USB disconnect, device number 33 [ 1745.080425][ T2237] Process accounting resumed [ 1746.291219][ T2279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1746.376347][ T2279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1746.483959][ T5793] usb 4-1: USB disconnect, device number 17 [ 1746.537010][ T9] usb 6-1: USB disconnect, device number 65 [ 1748.207345][ T2315] netlink: 64 bytes leftover after parsing attributes in process `syz.5.5359'. [ 1748.607249][ T29] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 1748.771249][ T29] usb 1-1: Using ep0 maxpacket: 32 [ 1748.838547][ T2334] netlink: 'syz.1.5361': attribute type 1 has an invalid length. [ 1749.010599][ T29] usb 1-1: New USB device found, idVendor=04e8, idProduct=6601, bcdDevice=81.9b [ 1749.027804][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1749.064362][ T29] usb 1-1: Product: syz [ 1749.072413][ T29] usb 1-1: Manufacturer: syz [ 1749.085866][ T29] usb 1-1: SerialNumber: syz [ 1749.332697][ T2317] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5360'. [ 1749.375264][ T2317] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1749.409327][ T2317] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1749.511336][ T29] usb 1-1: palm_os_4_probe - error -110 getting connection info [ 1749.519104][ T29] visor 1-1:1.0: Handspring Visor / Palm OS converter detected [ 1749.536300][ T2341] syzkaller0: entered promiscuous mode [ 1749.541908][ T2341] syzkaller0: entered allmulticast mode [ 1749.553140][ T2317] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1749.599267][ T2317] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1749.602787][ T29] usb 1-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 1749.627232][ T2317] netlink: 84 bytes leftover after parsing attributes in process `syz.0.5360'. [ 1749.659412][ T29] usb 1-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 1749.688429][ T29] usb 1-1: USB disconnect, device number 25 [ 1749.724063][ T29] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 1749.773516][ T29] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 1749.794111][ T29] visor 1-1:1.0: device disconnected [ 1749.809751][T15065] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1750.849835][T15065] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1750.876040][T15065] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1750.897263][T15065] usb 6-1: Product: syz [ 1750.920433][T15065] usb 6-1: Manufacturer: syz [ 1750.925067][T15065] usb 6-1: SerialNumber: syz [ 1750.945724][T15065] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1750.967405][ T29] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1751.196976][ T9] usb 6-1: USB disconnect, device number 66 [ 1751.252509][ T30] audit: type=1800 audit(1772619851.274:1789): pid=2390 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.5368" name="SYSV00000000" dev="hugetlbfs" ino=10 res=0 errno=0 [ 1751.516009][ T2400] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1752.117644][ T29] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1752.224504][ T5930] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1752.254419][ T29] ath9k_htc: Failed to initialize the device [ 1752.269120][ T9] usb 6-1: ath9k_htc: USB layer deinitialized [ 1752.459119][ T5930] usb 4-1: Using ep0 maxpacket: 8 [ 1752.468672][ T5930] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1752.479044][ T5930] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1752.489244][ T5930] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1752.499221][ T5930] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1752.519950][ T5930] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1752.529704][ T5930] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1752.662822][ T24] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1752.739348][ T2454] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5376'. [ 1752.758293][ T5930] usb 4-1: GET_CAPABILITIES returned 0 [ 1752.765593][ T5930] usbtmc 4-1:16.0: can't read capabilities [ 1752.819313][ T2466] syzkaller0: entered promiscuous mode [ 1752.825017][ T2466] syzkaller0: entered allmulticast mode [ 1752.832048][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1752.841746][ T24] usb 2-1: config 63 has an invalid interface number: 66 but max is 0 [ 1752.850338][ T24] usb 2-1: config 63 contains an unexpected descriptor of type 0x1, skipping [ 1752.859676][ T24] usb 2-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 1752.871644][ T2466] tipc: Enabled bearer , priority 0 [ 1752.879193][ T24] usb 2-1: config 63 has no interface number 0 [ 1752.885694][ T24] usb 2-1: config 63 interface 66 has no altsetting 0 [ 1752.895725][ T24] usb 2-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 1752.908672][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1752.916832][ T24] usb 2-1: Product: syz [ 1752.921223][ T24] usb 2-1: Manufacturer: syz [ 1752.925858][ T24] usb 2-1: SerialNumber: syz [ 1752.977015][ T2466] Cannot find del_set index 3 as target [ 1752.996539][ T9] usb 4-1: USB disconnect, device number 18 [ 1753.002627][ T2465] tipc: Resetting bearer [ 1753.041555][ T2465] tipc: Disabling bearer [ 1753.189143][ T24] uvcvideo 2-1:63.66: Found UVC 5.07 device syz (174f:8acf) [ 1753.197132][ T24] uvcvideo 2-1:63.66: No valid video chain found. [ 1753.210946][ T24] usb 2-1: USB disconnect, device number 32 [ 1753.220156][ T2090] udevd[2090]: setting mode of /dev/bus/usb/002/032 to 020664 failed: No such file or directory [ 1753.249471][ T2090] udevd[2090]: setting owner of /dev/bus/usb/002/032 to uid=0, gid=0 failed: No such file or directory [ 1753.614157][ T5930] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 1754.030228][ T5930] usb 1-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1754.051060][ T5930] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1754.084913][ T5930] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1754.118800][ T2534] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5385'. [ 1754.128079][ T2534] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5385'. [ 1754.137104][ T5930] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1754.159419][ T5930] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1754.184353][ T2510] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1754.187752][ T2534] geneve2: entered promiscuous mode [ 1754.198865][ T2534] geneve2: entered allmulticast mode [ 1754.715317][ T5930] aiptek 1-1:17.0: Aiptek using 400 ms programming speed [ 1754.737470][ T5930] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input161 [ 1754.840706][ T2558] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5387'. [ 1755.258862][ T5930] usb 1-1: USB disconnect, device number 26 [ 1755.264826][ C1] aiptek 1-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1755.795401][ T29] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 1755.944698][ T29] usb 5-1: device descriptor read/64, error -71 [ 1755.990451][ T2604] 9p: Bad value for 'rfdno' [ 1756.201301][ T29] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 1757.387884][ T29] usb 5-1: device descriptor read/64, error -71 [ 1758.297590][ T29] usb usb5-port1: attempt power cycle [ 1758.739569][ T2622] qrtr: Invalid version 255 [ 1758.756240][ T30] audit: type=1400 audit(1772619858.290:1790): avc: denied { read } for pid=2621 comm="syz.1.5399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1758.834012][ T2634] overlay: Bad value for 'redirect_dir' [ 1758.885193][ T29] usb usb5-port1: Cannot enable. Maybe the USB cable is bad? [ 1759.056246][ T29] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 1759.102456][ T29] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 1759.135985][ T29] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 124, setting to 64 [ 1759.173262][ T29] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1759.182352][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1759.197426][ T24] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 1759.296706][ T29] usb 5-1: config 0 descriptor?? [ 1759.515498][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 1759.522397][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1759.533999][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1759.536454][ T2623] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5398'. [ 1759.543817][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8 [ 1759.579487][ T24] usb 1-1: New USB device found, idVendor=056e, idProduct=00fe, bcdDevice= 0.00 [ 1759.589208][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1759.640454][ T2623] netlink: 200 bytes leftover after parsing attributes in process `syz.4.5398'. [ 1759.719581][ T24] usb 1-1: config 0 descriptor?? [ 1760.425388][ T29] ath6kl: Failed to submit usb control message: -110 [ 1760.433422][ T29] ath6kl: unable to send the bmi data to the device: -110 [ 1760.440956][ T29] ath6kl: Unable to send get target info: -110 [ 1760.469225][ T29] ath6kl: Failed to init ath6kl core: -110 [ 1760.487188][ T29] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1762.094384][ T9] usb 5-1: USB disconnect, device number 37 [ 1762.231168][ T24] usbhid 1-1:0.0: can't add hid device: -71 [ 1762.237896][ T24] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1762.460661][ T5792] IPVS: starting estimator thread 0... [ 1762.583385][ T24] usb 1-1: USB disconnect, device number 27 [ 1762.607390][ T2709] netlink: 'syz.0.5407': attribute type 2 has an invalid length. [ 1762.616241][ T2709] netlink: 'syz.0.5407': attribute type 1 has an invalid length. [ 1762.683901][ T2717] syz_tun: tun_net_xmit 74 [ 1762.701194][ T2704] IPVS: using max 82 ests per chain, 196800 per kthread [ 1762.873194][ T5930] syz_tun: tun_net_xmit 106 [ 1763.011173][ T24] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 1763.171731][ T24] usb 1-1: device descriptor read/64, error -71 [ 1763.438814][ T24] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 1763.609962][ T5792] syz_tun: tun_net_xmit 106 [ 1763.621744][ T24] usb 1-1: device descriptor read/64, error -71 [ 1763.738186][ T30] audit: type=1326 audit(1772619862.901:1791): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1763.778120][ T24] usb usb1-port1: attempt power cycle [ 1764.016159][ T30] audit: type=1326 audit(1772619862.901:1792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1764.043569][ T30] audit: type=1326 audit(1772619862.901:1793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1764.234885][ T9] syz_tun: tun_net_xmit 106 [ 1764.270690][ T30] audit: type=1326 audit(1772619862.911:1794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1764.328156][ T30] audit: type=1326 audit(1772619862.911:1795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1764.422433][ T30] audit: type=1326 audit(1772619862.911:1796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1764.491330][ T30] audit: type=1326 audit(1772619862.911:1797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1764.545044][ T24] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 1764.567992][ T30] audit: type=1326 audit(1772619862.911:1798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1764.617914][ T24] usb 1-1: device descriptor read/8, error -71 [ 1764.721791][ T2767] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5413'. [ 1764.832001][ T2767] netlink: 'syz.4.5413': attribute type 13 has an invalid length. [ 1764.840147][ T2767] netlink: 'syz.4.5413': attribute type 17 has an invalid length. [ 1765.016948][ T2767] 8021q: adding VLAN 0 to HW filter on device team0 [ 1765.266825][ T30] audit: type=1326 audit(1772619862.911:1799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1765.645901][ T24] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 1765.677766][ T24] usb 1-1: device descriptor read/8, error -71 [ 1765.692634][ T30] audit: type=1326 audit(1772619862.911:1800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1765.725762][ T30] audit: type=1326 audit(1772619862.911:1801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1765.751036][ T30] audit: type=1326 audit(1772619862.911:1802): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1765.776280][ T30] audit: type=1326 audit(1772619862.920:1803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2748 comm="syz.4.5411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f07bf19c799 code=0x7ffc0000 [ 1765.901990][ T24] usb usb1-port1: unable to enumerate USB device [ 1765.917611][ T2767] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1766.764512][ T2804] input: syz0 as /devices/virtual/input/input162 [ 1767.740086][ T2828] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5425'. [ 1767.749950][ T2830] program syz.3.5425 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1767.760087][ T2830] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5425'. [ 1767.769961][ T2828] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5425'. [ 1767.918217][ T29] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 1768.100028][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 1768.204974][ T29] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 1768.345337][ T29] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1768.375575][ T29] usb 2-1: config 0 has no interface number 0 [ 1768.398809][ T29] usb 2-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1768.738931][ T29] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1768.751454][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1768.761255][ T29] usb 2-1: Product: syz [ 1769.423130][ T29] usb 2-1: Manufacturer: syz [ 1769.436606][ T29] usb 2-1: SerialNumber: syz [ 