last executing test programs: 1m56.733206589s ago: executing program 4 (id=1238): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1600000000060000080000000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000500)=ANY=[@ANYRES32=r1, @ANYBLOB="d7bc23fe59a4fbffce3cfcdc64f8111daca6de48", @ANYRES16=r1, @ANYRES32, @ANYBLOB="1fe9ada7028aa34499c33ff30000010000000000288b49ecb5254b3a2a069f062b883d106063ed2dbac691156baa3c838c2cb1101a43132fcd2b0028a0a8187f3d9e0f4c4b4f95"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x9c) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r2}, 0x10) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x8}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) (async) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x30000000, 0x141103) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0xb, 0x1, 0x0) (async) r5 = syz_io_uring_setup(0x110, &(0x7f0000001280)={0x0, 0xfad6, 0x400}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) (async) r8 = syz_open_dev$usbfs(&(0x7f0000000180), 0x200, 0x882) ioctl$USBDEVFS_GETDRIVER(r8, 0x41045508, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r9 = signalfd4(r3, &(0x7f00000003c0)={[0x60]}, 0x8, 0x800) prlimit64(0x0, 0x1, &(0x7f0000000640)={0x4, 0x9}, &(0x7f0000000680)) (async) read$FUSE(0xffffffffffffffff, 0x0, 0x0) (async) write$FUSE_DIRENT(r9, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002640)={0x11, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000280)={0x3, 0x7, 0x5, 0x7272}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc}, 0x94) (async) r10 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x80000001}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r10, 0x4040534e, &(0x7f0000000140)={0x16f, @tick=0x7}) openat$cachefiles(0xffffffffffffff9c, 0x0, 0x1, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x11, 0x0, @fd=r10}) (async) io_uring_enter(r5, 0xdb4, 0x0, 0x0, 0x0, 0x0) 1m55.765437489s ago: executing program 4 (id=1244): r0 = socket$packet(0x11, 0x3, 0x300) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xd, 0xe, &(0x7f00000004c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040)={0x0, 0x4}, 0x10}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r1, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) 1m55.704600981s ago: executing program 4 (id=1246): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x38, 0x16, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x4}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x7}]}], {0x14, 0x4}}, 0x80}}, 0x0) (async, rerun: 64) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="440000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000001c00128009000100626f6e64000000000c00028008000500f9ffffff08002000ff0f00000000"], 0x44}}, 0x4000010) (rerun: 64) 1m54.674473656s ago: executing program 4 (id=1250): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0x3}) mmap(&(0x7f00003e9000/0x3000)=nil, 0x3000, 0x100000e, 0x12, r0, 0x100000000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') r1 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) quotactl_fd$Q_SETINFO(r1, 0xffffffff80000601, 0x0, &(0x7f0000000300)={0x100008, 0x4, 0x1}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000140)="bad104ec0f20d86635080000000f22d8b800008ee0baf80c66b84a50ad8b66efbafc0cb013ee66b9650900000f32f30f35660f3a0c7500fcba6100b84f00ef66b93d0b00000f32baf80c66b8d87c528166efbafc0c66b80000000066ef", 0x5d}], 0x1, 0x49, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x54, 0x0, 0xfffffffffffffd9c) ioctl$KVM_RUN(r4, 0xae80, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000005c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x400000}) writev(r5, &(0x7f0000000580)=[{&(0x7f0000000000)="228292", 0xfff6}], 0x2) syz_clone(0x104080, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0) 1m53.231662692s ago: executing program 4 (id=1256): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 32) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) (rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) (async) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x48c00, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000100)={{}, {0x0, 0x3938700}}, 0x0) (async) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0}, 0x18) (async, rerun: 64) open_tree(0xffffffffffffffff, 0x0, 0x89901) (rerun: 64) sendfile(r1, r1, 0x0, 0x200000) 1m52.641220332s ago: executing program 4 (id=1260): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x0) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) (async) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000200)={0x8e, "00005c02ac56f967e45706449300004ed82ff400"}) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000f40)={0x101, "7bb9595931028deda525e19bdeffafde2500f6d15c9e31df9454310ad7c18e65", 0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r4, {0x0}}, './file0\x00'}) quotactl_fd$Q_GETFMT(r3, 0xffffffff80000400, r5, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000000)={0x0, 0x1, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x2, 0x4, 0x400000000, 0x4, 0x1}, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) 