1769.801446][ T29] usb 2-1: config 0 descriptor?? [ 1769.822527][ T29] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1770.063370][ T2826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1770.072073][ T2826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1770.083694][ T29] usb 2-1: qt2_setup_urbs - submit read urb failed -8 [ 1770.090770][ T29] quatech2 2-1:0.51: probe with driver quatech2 failed with error -8 [ 1770.138552][ T2894] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5431'. [ 1770.366867][ T2900] tipc: Cannot configure node identity twice [ 1770.471501][ T2920] unsupported nlmsg_type 40 [ 1770.751152][ T29] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 1771.027046][ T29] usb 6-1: too many configurations: 102, using maximum allowed: 8 [ 1771.046106][ T29] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 1771.055808][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1771.065090][ T29] usb 6-1: Product: syz [ 1771.069862][ T29] usb 6-1: Manufacturer: syz [ 1771.074671][ T29] usb 6-1: SerialNumber: syz [ 1771.144073][ T2947] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 1771.545675][ T5792] usb 2-1: USB disconnect, device number 33 [ 1771.853327][T13118] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1772.525888][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 1772.525907][ T30] audit: type=1400 audit(1772619870.787:1818): avc: denied { shutdown } for pid=2961 comm="syz.1.5442" lport=9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1772.590732][ T5793] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 1772.597057][ T29] rtl8150 6-1:1.0: couldn't reset the device [ 1772.613496][ T29] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 1772.634601][ T29] usb 6-1: USB disconnect, device number 67 [ 1772.787378][ T5793] usb 1-1: device descriptor read/64, error -71 [ 1773.445907][ T5793] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 1774.514242][ T5793] usb 1-1: device descriptor read/64, error -71 [ 1774.674473][ T5793] usb usb1-port1: attempt power cycle [ 1775.325612][ T3018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1775.365069][ T3018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1775.476743][ T5793] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 1775.516493][ T5793] usb 1-1: device descriptor read/8, error -71 [ 1776.278468][ T29] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 1776.597732][ T29] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1776.677503][ T3063] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1776.711720][ T3063] tipc: Enabled bearer , priority 10 [ 1776.711927][ T29] usb 2-1: config 63 has an invalid interface number: 66 but max is 0 [ 1776.728753][ T29] usb 2-1: config 63 has an invalid descriptor of length 128, skipping remainder of the config [ 1776.740616][ T29] usb 2-1: config 63 has no interface number 0 [ 1776.747019][ T29] usb 2-1: config 63 interface 66 has no altsetting 0 [ 1776.801049][ T29] usb 2-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 1776.812994][ T3068] input: syz1 as /devices/virtual/input/input163 [ 1776.820696][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1776.829195][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1776.855491][ T29] usb 2-1: Product: syz [ 1776.866460][ T29] usb 2-1: Manufacturer: syz [ 1776.885657][ T29] usb 2-1: SerialNumber: syz [ 1776.983756][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1777.133414][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1777.166008][ T5793] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 1777.218942][ T5792] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 1777.258580][ T3087] dummy0: entered promiscuous mode [ 1777.265190][ T3087] macsec2: entered allmulticast mode [ 1777.270578][ T3087] dummy0: entered allmulticast mode [ 1777.283142][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1777.293647][ T3087] dummy0: left allmulticast mode [ 1777.298948][ T3087] dummy0: left promiscuous mode [ 1777.432757][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1777.454951][ T5930] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1777.518348][ T5793] usb 4-1: device descriptor read/64, error -71 [ 1777.534360][ T5792] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1777.543014][ T5792] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1777.553700][ T5792] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1777.569734][ T5792] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1777.582512][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1777.588785][ T5792] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1777.603428][ T5792] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1777.622139][ T5792] usb 5-1: Product: syz [ 1777.626440][ T5792] usb 5-1: Manufacturer: syz [ 1777.650862][ T5792] cdc_wdm 5-1:1.0: skipping garbage [ 1777.656105][ T5792] cdc_wdm 5-1:1.0: skipping garbage [ 1777.661815][ T5792] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1777.725322][ T5930] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1777.733020][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1777.755685][ T5930] usb 6-1: config 63 has an invalid interface number: 66 but max is 0 [ 1777.764385][ T5930] usb 6-1: config 63 has an invalid descriptor of length 64, skipping remainder of the config [ 1777.774688][ T5930] usb 6-1: config 63 has no interface number 0 [ 1777.781087][ T5930] usb 6-1: config 63 interface 66 has no altsetting 0 [ 1777.796289][ T5793] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 1777.810050][ T5930] usb 6-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 1777.833135][ T5930] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1777.846996][ T5930] usb 6-1: Product: syz [ 1777.852116][ T5930] usb 6-1: Manufacturer: syz [ 1777.857796][ T5930] usb 6-1: SerialNumber: syz [ 1777.881819][ T24] tipc: Node number set to 1432629061 [ 1777.910170][ T29] uvcvideo 2-1:63.66: probe with driver uvcvideo failed with error -22 [ 1777.913784][ T3078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1777.924773][ T29] usb 2-1: USB disconnect, device number 34 [ 1777.931034][ T3078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1777.943194][ T5793] usb 4-1: device descriptor read/64, error -71 [ 1777.962803][ T5792] usb 5-1: USB disconnect, device number 38 [ 1778.031732][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1778.064011][ T5793] usb usb4-port1: attempt power cycle [ 1778.100835][ T5930] uvcvideo 6-1:63.66: probe with driver uvcvideo failed with error -22 [ 1778.114158][ T5930] usb 6-1: USB disconnect, device number 68 [ 1778.277505][ T10] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 1778.330784][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1778.437734][ T5793] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 1778.447308][ T10] usb 1-1: config 0 has an invalid interface number: 113 but max is 0 [ 1778.455764][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1778.466151][ T10] usb 1-1: config 0 has no interface number 0 [ 1778.472479][ T5793] usb 4-1: device descriptor read/8, error -71 [ 1778.488312][ T10] usb 1-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1778.498774][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1778.507001][ T10] usb 1-1: Product: syz [ 1778.511212][ T10] usb 1-1: Manufacturer: syz [ 1778.517901][ T10] usb 1-1: SerialNumber: syz [ 1778.525894][ T10] usb 1-1: config 0 descriptor?? [ 1778.543207][ T10] pn533_usb 1-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1778.719560][ T3144] FAULT_INJECTION: forcing a failure. [ 1778.719560][ T3144] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1778.758825][ T5793] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 1779.068093][ T3144] CPU: 1 UID: 0 PID: 3144 Comm: syz.4.5464 Tainted: G L syzkaller #0 PREEMPT(full) [ 1779.068121][ T3144] Tainted: [L]=SOFTLOCKUP [ 1779.068127][ T3144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1779.068138][ T3144] Call Trace: [ 1779.068145][ T3144] [ 1779.068153][ T3144] dump_stack_lvl+0x100/0x190 [ 1779.068183][ T3144] should_fail_ex.cold+0x5/0xa [ 1779.068204][ T3144] _copy_to_user+0x32/0xd0 [ 1779.068228][ T3144] msr_read+0x14e/0x250 [ 1779.068253][ T3144] ? __pfx_msr_read+0x10/0x10 [ 1779.068273][ T3144] ? bpf_lsm_file_permission+0x9/0x10 [ 1779.068302][ T3144] ? security_file_permission+0x76/0x210 [ 1779.068324][ T3144] ? rw_verify_area+0xce/0x6d0 [ 1779.068346][ T3144] ? __pfx_msr_read+0x10/0x10 [ 1779.068367][ T3144] vfs_read+0x1e4/0xb30 [ 1779.068394][ T3144] ? __pfx_vfs_read+0x10/0x10 [ 1779.068417][ T3144] ? find_held_lock+0x2b/0x80 [ 1779.068438][ T3144] ? __fget_files+0x215/0x3d0 [ 1779.068455][ T3144] ? __fget_files+0x215/0x3d0 [ 1779.068475][ T3144] ? __fget_files+0x21f/0x3d0 [ 1779.068498][ T3144] ksys_read+0x12a/0x250 [ 1779.068521][ T3144] ? __pfx_ksys_read+0x10/0x10 [ 1779.068551][ T3144] do_syscall_64+0x106/0xf80 [ 1779.068567][ T3144] ? clear_bhb_loop+0x40/0x90 [ 1779.068588][ T3144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1779.068605][ T3144] RIP: 0033:0x7f07bf19c799 [ 1779.068620][ T3144] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1779.068636][ T3144] RSP: 002b:00007f07c00b3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1779.068652][ T3144] RAX: ffffffffffffffda RBX: 00007f07bf415fa0 RCX: 00007f07bf19c799 [ 1779.068668][ T3144] RDX: 0000000000018ff8 RSI: 0000200000002700 RDI: 0000000000000003 [ 1779.068679][ T3144] RBP: 00007f07c00b3090 R08: 0000000000000000 R09: 0000000000000000 [ 1779.068689][ T3144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1779.068698][ T3144] R13: 00007f07bf416038 R14: 00007f07bf415fa0 R15: 00007ffc9ba453b8 [ 1779.068719][ T3144] [ 1779.272337][ T5793] usb 4-1: device descriptor read/8, error -71 [ 1779.308501][ T30] audit: type=1800 audit(1772619877.297:1819): pid=3151 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.5464" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1779.490537][ T5793] usb usb4-port1: unable to enumerate USB device [ 1779.568915][ T24] usb 1-1: USB disconnect, device number 36 [ 1779.870301][ T5793] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 1779.958110][ T3174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5469'. [ 1779.970163][ T3174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5469'. [ 1779.982989][ T3174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5469'. [ 1779.993450][ T3174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5469'. [ 1780.004764][ T3174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5469'. [ 1780.233683][ T5793] usb 2-1: Using ep0 maxpacket: 8 [ 1780.270972][ T5793] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 1780.286737][ T5793] usb 2-1: config 179 has no interface number 0 [ 1780.554558][ T5793] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1780.629445][ T5793] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1780.667906][ T5793] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1780.699121][ T3196] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5473'. [ 1780.737695][ T30] audit: type=1800 audit(1772619878.859:1820): pid=3198 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.5472" name="SYSV00000000" dev="hugetlbfs" ino=10 res=0 errno=0 [ 1780.760830][ T5793] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1780.786842][ T5793] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1780.825787][ T5793] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1780.851992][ T5793] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1780.888707][ T3163] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1781.693534][ T3226] netlink: 'syz.0.5475': attribute type 4 has an invalid length. [ 1781.857746][ T3228] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1782.232853][ C1] net_ratelimit: 3 callbacks suppressed [ 1782.232872][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1782.334556][ T3214] netlink: 'syz.0.5475': attribute type 4 has an invalid length. [ 1782.350522][ T5930] lo speed is unknown, defaulting to 1000 [ 1782.357397][ T24] lo speed is unknown, defaulting to 1000 [ 1782.603757][ T5792] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input164 [ 1782.801508][ T3242] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5479'. [ 1783.123984][ T24] usb 2-1: USB disconnect, device number 35 [ 1783.123984][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1783.124031][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1783.334568][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1783.459244][ T3261] Scaler: ================= START STATUS ================= [ 1783.481492][ T3261] Scaler: ================== END STATUS ================== [ 1783.529127][ T3261] input: syz1 as /devices/virtual/input/input165 [ 1783.629649][ T3248] tmpfs: Unknown parameter 'sS%' [ 1783.664356][ T30] audit: type=1800 audit(1772619881.591:1821): pid=3274 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.5483" name="SYSV00000000" dev="hugetlbfs" ino=4 res=0 errno=0 [ 1783.811471][ T3277] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5485'. [ 1784.336159][ T5792] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 1784.456472][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1784.554253][ T5792] usb 2-1: New USB device found, idVendor=093a, idProduct=2601, bcdDevice= 8.8f [ 1784.868776][ T5792] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1784.878816][ T5792] usb 2-1: config 0 descriptor?? [ 1784.894668][ T5792] gspca_main: pac7311-2.14.0 probing 093a:2601 [ 1785.154924][ T5793] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1785.180073][ T5792] gspca_pac7311: reg_w() failed index 0xff, value 0x01, error -71 [ 1785.188405][ T5792] pac7311 2-1:0.0: probe with driver pac7311 failed with error -71 [ 1785.199548][ T5792] usb 2-1: USB disconnect, device number 36 [ 1785.323679][ T5793] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1785.333914][ T5793] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1785.342924][ T5793] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1785.353315][ T5793] usb 4-1: config 0 descriptor?? [ 1785.362615][ T5793] pwc: Askey VC010 type 2 USB webcam detected. [ 1785.546946][ T5930] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 1785.557622][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1785.724588][ T3319] netlink: 'syz.4.5491': attribute type 1 has an invalid length. [ 1785.794552][ T5793] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1785.802155][ T5793] pwc: recv_control_msg error -32 req 02 val 2700 [ 1785.811172][ T5793] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1785.878603][ T5793] pwc: recv_control_msg error -32 req 04 val 1000 [ 1785.888132][ T3367] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1785.898438][ T5793] pwc: recv_control_msg error -32 req 04 val 1300 [ 1785.905576][ T3367] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 1785.913475][ T5793] pwc: recv_control_msg error -32 req 04 val 1400 [ 1785.920629][ T5793] pwc: recv_control_msg error -32 req 02 val 2000 [ 1785.932426][ T5793] pwc: recv_control_msg error -32 req 02 val 2100 [ 1785.940881][ T5793] pwc: recv_control_msg error -32 req 04 val 1500 [ 1785.948064][ T5793] pwc: recv_control_msg error -32 req 02 val 2500 [ 1785.955194][ T5793] pwc: recv_control_msg error -32 req 02 val 2400 [ 1785.962289][ T5793] pwc: recv_control_msg error -32 req 02 val 2600 [ 1785.969396][ T5793] pwc: recv_control_msg error -32 req 02 val 2900 [ 1785.976790][ T5793] pwc: recv_control_msg error -32 req 02 val 2800 [ 1785.992491][ T3381] input: syz1 as /devices/virtual/input/input166 [ 1786.669556][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1787.121307][ T5793] pwc: recv_control_msg error -71 req 04 val 1200 [ 1787.129705][ T5793] pwc: Registered as video103. [ 1787.138570][ T5793] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input167 [ 1787.165607][ T3384] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5494'. [ 1787.546892][ T3384] netlink: 'syz.1.5494': attribute type 13 has an invalid length. [ 1787.560653][ T5793] usb 4-1: USB disconnect, device number 23 [ 1787.592035][ T3384] netlink: 'syz.1.5494': attribute type 17 has an invalid length. [ 1787.733142][ T3384] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1787.783200][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1788.441212][ T3432] tmpfs: Unknown parameter 'sS%' [ 1788.689367][ T3437] binder: 3436:3437 ioctl 1 200000000180 returned -22 [ 1788.709351][ T5930] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1788.728689][ T5930] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1788.782512][ T5930] usb 5-1: can't read configurations, error -71 [ 1788.903770][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1788.924475][ T3450] xt_recent: Unsupported userspace flags (000000de) [ 1789.410027][ T24] usb 6-1: new full-speed USB device number 69 using dummy_hcd [ 1789.623923][ T24] usb 6-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=5f.b1 [ 1789.641703][ T24] usb 6-1: New USB device strings: Mfr=137, Product=72, SerialNumber=3 [ 1789.662827][ T24] usb 6-1: Product: syz [ 1790.015622][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1790.068278][ T24] usb 6-1: Manufacturer: syz [ 1790.084160][ T24] usb 6-1: SerialNumber: syz [ 1790.125379][ T24] usb 6-1: config 0 descriptor?? [ 1790.139963][ T24] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1790.160932][ T24] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1790.208208][ T29] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 1790.229646][ T3488] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5511'. [ 1790.240855][ T3488] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5511'. [ 1790.250628][ T3488] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5511'. [ 1790.262882][ T3488] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5511'. [ 1790.274117][ T3488] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5511'. [ 1790.275454][ T24] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) error while loading driver (-19) [ 1790.475566][ T29] usb 2-1: config 0 has an invalid interface number: 113 but max is 0 [ 1790.614098][ T29] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1790.643375][ T29] usb 2-1: config 0 has no interface number 0 [ 1790.653653][ T3494] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 1790.655541][ T29] usb 2-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1790.712517][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1790.726127][ T5793] usb 6-1: USB disconnect, device number 69 [ 1790.729260][ T29] usb 2-1: Product: syz [ 1790.737831][ T29] usb 2-1: Manufacturer: syz [ 1790.761112][ T29] usb 2-1: SerialNumber: syz [ 1790.769922][ T3502] syzkaller0: entered promiscuous mode [ 1790.783010][ T3502] syzkaller0: entered allmulticast mode [ 1790.783471][ T29] usb 2-1: config 0 descriptor?? [ 1790.797529][ T3502] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1790.798663][ T29] pn533_usb 2-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1790.996728][ T5792] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 1791.034739][ T3474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1791.044750][ T3474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1791.057279][ T29] usb 2-1: USB disconnect, device number 37 [ 1791.116728][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1791.155573][ T3522] No such timeout policy "syz1" [ 1791.566193][ T5792] usb 1-1: Using ep0 maxpacket: 8 [ 1791.573255][ T5792] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1791.586347][ T5792] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1791.596207][ T5792] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1791.596236][ T5792] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1791.596279][ T5792] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1791.596305][ T5792] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1791.869600][ T3532] tmpfs: Unknown parameter 'sS%' [ 1792.239242][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1792.600927][ T5792] usb 1-1: GET_CAPABILITIES returned 0 [ 1792.600954][ T5792] usbtmc 1-1:16.0: can't read capabilities [ 1793.340386][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1793.847530][ T3563] macvlan0: entered promiscuous mode [ 1793.882041][ T3563] macvlan0: left allmulticast mode [ 1793.902895][ T3563] netlink: 'syz.5.5521': attribute type 1 has an invalid length. [ 1793.950150][ T3563] netlink: 'syz.5.5521': attribute type 2 has an invalid length. [ 1794.068288][ T5930] usb 1-1: USB disconnect, device number 37 [ 1794.329980][ T3575] lo speed is unknown, defaulting to 1000 [ 1794.332535][ T3576] syzkaller0: entered promiscuous mode [ 1794.352899][ T3576] syzkaller0: entered allmulticast mode [ 1794.375133][ T3576] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1794.452310][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1794.570039][ T5930] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1794.781327][ T5930] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1794.814408][ T5930] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1794.858761][ T5930] usb 2-1: config 0 descriptor?? [ 1795.012898][ T3610] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5528'. [ 1795.487726][ T29] usb 6-1: new full-speed USB device number 70 using dummy_hcd [ 1795.564071][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1795.578810][ T3619] tmpfs: Unknown parameter 'vuge' [ 1796.297551][ T29] usb 6-1: config 0 has an invalid interface number: 113 but max is 0 [ 1796.675988][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1797.172572][ T3619] fuse: Unknown parameter '0x0000000000000008' [ 1797.202328][ T29] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1797.304440][ T3575] lo speed is unknown, defaulting to 1000 [ 1797.375218][ T29] usb 6-1: config 0 has no interface number 0 [ 1797.467466][ T29] usb 6-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1797.490296][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1797.507842][ T29] usb 6-1: Product: syz [ 1797.531540][ T29] usb 6-1: Manufacturer: syz [ 1797.569120][ T29] usb 6-1: SerialNumber: syz [ 1797.588654][ T29] usb 6-1: config 0 descriptor?? [ 1797.609515][ T29] pn533_usb 6-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1797.689888][ T3658] syzkaller0: entered promiscuous mode [ 1797.696180][ T3658] syzkaller0: entered allmulticast mode [ 1797.787787][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1798.454765][ T5930] usb 2-1: Cannot set autoneg [ 1798.469701][ T5930] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 1798.503195][ T5930] usb 2-1: USB disconnect, device number 38 [ 1798.524971][ T3608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1798.899592][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1799.621670][ T3608] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1799.719400][ T5793] usb 6-1: USB disconnect, device number 70 [ 1800.011331][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1801.123161][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1802.002217][ T3709] tmpfs: Unknown parameter 'sS%' [ 1802.245657][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1803.346827][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1803.729892][ T3709] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1803.739941][ T3709] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1803.749824][ T3709] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1804.458710][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1804.588752][ T3749] netlink: 'syz.1.5541': attribute type 4 has an invalid length. [ 1805.134724][ T3751] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.5544'. [ 1805.570515][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1806.259929][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1806.283208][ T10] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 1806.375782][ T3773] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5549'. [ 1806.407157][ T3773] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5549'. [ 1806.417990][ T3773] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5549'. [ 1806.428619][ T3773] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5549'. [ 1806.438158][ T3773] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5549'. [ 1806.629604][ T10] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 1806.641282][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1806.658354][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1806.682281][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1806.722557][ T3781] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5547'. [ 1806.796787][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1806.808567][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1806.825588][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1806.952964][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1806.971549][ T29] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1807.000372][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1807.026896][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1807.038045][ T5792] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1807.117454][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1807.127454][ T30] audit: type=1800 audit(1772619903.545:1822): pid=3781 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.5547" name="SYSV00000000" dev="hugetlbfs" ino=12 res=0 errno=0 [ 1807.150336][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1807.178517][ T29] usb 4-1: Using ep0 maxpacket: 16 [ 1807.185212][ T29] usb 4-1: config index 0 descriptor too short (expected 16456, got 72) [ 1807.189379][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1807.193551][ T29] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 1807.193576][ T29] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 1807.193597][ T29] usb 4-1: config 0 has an invalid interface number: 125 but max is 1 [ 1807.215980][ T5792] usb 6-1: Using ep0 maxpacket: 16 [ 1807.248658][ T29] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1807.257739][ T29] usb 4-1: config 0 has no interface number 0 [ 1807.258676][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1807.268660][ T29] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 1807.288336][ T29] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 1807.293055][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1807.305573][ T29] usb 4-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1807.307231][ T5792] usb 6-1: config 1 has an invalid interface number: 124 but max is 0 [ 1807.318332][ T29] usb 4-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1807.325394][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1807.338726][ T29] usb 4-1: config 0 interface 125 has no altsetting 0 [ 1807.349343][ T5792] usb 6-1: config 1 has no interface number 0 [ 1807.356430][ T29] usb 4-1: config 0 interface 125 has no altsetting 2 [ 1807.375536][ T5792] usb 6-1: config 1 interface 124 has no altsetting 0 [ 1807.387571][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1807.398980][ T3796] tmpfs: Unknown parameter 'sS%' [ 1807.413086][ T5792] usb 6-1: New USB device found, idVendor=0846, idProduct=5f00, bcdDevice=56.14 [ 1807.500726][ T5792] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1807.502228][T13120] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1807.741143][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1807.741188][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1807.741212][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1807.742030][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1807.742067][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1807.794213][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1807.801668][ T5792] usb 6-1: Product: syz [ 1807.801691][ T5792] usb 6-1: Manufacturer: syz [ 1807.801707][ T5792] usb 6-1: SerialNumber: syz [ 1807.812316][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1807.865324][ T29] usb 4-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 1807.866079][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1807.876098][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1807.884618][ T10] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1807.901035][ T29] usb 4-1: Product: syz [ 1807.905090][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1807.910025][ T29] usb 4-1: Manufacturer: syz [ 1807.919213][ T10] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1807.929817][ T10] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1807.930704][ T29] usb 4-1: SerialNumber: syz [ 1807.939098][ T10] usb 1-1: Product: syz [ 1807.947725][ T10] usb 1-1: Manufacturer: syz [ 1807.952347][ T10] usb 1-1: SerialNumber: syz [ 1807.958097][ T29] usb 4-1: config 0 descriptor?? [ 1807.977635][ T29] usb 4-1: selecting invalid altsetting 2 [ 1807.999918][ T10] usb 1-1: config 0 descriptor?? [ 1808.019872][ T10] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0 [ 1808.058116][ T3771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1808.089114][ T3771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1808.342411][ T24] usb 1-1: USB disconnect, device number 38 [ 1808.354597][ T24] yurex 1-1:0.0: USB YUREX #0 now disconnected [ 1808.618423][ T3838] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5558'. [ 1808.682262][ C1] usb 4-1: async_complete: urb error -71 [ 1808.688025][ C1] usb 4-1: async_complete: urb error -71 [ 1808.693745][ C1] usb 4-1: async_complete: urb error -71 [ 1808.726743][ T3771] SELinux: failed to load policy [ 1808.733642][ T29] get_1284_register: usb error -71 [ 1808.740308][ T29] uss720 4-1:0.125: probe with driver uss720 failed with error -71 [ 1808.776932][ T29] usb 4-1: USB disconnect, device number 24 [ 1808.845687][ T5792] usb 6-1: Could not find all expected endpoints [ 1808.887540][ T5792] usb 6-1: USB disconnect, device number 71 [ 1808.905930][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1809.510577][ T3863] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5560'. [ 1809.527926][ T3863] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5560'. [ 1810.028422][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1810.502263][ T3898] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5569'. [ 1811.129562][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1811.984589][ T3891] tmpfs: Unknown parameter 'sS%' [ 1812.241394][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1812.543915][ T29] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 1813.092975][ T3919] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5571'. [ 1813.118023][ T29] usb 5-1: device descriptor read/64, error -71 [ 1813.353216][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1813.452259][ T3926] netlink: 'syz.1.5572': attribute type 10 has an invalid length. [ 1813.481648][ T5818] Bluetooth: hci5: unexpected event for opcode 0x2003 [ 1813.567790][ T29] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 1813.735225][ T3936] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5576'. [ 1814.465237][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1814.606302][ T5792] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1815.576840][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1815.754283][ T3962] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1815.801357][ T5792] usb 6-1: Using ep0 maxpacket: 16 [ 1815.815725][ T29] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 1816.221559][ T29] usb 5-1: device descriptor read/64, error -71 [ 1816.475067][ T29] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 1816.649318][ T5792] usb 6-1: config 1 has an invalid interface number: 124 but max is 0 [ 1816.664573][ T5792] usb 6-1: config 1 has no interface number 0 [ 1816.677311][ T5792] usb 6-1: config 1 interface 124 has no altsetting 0 [ 1816.687916][ T5792] usb 6-1: New USB device found, idVendor=0846, idProduct=5f00, bcdDevice=56.14 [ 1816.697693][ T5792] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1816.699361][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1816.705760][ T5792] usb 6-1: Product: syz [ 1816.734360][ T5792] usb 6-1: Manufacturer: syz [ 1816.889669][ T5792] usb 6-1: SerialNumber: syz [ 1816.905447][ T29] usb 5-1: device descriptor read/64, error -71 [ 1817.098405][ T29] usb usb5-port1: attempt power cycle [ 1817.166026][ T5792] usb 6-1: Could not find all expected endpoints [ 1817.474161][ T5792] usb 6-1: USB disconnect, device number 72 [ 1817.501221][ T29] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 1817.560982][ T29] usb 5-1: device descriptor read/8, error -71 [ 1817.723791][ T3991] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5583'. [ 1817.811186][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1817.856266][ T5885] Process accounting resumed [ 1818.912397][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1819.856066][ T30] audit: type=1400 audit(1772619915.452:1823): avc: denied { write } for pid=4002 comm="syz.0.5585" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1820.035897][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1820.107344][ T4007] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5585'. [ 1821.026826][ T4015] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5587'. [ 1821.146738][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1821.229424][ T30] audit: type=1326 audit(1772619916.724:1824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.327827][ T30] audit: type=1326 audit(1772619916.762:1825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.432113][ T30] audit: type=1326 audit(1772619916.808:1826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.534703][ T4020] SELinux: failed to load policy [ 1821.553240][ T30] audit: type=1326 audit(1772619916.808:1827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.649278][ T30] audit: type=1326 audit(1772619916.808:1828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.693664][ T5792] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1821.725052][ T30] audit: type=1326 audit(1772619916.808:1829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.799046][ T30] audit: type=1326 audit(1772619916.808:1830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.810309][ T4031] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5591'. [ 1821.908250][ T30] audit: type=1326 audit(1772619916.808:1831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.943024][ T30] audit: type=1326 audit(1772619916.808:1832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4019 comm="syz.0.5588" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f054579c799 code=0x7ffc0000 [ 1821.991360][ T5792] usb 6-1: Using ep0 maxpacket: 8 [ 1822.000002][ T5792] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1822.030235][ T5792] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1822.065251][ T5792] usb 6-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 1822.109313][ T5792] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1822.132318][ T5792] usb 6-1: Product: syz [ 1822.148187][ T5792] usb 6-1: Manufacturer: syz [ 1822.247807][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1822.493900][ T10] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1822.588569][ T5792] usb 6-1: SerialNumber: syz [ 1822.795035][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1822.814505][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1822.849414][ T10] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1822.877519][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1822.886172][ T5792] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1822.893229][ T5792] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1822.900021][ T10] usb 2-1: SerialNumber: syz [ 1823.012456][ T5792] usb 6-1: USB disconnect, device number 73 [ 1823.140710][ T4037] netlink: 'syz.1.5592': attribute type 23 has an invalid length. [ 1823.359675][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1824.471874][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1824.593806][ T4110] netlink: 200 bytes leftover after parsing attributes in process `syz.4.5601'. [ 1825.583268][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1826.084212][ T10] usb 2-1: 0:2 : does not exist [ 1826.140491][ T10] usb 2-1: unit 5: unexpected type 0x0d [ 1826.284367][ T10] usb 2-1: USB disconnect, device number 39 [ 1826.695540][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1826.819561][ T3761] udevd[3761]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1827.497877][ T29] usb 1-1: new low-speed USB device number 39 using dummy_hcd [ 1827.807131][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1827.819195][ T29] usb 1-1: No LPM exit latency info found, disabling LPM. [ 1827.847603][ T29] usb 1-1: config 6 has an invalid interface number: 49 but max is 0 [ 1827.945178][ T4174] input: syz0 as /devices/virtual/input/input169 [ 1828.093820][ T29] usb 1-1: config 6 has an invalid interface number: 123 but max is 0 [ 1828.134622][ T29] usb 1-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 1828.258021][ T29] usb 1-1: config 6 has no interface number 0 [ 1828.264697][ T29] usb 1-1: config 6 has no interface number 1 [ 1828.271281][ T29] usb 1-1: config 6 interface 49 altsetting 8 endpoint 0xC has invalid maxpacket 512, setting to 8 [ 1828.282083][ T29] usb 1-1: config 6 interface 49 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 1828.295605][ T29] usb 1-1: too many endpoints for config 6 interface 123 altsetting 12: 57, using maximum allowed: 30 [ 1828.307725][ T29] usb 1-1: config 6 interface 123 altsetting 12 endpoint 0x6 has invalid maxpacket 512, setting to 8 [ 1828.879848][ T29] usb 1-1: config 6 interface 123 altsetting 12 endpoint 0x3 has invalid maxpacket 64, setting to 8 [ 1828.918809][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1828.976145][ T29] usb 1-1: config 6 interface 123 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 57 [ 1828.992796][ T29] usb 1-1: config 6 interface 49 has no altsetting 0 [ 1829.000653][ T29] usb 1-1: config 6 interface 123 has no altsetting 0 [ 1829.168922][ T30] kauditd_printk_skb: 49 callbacks suppressed [ 1829.168940][ T30] audit: type=1400 audit(1772619924.161:1882): avc: denied { write } for pid=4187 comm="syz.4.5617" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 1829.468066][ T4193] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1829.476178][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1829.491542][ T4190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1829.537869][T30069] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1829.550591][T30069] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1829.560337][T30069] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1829.562774][ T4190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1829.584669][T30069] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1829.593867][T30069] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1829.652840][ T4200] lo speed is unknown, defaulting to 1000 [ 1829.699249][ T5930] usb 6-1: new full-speed USB device number 74 using dummy_hcd [ 1829.837484][ T4212] loop2: detected capacity change from 0 to 7 [ 1829.843955][ T5930] usb 6-1: device descriptor read/64, error -71 [ 1829.852353][ T4212] Dev loop2: unable to read RDB block 7 [ 1829.858406][ T4212] loop2: AHDI p1 p2 p3 [ 1829.864216][ T4212] loop2: partition table partially beyond EOD, truncated [ 1829.878660][ T4212] loop2: p1 start 1601398130 is beyond EOD, truncated [ 1829.896810][ T4212] loop2: p2 start 1702059890 is beyond EOD, truncated [ 1829.917306][ T4200] lo speed is unknown, defaulting to 1000 [ 1830.030558][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1830.105432][ T5930] usb 6-1: new full-speed USB device number 75 using dummy_hcd [ 1830.265930][ T5930] usb 6-1: device descriptor read/64, error -71 [ 1830.265944][ T10] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1830.324731][ T29] usb 1-1: New USB device found, idVendor=12d1, idProduct=1432, bcdDevice= 0.00 [ 1830.334005][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1830.402991][ T5930] usb usb6-port1: attempt power cycle [ 1830.606257][ T29] usb 1-1: can't set config #6, error -71 [ 1830.621946][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1830.640290][ T29] usb 1-1: USB disconnect, device number 39 [ 1830.641126][ T10] usb 2-1: config 63 has an invalid interface number: 66 but max is 0 [ 1830.677234][ T4200] chnl_net:caif_netlink_parms(): no params data found [ 1830.702983][ T10] usb 2-1: config 63 has an invalid descriptor of length 47, skipping remainder of the config [ 1830.721925][ T10] usb 2-1: config 