1m52.03272331s ago: executing program 32 (id=1260): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x0) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) (async) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000200)={0x8e, "00005c02ac56f967e45706449300004ed82ff400"}) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000f40)={0x101, "7bb9595931028deda525e19bdeffafde2500f6d15c9e31df9454310ad7c18e65", 0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r4, {0x0}}, './file0\x00'}) quotactl_fd$Q_GETFMT(r3, 0xffffffff80000400, r5, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000000)={0x0, 0x1, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x2, 0x4, 0x400000000, 0x4, 0x1}, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) 12.70777877s ago: executing program 0 (id=1578): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) r4 = syz_open_dev$sndpcmp(&(0x7f0000002440), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS64(r4, 0xc06c4124, &(0x7f0000000c40)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x200000, 0x21) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000540)={{0x2, 0x4e24, @remote}, {0x306, @local}, 0x34, {0x2, 0x4e20, @empty}, 'pim6reg1\x00'}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r3, 0x0, 0xffffffffffffffff, 0x1}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="0099c400", @ANYRES16=r6, @ANYBLOB="01002bbd7000fedbdf252500000008000300", @ANYRES32=r7, @ANYBLOB="08003500030000000a00060008021100000100000a000600080211000001000005000800050000001a003400d27f582d6c1dfe04eb60f146c9e054891670e1abb1000000080026007109000004002800"], 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x40) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000660001"], 0x1c}}, 0x0) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, r6, 0x8, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xe, 0x74}}}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x44}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x56}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8080) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NL80211_CMD_RADAR_DETECT(r0, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x30, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x2e}}}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x800}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3b6}]}, 0x30}, 0x1, 0x0, 0x0, 0x100}, 0x20000001) getsockopt$inet6_mreq(r9, 0x29, 0x1c, &(0x7f0000000440)={@initdev}, &(0x7f0000000480)=0x14) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) r11 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffdc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x49, 0x1}, 0x48) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffbf963}, [@call={0x85, 0x0, 0x0, 0x41}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r13, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r12, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r12, &(0x7f0000000000), &(0x7f00000000c0)=""/109}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r12, &(0x7f00000006c0), &(0x7f00000003c0)=""/14, 0x2}, 0x20) sendmsg$nl_route(r11, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20305, 0x10802}, [@IFLA_PHYS_SWITCH_ID={0x1c, 0x24, "41cddf442e6429a0946ad3c626cd289290f74e0f81c17c68"}, @IFLA_LINK={0x8, 0x5, r10}]}, 0x44}, 0x1, 0x0, 0x0, 0x404c000}, 0x0) 12.020803861s ago: executing program 0 (id=1581): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2083, 0x10056}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_CSUM={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x40050}, 0x4000880) io_setup(0x9, &(0x7f0000000140)=0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000180)=0x7) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xcb4, 0x81, &(0x7f0000000100)) restart_syscall() socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x5, 0x1000086}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) pipe2(&(0x7f00000003c0), 0x80800) read$FUSE(0xffffffffffffffff, &(0x7f00000004c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x4002) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, 0x0, 0x0) mknodat(0xffffffffffffff9c, 0x0, 0x0, 0x0) pipe2$9p(0x0, 0x0) r6 = dup(0xffffffffffffffff) write$FUSE_BMAP(r6, &(0x7f0000000100)={0x18}, 0x18) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x62, 0x5, 0x338, 0x150, 0x150, 0xffffffff, 0xa8, 0x150, 0x2a0, 0x2a0, 0xffffffff, 0x2a0, 0x2a0, 0x5, 0x0, {[{{@ip={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'veth0_to_bond\x00', 'wg1\x00'}, 0x0, 0x70, 0xa8, 0x0, {0x22e}}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x2, {0x9, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @gre_key=0x80, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @rand_addr, @broadcast, @port, @gre_key}}}}, {{@ip={@loopback, @multicast1, 0x0, 0x0, 'nr0\x00', 'macvlan0\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @private, @multicast2, @gre_key, @icmp_id}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x398) mount$9p_fd(0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, 0x0, 0x0) io_submit(r2, 