63 has no interface number 0 [ 1830.728685][ T10] usb 2-1: config 63 interface 66 has no altsetting 0 [ 1830.743796][ T10] usb 2-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 1830.762157][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1830.770490][ T10] usb 2-1: Product: syz [ 1830.775425][ T10] usb 2-1: Manufacturer: syz [ 1830.782197][ T10] usb 2-1: SerialNumber: syz [ 1830.883947][ T4200] bridge0: port 1(bridge_slave_0) entered blocking state [ 1830.894680][ T4200] bridge0: port 1(bridge_slave_0) entered disabled state [ 1830.902263][ T4200] bridge_slave_0: entered allmulticast mode [ 1830.911057][ T4200] bridge_slave_0: entered promiscuous mode [ 1830.920101][ T4200] bridge0: port 2(bridge_slave_1) entered blocking state [ 1830.929654][ T4200] bridge0: port 2(bridge_slave_1) entered disabled state [ 1830.937025][ T4200] bridge_slave_1: entered allmulticast mode [ 1830.946971][ T4200] bridge_slave_1: entered promiscuous mode [ 1830.982855][ T5930] usb 6-1: new full-speed USB device number 76 using dummy_hcd [ 1831.003907][ T5930] usb 6-1: device descriptor read/8, error -71 [ 1831.023657][ T4200] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1831.066925][ T4200] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1831.088960][ T29] usb 1-1: new full-speed USB device number 40 using dummy_hcd [ 1831.142413][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1831.167726][ T4200] team0: Port device team_slave_0 added [ 1831.188486][ T4200] team0: Port device team_slave_1 added [ 1831.244038][ T4200] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1831.251550][ T4200] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1831.270950][ T5930] usb 6-1: new full-speed USB device number 77 using dummy_hcd [ 1831.279371][ T4200] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1831.300362][ T4200] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1831.304350][ T29] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 1831.308047][ T4200] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1831.328045][ T29] usb 1-1: config 0 has no interface number 0 [ 1831.348470][ T4200] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1831.365037][ T29] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1831.388279][ T5930] usb 6-1: device descriptor read/8, error -71 [ 1831.394946][ T29] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1831.417403][ T4200] hsr_slave_0: entered promiscuous mode [ 1831.420451][ T29] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1831.425525][ T4200] hsr_slave_1: entered promiscuous mode [ 1831.440967][ T4200] debugfs: 'hsr0' already exists in 'hsr' [ 1831.447150][ T29] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 1831.450750][ T4200] Cannot create hsr debugfs directory [ 1831.474194][ T3967] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 1831.481923][ T29] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1831.506499][ T5930] usb usb6-port1: unable to enumerate USB device [ 1831.516571][ T29] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1831.525673][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1831.551009][ T29] usb 1-1: config 0 descriptor?? [ 1831.556749][ T4279] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1831.588875][ T29] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1831.661018][ T10] uvcvideo 2-1:63.66: probe with driver uvcvideo failed with error -22 [ 1831.667274][ T3967] usb 5-1: Using ep0 maxpacket: 16 [ 1831.676239][ T3967] usb 5-1: config 3 has an invalid interface number: 155 but max is 0 [ 1831.690555][ T3967] usb 5-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 1831.702720][ T3967] usb 5-1: config 3 has no interface number 0 [ 1831.703587][ T10] usb 2-1: USB disconnect, device number 40 [ 1831.708828][ T3967] usb 5-1: config 3 interface 155 has no altsetting 0 [ 1831.724168][ T3967] usb 5-1: New USB device found, idVendor=05a9, idProduct=264a, bcdDevice=e5.4c [ 1831.737730][ T3967] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1831.759198][ T3967] usb 5-1: Product: syz [ 1831.765877][ T3967] usb 5-1: Manufacturer: syz [ 1831.770779][ T3967] usb 5-1: SerialNumber: syz [ 1831.826844][ T5818] Bluetooth: hci2: command tx timeout [ 1831.840445][ T5792] usb 1-1: USB disconnect, device number 40 [ 1831.840518][ C0] ldusb 1-1:0.55: usb_submit_urb failed (-19) [ 1831.873766][ T5792] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 1831.919918][ T4200] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1831.938632][ T4200] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1831.959632][ T4200] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1832.030768][ T3967] uvcvideo 5-1:3.155: probe with driver uvcvideo failed with error -22 [ 1832.062922][ T3967] usb 5-1: USB disconnect, device number 47 [ 1832.254281][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1832.296877][ T4200] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1832.480923][ T4200] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1832.520266][ T4200] 8021q: adding VLAN 0 to HW filter on device team0 [ 1832.545422][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1832.552593][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1832.576843][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1832.584014][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1832.889804][ T3967] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 1833.034761][ T3967] usb 1-1: device descriptor read/64, error -71 [ 1833.291331][ T3967] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 1833.366030][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1833.483650][ T3967] usb 1-1: device descriptor read/64, error -71 [ 1833.495391][ T4200] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1833.614413][ T3967] usb usb1-port1: attempt power cycle [ 1834.050613][ T3967] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 1834.050622][ T5818] Bluetooth: hci2: command tx timeout [ 1834.076646][ T3967] usb 1-1: device descriptor read/8, error -71 [ 1834.168293][ T5818] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 1834.189437][ T5818] CPU: 0 UID: 0 PID: 5818 Comm: kworker/u9:5 Tainted: G L syzkaller #0 PREEMPT(full) [ 1834.189478][ T5818] Tainted: [L]=SOFTLOCKUP [ 1834.189487][ T5818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1834.189502][ T5818] Workqueue: hci1 hci_rx_work [ 1834.189540][ T5818] Call Trace: [ 1834.189549][ T5818] [ 1834.189558][ T5818] dump_stack_lvl+0x100/0x190 [ 1834.189595][ T5818] sysfs_warn_dup.cold+0x1c/0x28 [ 1834.189620][ T5818] sysfs_create_dir_ns+0x24b/0x2b0 [ 1834.189647][ T5818] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1834.189679][ T5818] ? find_held_lock+0x2b/0x80 [ 1834.189703][ T5818] ? kobject_add_internal+0x25f/0x930 [ 1834.189727][ T5818] ? kobject_add_internal+0x25f/0x930 [ 1834.189754][ T5818] ? do_raw_spin_unlock+0x145/0x1e0 [ 1834.189777][ T5818] kobject_add_internal+0x2c8/0x930 [ 1834.189806][ T5818] kobject_add+0x16a/0x1e0 [ 1834.189830][ T5818] ? __pfx_kobject_add+0x10/0x10 [ 1834.189852][ T5818] ? class_to_subsys+0x10f/0x150 [ 1834.189885][ T5818] ? kobject_put+0xb9/0x640 [ 1834.189905][ T5818] ? _raw_spin_unlock+0x28/0x50 [ 1834.189948][ T5818] device_add+0x294/0x1950 [ 1834.189982][ T5818] ? __pfx_dev_set_name+0x10/0x10 [ 1834.190005][ T5818] ? __pfx_device_add+0x10/0x10 [ 1834.190036][ T5818] ? mgmt_send_event_skb+0x2fb/0x460 [ 1834.190078][ T5818] hci_conn_add_sysfs+0x1a3/0x260 [ 1834.190100][ T5818] le_conn_complete_evt+0x11cb/0x1f40 [ 1834.190137][ T5818] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1834.190172][ T5818] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1834.190200][ T5818] ? skb_pull_data+0x15f/0x1e0 [ 1834.190226][ T5818] hci_le_meta_evt+0x34a/0x5f0 [ 1834.190245][ T5818] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1834.190275][ T5818] hci_event_packet+0x682/0x11c0 [ 1834.190302][ T5818] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1834.190321][ T5818] ? __pfx_hci_event_packet+0x10/0x10 [ 1834.190352][ T5818] ? hci_rx_work+0x28a/0xfc0 [ 1834.190381][ T5818] hci_rx_work+0x451/0xfc0 [ 1834.190414][ T5818] process_one_work+0x9d7/0x1920 [ 1834.190444][ T5818] ? __pfx_process_one_work+0x10/0x10 [ 1834.190476][ T5818] ? __pfx_hci_rx_work+0x10/0x10 [ 1834.190507][ T5818] worker_thread+0x5da/0xe40 [ 1834.190535][ T5818] ? kthread+0x13a/0x450 [ 1834.190552][ T5818] ? __pfx_worker_thread+0x10/0x10 [ 1834.190567][ T5818] kthread+0x370/0x450 [ 1834.190581][ T5818] ? __pfx_kthread+0x10/0x10 [ 1834.190600][ T5818] ret_from_fork+0x754/0xd80 [ 1834.190622][ T5818] ? __pfx_ret_from_fork+0x10/0x10 [ 1834.190643][ T5818] ? __switch_to+0x7b4/0x1120 [ 1834.190670][ T5818] ? __pfx_kthread+0x10/0x10 [ 1834.190690][ T5818] ret_from_fork_asm+0x1a/0x30 [ 1834.190725][ T5818] [ 1834.194548][ T5818] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1834.381884][ T3967] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 1834.384787][ T5818] Bluetooth: hci1: failed to register connection device [ 1834.477847][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1834.578670][ T3967] usb 1-1: device descriptor read/8, error -71 [ 1834.610362][ T143] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1834.738104][ T3967] usb usb1-port1: unable to enumerate USB device [ 1834.753561][ T4200] veth0_vlan: entered promiscuous mode [ 1834.780365][ T4619] input: syz1 as /devices/virtual/input/input171 [ 1834.797234][ T4619] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5634'. [ 1834.856059][ T143] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1834.918448][ T4200] veth1_vlan: entered promiscuous mode [ 1834.979169][ T143] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1835.069462][ T3967] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 1835.170721][ T4200] veth0_macvtap: entered promiscuous mode [ 1835.185249][ T4200] veth1_macvtap: entered promiscuous mode [ 1835.204291][ T4200] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1835.215745][ T5930] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1835.248610][ T143] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1835.277699][ T3967] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1835.297317][ T3967] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1835.589722][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1835.665203][ T4200] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1835.679149][ T5930] usb 2-1: New USB device found, idVendor=0c72, idProduct=0012, bcdDevice=22.96 [ 1835.681825][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1835.690410][ T5930] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1835.716166][ T3967] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1835.737361][ T5930] usb 2-1: Product: syz [ 1835.746106][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1835.767451][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1835.773932][ T5930] usb 2-1: Manufacturer: syz [ 1835.781530][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1835.790347][ T5930] usb 2-1: SerialNumber: syz [ 1835.815857][ T5930] usb 2-1: config 0 descriptor?? [ 1835.824909][ T3967] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1835.834025][ T3967] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1835.901688][ T3967] usb 5-1: Product: syz [ 1835.911711][ T3967] usb 5-1: Manufacturer: syz [ 1835.916419][ T3967] usb 5-1: SerialNumber: syz [ 1835.940532][ T3967] usb 5-1: config 0 descriptor?? [ 1835.958380][ T4620] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1835.988205][ T4620] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1836.011774][ T3967] usb 5-1: ucan: probing device on interface #0 [ 1836.119198][ T5930] peak_usb 2-1:0.0: PEAK-System PCAN-USB FD v0 fw v0.0.0 (1 channels) [ 1836.139803][T13120] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1836.168202][T13120] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1836.250102][T30227] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1836.271933][T30227] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1836.288029][ T5818] Bluetooth: hci2: command tx timeout [ 1836.314322][ T143] bridge_slave_1: left allmulticast mode [ 1836.320881][ T143] bridge_slave_1: left promiscuous mode [ 1836.326625][ T143] bridge0: port 2(bridge_slave_1) entered disabled state [ 1836.334836][ T5930] peak_usb 2-1:0.0 can0: unable to request usb[type=2 value=5] err=-71 [ 1836.344031][ T5930] peak_usb 2-1:0.0: unable to tell PCAN-USB FD driver is loaded (err -71) [ 1836.355955][ T143] bridge_slave_0: left allmulticast mode [ 1836.382901][ T143] bridge_slave_0: left promiscuous mode [ 1836.389032][ T143] bridge0: port 1(bridge_slave_0) entered disabled state [ 1836.701497][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1836.739519][ T3967] usb 5-1: ucan: device reported invalid device info [ 1836.787518][ T3967] usb 5-1: ucan: probe failed; try to update the device firmware [ 1836.941960][ T4695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1836.955499][ T4695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1837.183080][ T5872] usb 1-1: new low-speed USB device number 45 using dummy_hcd [ 1837.333376][ T4717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1837.344475][ T5872] usb 1-1: device descriptor read/64, error -71 [ 1837.360820][ T4717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1837.497125][ T5793] usb 5-1: USB disconnect, device number 48 [ 1837.599895][ T5872] usb 1-1: new low-speed USB device number 46 using dummy_hcd [ 1837.813325][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1838.738433][ T5818] Bluetooth: hci2: command tx timeout [ 1838.782987][ T5872] usb 1-1: device descriptor read/64, error -71 [ 1838.797415][ T143] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1838.825855][ T143] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1838.925166][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1839.077929][ T5872] usb usb1-port1: attempt power cycle [ 1839.091681][ T143] bond0 (unregistering): Released all slaves [ 1839.106069][ T143] bond1 (unregistering): Released all slaves [ 1839.329899][ T143] tipc: Left network mode [ 1839.335357][ T5930] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -71 [ 1839.481115][ T5872] usb 1-1: new low-speed USB device number 47 using dummy_hcd [ 1839.582910][ T5930] usb 2-1: USB disconnect, device number 41 [ 1839.614260][ T5872] usb 1-1: device descriptor read/8, error -71 [ 1839.984063][ T5872] usb 1-1: new low-speed USB device number 48 using dummy_hcd [ 1840.037561][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1840.039660][ T5872] usb 1-1: device descriptor read/8, error -71 [ 1840.229660][ T5872] usb usb1-port1: unable to enumerate USB device [ 1840.887035][ T4765] syzkaller0: entered promiscuous mode [ 1840.894535][ T4765] syzkaller0: entered allmulticast mode [ 1841.159490][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1841.227759][T30227] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1841.243195][ T4780] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 1841.384300][ T3967] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 1841.572040][ T4798] 9pnet_virtio: no channels available for device qY3aK [ 1841.662007][ T3967] usb 5-1: Using ep0 maxpacket: 8 [ 1841.695250][ T3967] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1841.706287][ T3967] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1841.739155][ T3967] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1842.260614][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1842.471026][ T143] hsr_slave_0: left promiscuous mode [ 1842.578510][ T143] hsr_slave_1: left promiscuous mode [ 1842.591676][ T143] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1842.602884][ T143] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1842.641732][ T143] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1842.651518][ T143] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1842.664879][ T143] veth1_macvtap: left promiscuous mode [ 1842.672762][ T143] veth0_macvtap: left promiscuous mode [ 1842.684917][ T143] veth1_vlan: left promiscuous mode [ 1842.694099][ T143] veth0_vlan: left promiscuous mode [ 1842.699759][ T5872] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 1842.860623][ T5872] usb 1-1: Using ep0 maxpacket: 16 [ 1842.868987][ T5872] usb 1-1: New USB device found, idVendor=0582, idProduct=000b, bcdDevice= 0.40 [ 1842.885135][ T5872] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1842.904073][ T5872] usb 1-1: Manufacturer: 露៰쇛霗㚫嬡樍皼垼᮰∰镚䤣頨ᦏ粊껑䚰둸덳೅䵒᪕쇳ᜏ㫻傃ধ [ 1842.927073][ T5872] usb 1-1: SerialNumber: 渚ꇸ疳殦ﺳ쇮칫ᡲⷓ⿰ི핗䌁쒬滽 [ 1842.940959][ T143] pim6reg (unregistering): left allmulticast mode [ 1843.196732][ T5872] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1843.211765][ T5872] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 1843.258018][ T5872] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1843.301546][ T5872] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 1843.383131][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1843.425130][ T5872] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1843.644776][ T5872] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 1843.713404][ T5872] usb 1-1: USB disconnect, device number 49 [ 1843.770055][ T5930] usb 6-1: new full-speed USB device number 78 using dummy_hcd [ 1843.828252][ T3761] udevd[3761]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1843.882449][ T143] team0 (unregistering): Port device team_slave_1 removed [ 1843.942782][ T143] team0 (unregistering): Port device team_slave_0 removed [ 1843.951718][ T5930] usb 6-1: config 0 has an invalid interface number: 133 but max is 0 [ 1843.978063][ T5930] usb 6-1: config 0 has no interface number 0 [ 1844.005627][ T5930] usb 6-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1844.017831][ T5930] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1844.040561][ T5930] usb 6-1: Product: syz [ 1844.052833][ T5930] usb 6-1: Manufacturer: syz [ 1844.060858][ T5930] usb 6-1: SerialNumber: syz [ 1844.098191][ T5930] usb 6-1: config 0 descriptor?? [ 1844.142051][ T29] usb 5-1: USB disconnect, device number 49 [ 1844.324087][ T5872] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 1844.484300][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1844.586644][ T143] vcan0 (unregistering): left allmulticast mode [ 1844.737885][ T5872] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1844.759085][ T5872] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1844.776283][ T5872] usb 1-1: Product: syz [ 1844.787934][ T5872] usb 1-1: Manufacturer: syz [ 1844.793096][ T5872] usb 1-1: SerialNumber: syz [ 1845.421463][ T143] IPVS: stop unused estimator thread 0... [ 1845.596182][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1846.027716][ T4951] random: crng reseeded on system resumption [ 1846.707893][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1846.875719][ T4959] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5665'. [ 1847.072179][ T5930] keyspan 6-1:0.133: Keyspan 1 port adapter converter detected [ 1847.079542][ T4965] openvswitch: netlink: IPv4 tun info is not correct [ 1847.102809][ T5930] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 81 [ 1847.169806][ T5930] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 1 [ 1847.177653][ T5930] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 2 [ 1847.241783][ T5930] usb 6-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1847.360442][ T5930] usb 6-1: USB disconnect, device number 78 [ 1847.380248][ T5872] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1847.420444][ T5872] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO [ 1847.426339][ T5930] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1847.453354][ T5930] keyspan 6-1:0.133: device disconnected [ 1847.538359][ T5872] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 1847.830410][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1848.031542][ T5872] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1848.041805][ T5872] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1848.172976][ T5872] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 1848.225115][ T5872] usb 1-1: USB disconnect, device number 50 [ 1848.354816][ T5003] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5666'. [ 1848.931552][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1850.054319][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1850.266208][ T5060] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5677'. [ 1850.558693][ T5054] geneve2: entered promiscuous mode [ 1850.574868][ T5054] geneve2: entered allmulticast mode [ 1850.651805][ T5063] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1850.799151][ T5066] syzkaller0: entered promiscuous mode [ 1850.807825][ T5066] syzkaller0: entered allmulticast mode [ 1851.155225][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1851.579726][ T30] audit: type=1400 audit(1772619945.123:1883): avc: denied { write } for pid=5108 comm="syz.6.5686" path="socket:[130173]" dev="sockfs" ino=130173 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1851.675814][ T30] audit: type=1400 audit(1772619945.207:1884): avc: denied { map } for pid=5113 comm="syz.4.5687" path="socket:[129493]" dev="sockfs" ino=129493 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1851.701707][ T5114] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5114 comm=syz.4.5687 [ 1851.715693][ T5114] netlink: 'syz.4.5687': attribute type 1 has an invalid length. [ 1851.738492][ T5123] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=36424 sclass=netlink_route_socket pid=5123 comm=syz.0.5688 [ 1851.832585][ T5144] bond2: (slave gretap1): making interface the new active one [ 1851.882840][ T5930] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1851.894946][ T5144] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 1852.004531][ T5114] vlan2: entered allmulticast mode [ 1852.023785][ T5114] bond2: entered allmulticast mode [ 1852.028944][ T5114] gretap1: entered allmulticast mode [ 1852.056945][ T5114] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1852.064076][ T29] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1852.101108][ T5930] usb 7-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 1852.212927][ T5930] usb 7-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 1852.221969][ T5930] usb 7-1: Product: syz [ 1852.226341][ T5930] usb 7-1: Manufacturer: syz [ 1852.231034][ T5930] usb 7-1: SerialNumber: syz [ 1852.244688][ T5930] usb 7-1: config 0 descriptor?? [ 1852.251580][ T5930] ch341 7-1:0.0: ch341-uart converter detected [ 1852.257852][ T24] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 1852.277800][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1852.635695][ T5930] usb 7-1: failed to receive control message: -71 [ 1852.642525][ T5930] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 1852.653692][ T5930] usb 7-1: USB disconnect, device number 2 [ 1852.661189][ T5930] ch341 7-1:0.0: device disconnected [ 1852.669450][ T29] usb 1-1: config index 0 descriptor too short (expected 7768, got 18) [ 1852.677976][ T29] usb 1-1: config 0 has an invalid interface number: 49 but max is 0 [ 1852.689071][ T29] usb 1-1: config 0 has no interface number 0 [ 1852.696756][ T29] usb 1-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 1852.709751][ T29] usb 1-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 1852.723660][ T29] usb 1-1: config 0 interface 49 has no altsetting 0 [ 1852.731470][ T29] usb 1-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice=52.4d [ 1852.743561][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1852.756852][ T29] usb 1-1: config 0 descriptor?? [ 1852.801588][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 1852.808485][ T24] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1852.821274][ T24] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1852.831272][ T24] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1852.839745][ T24] usb 5-1: Product: syz [ 1852.843961][ T24] usb 5-1: Manufacturer: syz [ 1852.848633][ T24] usb 5-1: SerialNumber: syz [ 1852.978042][ T29] usb 1-1: string descriptor 0 read error: -71 [ 1852.994798][ T29] ftdi_sio 1-1:0.49: FTDI USB Serial Device converter detected [ 1853.008569][ T29] ftdi_sio ttyUSB0: unknown device type: 0x524d [ 1853.039269][ T29] usb 1-1: USB disconnect, device number 51 [ 1853.127503][ T24] usb 5-1: Handspring Visor / Palm OS: No valid connect info available [ 1853.136443][ T29] ftdi_sio 1-1:0.49: device disconnected [ 1853.142999][ T24] usb 5-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 1853.154257][ T24] usb 5-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 1853.162680][ T24] usb 5-1: Handspring Visor / Palm OS: Number of ports: 2 [ 1853.191690][ T5219] smc: removing ib device syU [ 1853.240037][ T5225] netlink: 2 bytes leftover after parsing attributes in process `syz.6.5692'. [ 1853.354847][ T24] usb 5-1: palm_os_3_probe - error -71 getting bytes available request [ 1853.370830][ T24] visor 5-1:1.0: Handspring Visor / Palm OS converter detected [ 1853.378979][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1853.398357][ T24] usb 5-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 1853.415895][ T24] usb 5-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 1853.430962][ T24] usb 5-1: USB disconnect, device number 50 [ 1853.441148][ T24] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 1853.471697][ T24] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 1853.505315][ T24] visor 5-1:1.0: device disconnected [ 1853.740667][ T5255] bridge3: entered promiscuous mode [ 1854.299419][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055078400: rx timeout, send abort [ 1854.360946][ T5267] netlink: 'syz.4.5697': attribute type 13 has an invalid length. [ 1854.368855][ T5267] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5697'. [ 1854.501431][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1854.666457][ T24] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1854.834323][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055454400: rx timeout, send abort [ 1854.842754][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055078400: abort rx timeout. Force session deactivation [ 1854.858961][ T24] usb 2-1: too many configurations: 154, using maximum allowed: 8 [ 1854.883090][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1854.895015][ T24] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1854.928993][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1854.938243][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1854.955284][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1855.030653][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1855.043146][ T24] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1855.056793][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1855.068450][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1855.079994][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1855.123518][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1855.133321][ T24] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1855.150461][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1855.177506][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1855.193752][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1855.207449][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1855.216355][ T24] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1855.228867][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1855.238198][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1855.252891][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1855.266028][ T5287] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5701'. [ 1855.283580][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1855.339163][ T24] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1855.353195][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1855.377114][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055454400: abort rx timeout. Force session deactivation [ 1855.404091][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1855.456692][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1855.469497][ T5291] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5704'. [ 1855.602580][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1855.625369][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1855.634105][ T24] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1855.657981][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1855.667889][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1855.894954][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1855.913037][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1855.937024][ T24] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1856.057607][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1856.090463][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1856.121383][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1856.152048][ T24] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1856.170712][ T24] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1856.208037][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1856.270329][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1856.319077][ T24] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1856.439579][ T24] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1856.451354][ T24] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1856.461149][ T24] usb 2-1: Product: syz [ 1856.465440][ T24] usb 2-1: Manufacturer: syz [ 1856.488533][ T24] cdc_wdm 2-1:1.0: skipping garbage [ 1856.493992][ T24] cdc_wdm 2-1:1.0: skipping garbage [ 1856.514642][ T24] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1856.536875][ T24] cdc_wdm 2-1:1.0: Unknown control protocol [ 1856.714401][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1856.903172][ T5330] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5713'. [ 1857.694274][ T5343] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1857.748665][ T5885] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 1857.826148][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1858.140282][ T5354] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5715'. [ 1858.213116][ T5885] usb 5-1: config 0 has an invalid descriptor of length 78, skipping remainder of the config [ 1858.215049][ T30] audit: type=1400 audit(1772619951.325:1885): avc: denied { read } for pid=5358 comm="syz.6.5717" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1858.237705][ T5885] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1858.282204][ T5885] usb 5-1: New USB device found, idVendor=0eef, idProduct=72d0, bcdDevice= 0.00 [ 1858.314381][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1858.336418][ T5885] usb 5-1: config 0 descriptor?? [ 1858.490320][ T5384] netlink: 'syz.5.5719': attribute type 1 has an invalid length. [ 1858.619865][ T5384] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1858.636925][ T5387] bond2: (slave ip6erspan0): making interface the new active one [ 1858.666899][ T5387] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link [ 1858.875766][ T5338] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1858.889846][ T5338] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1858.906967][ T5872] usb 5-1: USB disconnect, device number 51 [ 1858.938115][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1859.149619][ T5872] usb 2-1: USB disconnect, device number 42 [ 1859.258792][ T794] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1859.456081][ T794] usb 7-1: Using ep0 maxpacket: 32 [ 1859.474943][ T794] usb 7-1: config 0 has an invalid interface number: 35 but max is 0 [ 1859.504700][ T794] usb 7-1: config 0 has no interface number 0 [ 1859.510845][ T794] usb 7-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1859.580014][ T794] usb 7-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 1859.601632][ T794] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1859.609656][ T794] usb 7-1: Product: syz [ 1860.049787][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1860.159676][ T794] usb 7-1: Manufacturer: syz [ 1860.164887][ T794] usb 7-1: SerialNumber: syz [ 1860.331996][ T794] usb 7-1: config 0 descriptor?? [ 1860.473265][ T794] radio-si470x 7-1:0.35: could not find interrupt in endpoint [ 1860.482482][ T794] radio-si470x 7-1:0.35: probe with driver radio-si470x failed with error -5 [ 1860.684128][ T794] radio-raremono 7-1:0.35: Thanko's Raremono connected: (10C4:818A) [ 1860.789829][ T30] audit: type=1400 audit(1772619953.738:1886): avc: denied { ioctl } for pid=5480 comm="syz.0.5731" path="socket:[130630]" dev="sockfs" ino=130630 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1860.816199][ T30] audit: type=1400 audit(1772619953.747:1887): avc: denied { write } for pid=5480 comm="syz.0.5731" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1860.938041][ T794] radio-raremono 7-1:0.35: raremono_cmd_main failed (-71) [ 1860.961612][ T794] radio-raremono 7-1:0.35: V4L2 device registered as radio48 [ 1860.981850][ T794] usb 7-1: USB disconnect, device number 3 [ 1860.988780][ T794] radio-raremono 7-1:0.35: Thanko's Raremono disconnected [ 1861.022655][ T24] usb 5-1: new full-speed USB device number 52 using dummy_hcd [ 1861.161632][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1861.238113][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1861.288260][ T24] usb 5-1: not running at top speed; connect to a high speed hub [ 1861.366556][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 12014, setting to 64 [ 1861.417889][ T24] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1861.447951][ T24] usb 5-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0x4, skipping [ 1861.461855][ T24] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1861.479574][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 1861.508096][ T24] usb 5-1: New USB device found, idVendor=0e41, idProduct=4750, bcdDevice= 0.40 [ 1861.519438][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1861.534437][ T24] usb 5-1: Product: syz [ 1861.538705][ T24] usb 5-1: Manufacturer: syz [ 1861.543416][ T24] usb 5-1: SerialNumber: syz [ 1861.773082][ T5479] netlink: 'syz.4.5730': attribute type 2 has an invalid length. [ 1861.780920][ T5479] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5730'. [ 1861.807382][ T5479] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1861.817390][ T5479] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1861.887367][ T24] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1861.895031][ T24] usb 5-1: MIDIStreaming interface descriptor not found [ 1861.949335][ T24] usb 5-1: USB disconnect, device number 52 [ 1862.007224][ T3785] udevd[3785]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1862.063266][ T5561] tipc: Enabled bearer , priority 0 [ 1862.070999][ T9] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1862.079442][ T5561] syzkaller0: entered promiscuous mode [ 1862.085528][ T5561] syzkaller0: entered allmulticast mode [ 1862.109064][ T5561] tipc: Resetting bearer [ 1862.116855][ T5560] tipc: Resetting bearer [ 1862.133724][ T5560] tipc: Disabling bearer [ 1862.273457][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1862.306721][ T9] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1862.315892][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1862.325899][ T9] usb 2-1: config 0 descriptor?? [ 1862.332903][ T9] cp210x 2-1:0.0: cp210x converter detected [ 1862.945456][ T9] cp210x 2-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 1863.363926][ T9] usb 2-1: cp210x converter now attached to ttyUSB0 [ 1863.385258][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1863.584903][ T9] usb 2-1: USB disconnect, device number 43 [ 1863.712356][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1863.741186][ T9] cp210x 2-1:0.0: device disconnected [ 1863.905876][ T5615] netlink: 'syz.5.5741': attribute type 2 has an invalid length. [ 1863.997801][ T5616] netlink: 'syz.5.5741': attribute type 2 has an invalid length. [ 1864.184214][ T5594] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1864.268128][ T5620] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5744'. [ 1864.497084][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1865.309586][ T5885] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 1865.483299][ T5885] usb 7-1: config 0 has an invalid interface number: 214 but max is 0 [ 1865.495192][ T5885] usb 7-1: config 0 has no interface number 0 [ 1865.531671][ T5885] usb 7-1: config 0 interface 214 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 1865.561440][ T5885] usb 7-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1865.576724][ T5885] usb 7-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 1865.594477][ T5885] usb 7-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 1865.608906][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1865.619267][ T5885] usb 7-1: Manufacturer: syz [ 1865.624791][ T5885] usb 7-1: SerialNumber: syz [ 1865.675594][ T5885] usb 7-1: config 0 descriptor?? [ 1866.720768][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1867.211354][ T5885] usbtouchscreen 7-1:0.214: Failed to read FW rev: -71 [ 1867.236282][ T5885] usbtouchscreen 7-1:0.214: probe with driver usbtouchscreen failed with error -71 [ 1867.253843][ T5885] usb 7-1: USB disconnect, device number 4 [ 1867.832922][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1868.944382][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1870.056189][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1870.135832][ T5818] Bluetooth: hci1: unexpected event for opcode 0x2019 [ 1870.462481][ T5885] usb 5-1: new full-speed USB device number 53 using dummy_hcd [ 1870.928463][ T5885] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1870.965441][ T5885] usb 5-1: not running at top speed; connect to a high speed hub [ 1870.983836][ T5885] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 1871.022639][ T5885] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 21064, setting to 64 [ 1871.057559][ T5885] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 64 [ 1871.084414][ T5885] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1871.109646][ T5885] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x14, changing to 0x4 [ 1871.117337][ T5795] tmpfs: Unknown parameter '( D#Dm [ 1871.117337][ T5795] A 82 (6:Y5OsH<*_$Lo<)iq`D#{Q0NhFp(% [ 1871.117337][ T5795] *MfNZIAY?b)k_*UZ۳Kk\QͲ' [ 1871.145894][ T5791] tipc: Enabled bearer , priority 10 [ 1871.154488][ T5791] futex_wake_op: syz.0.5769 tries to shift op by 32; fix this program [ 1871.168065][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1871.179505][ T30] audit: type=1400 audit(1772619963.457:1888): avc: denied { open } for pid=5794 comm="syz.6.5762" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=130958 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1871.209075][ T5797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1871.220235][ T5797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1871.247699][ T5885] usb 5-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 1871.253337][ T5795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1871.268144][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1871.276471][ T5885] usb 5-1: Product: syz [ 1871.283002][ T5885] usb 5-1: Manufacturer: syz [ 1871.288301][ T5885] usb 5-1: SerialNumber: syz [ 1871.300592][ T5885] usb 5-1: config 0 descriptor?? [ 1871.305654][ T5795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1871.306617][ T5762] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1871.318931][ T5809] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5770'. [ 1871.324063][ T5885] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1871.480866][ T5872] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 1871.500411][ T9] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 1871.724283][ T5872] usb 7-1: Using ep0 maxpacket: 8 [ 1871.775625][ T5872] usb 7-1: config index 0 descriptor too short (expected 50468, got 36) [ 1871.787956][ T5872] usb 7-1: config 144 has too many interfaces: 85, using maximum allowed: 32 [ 1871.796828][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 1871.809656][ T5872] usb 7-1: config 144 has an invalid descriptor of length 0, skipping remainder of the config [ 1871.822054][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 1871.838561][ T9] usb 1-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 1871.851116][ T5872] usb 7-1: config 144 has 0 interfaces, different from the descriptor's value: 85 [ 1871.862758][ T9] usb 1-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 1871.872298][ T5872] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.d4 [ 1871.881471][ T9] usb 1-1: Product: syz [ 1871.888248][ T9] usb 1-1: Manufacturer: syz [ 1871.892915][ T5872] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1871.902390][ T9] usb 1-1: SerialNumber: syz [ 1871.941943][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1871.969839][ T5885] usb 5-1: USB disconnect, device number 53 [ 1872.140502][ T5872] usb 7-1: string descriptor 0 read error: -71 [ 1872.151306][ T5872] usb 7-1: USB disconnect, device number 5 [ 1872.171695][ T9] usb 1-1: Invalid connection information received from device [ 1872.279848][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1872.403707][ T5791] fuse: Bad value for 'rootmode' [ 1872.410429][ T5872] usb 1-1: USB disconnect, device number 52 [ 1872.518177][ T5889] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5777'. [ 1872.529796][ T5889] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5777'. [ 1872.552008][ T5889] tipc: Enabled bearer , priority 10 [ 1873.072289][ T5902] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5781'. [ 1873.391693][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1874.033573][ T5930] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1874.318570][ T5930] usb 5-1: device descriptor read/64, error -71 [ 1874.339626][ T5917] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5779'. [ 1874.503505][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1874.590325][ T5930] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1874.728061][ T5930] usb 5-1: device descriptor read/64, error -71 [ 1874.847394][ T5930] usb usb5-port1: attempt power cycle [ 1875.241274][ T5930] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 1875.300226][ T5930] usb 5-1: device descriptor read/8, error -71 [ 1875.576250][ T5927] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5787'. [ 1875.615325][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1875.639085][ T5930] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 1875.723385][ T5930] usb 5-1: device descriptor read/8, error -71 [ 1875.889379][ T5930] usb usb5-port1: unable to enumerate USB device [ 1875.914902][ T5949] netlink: 'syz.6.5790': attribute type 6 has an invalid length. [ 1875.930786][ T5949] netlink: 'syz.6.5790': attribute type 6 has an invalid length. [ 1876.385409][ T29] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 1876.561434][T30069] Bluetooth: hci4: command 0x0406 tx timeout [ 1876.594751][ T29] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1876.606653][ T29] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1876.619600][ T29] usb 7-1: New USB device found, idVendor=1ac7, idProduct=0001, bcdDevice=cc.19 [ 1876.629148][ T29] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1876.637278][ T29] usb 7-1: Product: syz [ 1876.641499][ T29] usb 7-1: Manufacturer: syz [ 1876.646214][ T29] usb 7-1: SerialNumber: syz [ 1876.666913][ T29] usb 7-1: config 0 descriptor?? [ 1876.727555][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1876.893976][ T5872] usb 7-1: USB disconnect, device number 6 [ 1877.167033][ T5993] netlink: 'syz.4.5797': attribute type 16 has an invalid length. [ 1877.174952][ T5993] netlink: 'syz.4.5797': attribute type 17 has an invalid length. [ 1877.283457][ T5930] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 1877.291645][ T5993] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1877.528947][ T5930] usb 2-1: Using ep0 maxpacket: 8 [ 1877.535495][ T5930] usb 2-1: config 0 has an invalid interface number: 151 but max is 1 [ 1877.671504][ T5818] ================================================================== [ 1877.679681][ T5818] BUG: KASAN: slab-use-after-free in le_read_features_complete+0x56/0x380 [ 1877.688170][ T5818] Write of size 4 at addr ffff888068624010 by task kworker/u9:5/5818 [ 1877.696221][ T5818] [ 1877.698616][ T5818] CPU: 1 UID: 0 PID: 5818 Comm: kworker/u9:5 Tainted: G L syzkaller #0 PREEMPT(full) [ 1877.698633][ T5818] Tainted: [L]=SOFTLOCKUP [ 1877.698637][ T5818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1877.698646][ T5818] Workqueue: hci4 hci_cmd_sync_work [ 1877.698663][ T5818] Call Trace: [ 1877.698669][ T5818] [ 1877.698673][ T5818] dump_stack_lvl+0x100/0x190 [ 1877.698691][ T5818] print_report+0x156/0x4c9 [ 1877.698706][ T5818] ? __virt_addr_valid+0x81/0x620 [ 1877.698722][ T5818] ? __phys_addr+0xe8/0x180 [ 1877.698750][ T5818] ? le_read_features_complete+0x56/0x380 [ 1877.698763][ T5818] kasan_report+0xdf/0x1e0 [ 1877.698780][ T5818] ? le_read_features_complete+0x56/0x380 [ 1877.698794][ T5818] kasan_check_range+0x10f/0x1e0 [ 1877.698806][ T5818] le_read_features_complete+0x56/0x380 [ 1877.698823][ T5818] hci_cmd_sync_work+0x214/0x470 [ 1877.698835][ T5818] ? __pfx_le_read_features_complete+0x10/0x10 [ 1877.698849][ T5818] process_one_work+0x9d7/0x1920 [ 1877.698863][ T5818] ? __pfx_process_one_work+0x10/0x10 [ 1877.698876][ T5818] ? __pfx_hci_cmd_sync_work+0x10/0x10 [ 1877.698888][ T5818] worker_thread+0x5da/0xe40 [ 1877.698901][ T5818] ? kthread+0x13a/0x450 [ 1877.698910][ T5818] ? __pfx_worker_thread+0x10/0x10 [ 1877.698921][ T5818] kthread+0x370/0x450 [ 1877.698930][ T5818] ? __pfx_kthread+0x10/0x10 [ 1877.698939][ T5818] ret_from_fork+0x754/0xd80 [ 1877.698950][ T5818] ? __pfx_ret_from_fork+0x10/0x10 [ 1877.698961][ T5818] ? __switch_to+0x7b4/0x1120 [ 1877.698974][ T5818] ? __pfx_kthread+0x10/0x10 [ 1877.698984][ T5818] ret_from_fork_asm+0x1a/0x30 [ 1877.698999][ T5818] [ 1877.699003][ T5818] [ 1877.858858][ T5818] Allocated by task 30069: [ 1877.863256][ T5818] kasan_save_stack+0x30/0x50 [ 1877.867945][ T5818] kasan_save_track+0x14/0x30 [ 1877.872598][ T5818] __kasan_kmalloc+0xaa/0xb0 [ 1877.877175][ T5818] __hci_conn_add+0x1f4/0x1da0 [ 1877.881926][ T5818] hci_conn_add_unset+0x76/0x120 [ 1877.886842][ T5818] le_conn_complete_evt+0x633/0x1f40 [ 1877.892101][ T5818] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1877.897623][ T5818] hci_le_meta_evt+0x34a/0x5f0 [ 1877.902362][ T5818] hci_event_packet+0x682/0x11c0 [ 1877.907277][ T5818] hci_rx_work+0x451/0xfc0 [ 1877.911678][ T5818] process_one_work+0x9d7/0x1920 [ 1877.916593][ T5818] worker_thread+0x5da/0xe40 [ 1877.921352][ T5818] kthread+0x370/0x450 [ 1877.925406][ T5818] ret_from_fork+0x754/0xd80 [ 1877.929973][ T5818] ret_from_fork_asm+0x1a/0x30 [ 1877.934726][ T5818] [ 1877.937027][ T5818] Freed by task 30069: [ 1877.941062][ T5818] kasan_save_stack+0x30/0x50 [ 1877.945725][ T5818] kasan_save_track+0x14/0x30 [ 1877.950381][ T5818] kasan_save_free_info+0x3b/0x70 [ 1877.955375][ T5818] __kasan_slab_free+0x5f/0x80 [ 1877.960111][ T5818] kfree+0x1f6/0x6b0 [ 1877.963990][ T5818] device_release+0xa4/0x240 [ 1877.968743][ T5818] kobject_put+0x1f7/0x640 [ 1877.973155][ T5818] device_unregister+0x2f/0xe0 [ 1877.977899][ T5818] hci_conn_del_sysfs+0xb9/0x1a0 [ 1877.982848][ T5818] hci_conn_del+0x506/0x1180 [ 1877.987415][ T5818] hci_cs_disconnect+0x6bc/0xa50 [ 1877.992328][ T5818] hci_cmd_status_evt+0x258/0x770 [ 1877.997336][ T5818] hci_event_packet+0x682/0x11c0 [ 1878.002250][ T5818] hci_rx_work+0x451/0xfc0 [ 1878.006647][ T5818] process_one_work+0x9d7/0x1920 [ 1878.011565][ T5818] worker_thread+0x5da/0xe40 [ 1878.016122][ T5818] kthread+0x370/0x450 [ 1878.020156][ T5818] ret_from_fork+0x754/0xd80 [ 1878.024714][ T5818] ret_from_fork_asm+0x1a/0x30 [ 1878.029452][ T5818] [ 1878.031759][ T5818] The buggy address belongs to the object at ffff888068624000 [ 1878.031759][ T5818] which belongs to the cache kmalloc-8k of size 8192 [ 1878.045868][ T5818] The buggy address is located 16 bytes inside of [ 1878.045868][ T5818] freed 8192-byte region [ffff888068624000, ffff888068626000) [ 1878.059643][ T5818] [ 1878.061938][ T5818] The buggy address belongs to the physical page: [ 1878.068319][ T5818] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x68620 [ 1878.077046][ T5818] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1878.085529][ T5818] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1878.093050][ T5818] page_type: f5(slab) [ 1878.097011][ T5818] raw: 00fff00000000040 ffff88813fe40280 dead000000000100 dead000000000122 [ 1878.105566][ T5818] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 1878.114554][ T5818] head: 00fff00000000040 ffff88813fe40280 dead000000000100 dead000000000122 [ 1878.123193][ T5818] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 1878.131869][ T5818] head: 00fff00000000003 ffffea0001a18801 00000000ffffffff 00000000ffffffff [ 1878.140519][ T5818] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1878.149162][ T5818] page dumped because: kasan: bad access detected [ 1878.155551][ T5818] page_owner tracks the page as allocated [ 1878.161236][ T5818] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 14124, tgid 14124 (syz-executor), ts 721523610471, free_ts 721518268068 [ 1878.182912][ T5818] post_alloc_hook+0x153/0x170 [ 1878.187742][ T5818] get_page_from_freelist+0x111d/0x3140 [ 1878.193349][ T5818] __alloc_frozen_pages_noprof+0x27c/0x2ba0 [ 1878.199220][ T5818] new_slab+0xa6/0x6d0 [ 1878.203275][ T5818] refill_objects+0x26b/0x400 [ 1878.207934][ T5818] __pcs_replace_empty_main+0x19f/0x600 [ 1878.213454][ T5818] __kmalloc_noprof+0x688/0x850 [ 1878.218281][ T5818] ops_init+0x77/0x5f0 [ 1878.222319][ T5818] setup_net+0x118/0x3a0 [ 1878.226531][ T5818] copy_net_ns+0x46f/0x7c0 [ 1878.230916][ T5818] create_new_namespaces+0x3ea/0xac0 [ 1878.236180][ T5818] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 1878.241786][ T5818] ksys_unshare+0x473/0xad0 [ 1878.246262][ T5818] __x64_sys_unshare+0x31/0x40 [ 1878.251008][ T5818] do_syscall_64+0x106/0xf80 [ 1878.255584][ T5818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1878.261460][ T5818] page last free pid 14124 tgid 14124 stack trace: [ 1878.267936][ T5818] __free_frozen_pages+0x7e1/0x10d0 [ 1878.273110][ T5818] qlist_free_all+0x47/0xe0 [ 1878.277596][ T5818] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1878.283053][ T5818] __kasan_slab_alloc+0x69/0x90 [ 1878.287892][ T5818] __kmalloc_cache_noprof+0x243/0x6f0 [ 1878.293264][ T5818] ref_tracker_alloc+0x190/0x590 [ 1878.298177][ T5818] register_netdevice+0x1535/0x2210 [ 1878.303358][ T5818] register_netdev+0x34/0x50 [ 1878.307915][ T5818] sit_init_net+0x2c0/0x5f0 [ 1878.312394][ T5818] ops_init+0x1e2/0x5f0 [ 1878.316530][ T5818] setup_net+0x118/0x3a0 [ 1878.320743][ T5818] copy_net_ns+0x46f/0x7c0 [ 1878.325128][ T5818] create_new_namespaces+0x3ea/0xac0 [ 1878.330396][ T5818] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 1878.336001][ T5818] ksys_unshare+0x473/0xad0 [ 1878.340476][ T5818] __x64_sys_unshare+0x31/0x40 [ 1878.345214][ T5818] [ 1878.347509][ T5818] Memory state around the buggy address: [ 1878.353192][ T5818] ffff888068623f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1878.361222][ T5818] ffff888068623f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1878.369262][ T5818] >ffff888068624000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1878.377291][ T5818] ^ [ 1878.381848][ T5818] ffff888068624080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1878.389880][ T5818] ffff888068624100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1878.397909][ T5818] ================================================================== [ 1878.406166][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 1878.423707][ T5930] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1878.433905][ T5818] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1878.441133][ T5818] CPU: 1 UID: 0 PID: 5818 Comm: kworker/u9:5 Tainted: G L syzkaller #0 PREEMPT(full) [ 1878.452162][ T5818] Tainted: [L]=SOFTLOCKUP [ 1878.456479][ T5818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1878.466533][ T5818] Workqueue: hci4 hci_cmd_sync_work [ 1878.471718][ T5818] Call Trace: [ 1878.474995][ T5818] [ 1878.477915][ T5818] dump_stack_lvl+0x100/0x190 [ 1878.482594][ T5818] vpanic+0x552/0x970 [ 1878.486563][ T5818] ? __pfx_vpanic+0x10/0x10 [ 1878.491044][ T5818] ? le_read_features_complete+0x56/0x380 [ 1878.496752][ T5818] panic+0xd1/0xe0 [ 1878.500443][ T5818] ? __pfx_panic+0x10/0x10 [ 1878.504838][ T5818] ? le_read_features_complete+0x56/0x380 [ 1878.510530][ T5818] ? preempt_schedule_common+0x42/0xc0 [ 1878.515959][ T5818] ? check_panic_on_warn+0x1f/0x90 [ 1878.521060][ T5818] check_panic_on_warn.cold+0x19/0x34 [ 1878.526404][ T5818] end_report.part.0+0x3a/0x90 [ 1878.531169][ T5818] kasan_report.cold+0xe/0x18 [ 1878.535831][ T5818] ? le_read_features_complete+0x56/0x380 [ 1878.541533][ T5818] kasan_check_range+0x10f/0x1e0 [ 1878.546442][ T5818] le_read_features_complete+0x56/0x380 [ 1878.552048][ T5818] hci_cmd_sync_work+0x214/0x470 [ 1878.556978][ T5818] ? __pfx_le_read_features_complete+0x10/0x10 [ 1878.563112][ T5818] process_one_work+0x9d7/0x1920 [ 1878.568984][ T5818] ? __pfx_process_one_work+0x10/0x10 [ 1878.574328][ T5818] ? __pfx_hci_cmd_sync_work+0x10/0x10 [ 1878.579760][ T5818] worker_thread+0x5da/0xe40 [ 1878.584332][ T5818] ? kthread+0x13a/0x450 [ 1878.588545][ T5818] ? __pfx_worker_thread+0x10/0x10 [ 1878.593631][ T5818] kthread+0x370/0x450 [ 1878.598195][ T5818] ? __pfx_kthread+0x10/0x10 [ 1878.602753][ T5818] ret_from_fork+0x754/0xd80 [ 1878.607310][ T5818] ? __pfx_ret_from_fork+0x10/0x10 [ 1878.612388][ T5818] ? __switch_to+0x7b4/0x1120 [ 1878.617036][ T5818] ? __pfx_kthread+0x10/0x10 [ 1878.621593][ T5818] ret_from_fork_asm+0x1a/0x30 [ 1878.626331][ T5818] [ 1878.629556][ T5818] Kernel Offset: disabled [ 1878.633852][ T5818] Rebooting in 86400 seconds..