0x1, &(0x7f0000000480)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f00000001c0)="ea9cd332d77c17f134f19fb7627bb029ccca57cb320fe1ec28ff3d14371e2e2d4ea73f4139e4d79e1fce7dc482889899c1d6bcc147255b8beb64e29c469c8e6cd85759f35c0a5dfa", 0x48, 0x7, 0x0, 0x2}]) 9.68856382s ago: executing program 0 (id=1586): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x3, 0x3, &(0x7f0000000740)=ANY=[@ANYBLOB="7a0a00ff00000000711093000000000095"], &(0x7f0000000480)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x64}, 0x94) socket$inet6(0xa, 0x1, 0x6) (async) socket$inet6(0xa, 0x1, 0x6) socket$inet(0x2, 0x4000000000000001, 0x0) (async) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)) (async) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) prctl$PR_SCHED_CORE(0x3e, 0xfffffffffffffffe, r2, 0x2, 0x0) syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0x1f91, 0x0, 0x0, 0x288}, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_setup(0x499, &(0x7f0000000400)={0x0, 0x1f91, 0x0, 0x0, 0x288}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x16, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0x81020000}, {0x65}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x2, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x14, 0x0, 0x0, 0x80000006}}], {{0x7, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380)='devtmpfs\x00', 0x4000, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x3200890, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x262) (async) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x262) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) read$FUSE(r5, &(0x7f0000000a40)={0x2020}, 0x2020) (async) read$FUSE(r5, &(0x7f0000000a40)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r6, &(0x7f0000000240)={0x10, 0xfffffffffffffffe, r7}, 0x10) (async) write$FUSE_INTERRUPT(r6, &(0x7f0000000240)={0x10, 0xfffffffffffffffe, r7}, 0x10) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) socket$inet6_sctp(0xa, 0x5, 0x84) (async) socket$inet6_sctp(0xa, 0x5, 0x84) 6.017288755s ago: executing program 3 (id=1596): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc20e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x49, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x3, 0x4, 0x1, {0x22, 0x1}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x95, 0x0, 0x10}}}}}]}}]}}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @local}, 0x80000200, 0x0, 0xff, 0x3}, 0x20) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000380)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x28, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kfree\x00', r3}, 0x18) (async) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000040)={0x200000000000001}, 0x8) (async) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0xc}, 0x5}, 0x1c) (async) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000000100)=ANY=[@ANYRESOCT=r3], 0xc0) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) (async) setsockopt$inet6_IPV6_RTHDR(r4, 0x29, 0x39, 0x0, 0x0) (async) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190a01"], 0x2c}}, 0x8004) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000305"], 0x0, 0x0, 0x0, 0x0}, 0x0) 5.807819182s ago: executing program 3 (id=1597): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) (async) bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) (async) setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, 0x0, 0x0) (async) ioctl(0xffffffffffffffff, 0x20000005, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) (async, rerun: 64) r2 = getpid() (rerun: 64) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x1) (async, rerun: 64) read$msr(r1, &(0x7f000001aa40)=""/102400, 0x19000) (async, rerun: 64) r3 = openat$smackfs_access(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/access\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f00000001c0)="5febd0a274ef68c04bcf8714eaffa77ac14ffc0444ada297c0dc4c25ad1d324d8a3af7fffffff2179674faf663285879ce4c181a2bcd", 0x36}], 0x1) (async) ioctl$SG_IO(r0, 0x2285, 0x0) (async, rerun: 64) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000080)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}], 0x1) (rerun: 64) r4 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfad6, 0x0, 0x0, 0x1}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) (async, rerun: 64) io_uring_enter(r4, 0xdb4, 0x0, 0x0, 0x0, 0x0) (rerun: 64) 5.5684072s ago: executing program 3 (id=1600): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x300000000000000, &(0x7f0000000100)=@base={0x18, 0x4, 0x41, 0x0, 0x1, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4003, 0x1}, 0x48) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r3 = dup(r2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000000)=@x86={0xfb, 0x7, 0x1, 0x0, 0x6, 0x3, 0x4, 0x8, 0x1, 0x4, 0x4, 0x24, 0x0, 0xfffffffe, 0xffffffff, 0x78, 0x8, 0x7, 0x6, '\x00', 0xdd, 0xc}) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000002c0)=0x10000) r4 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) r6 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100}, &(0x7f0000000040)=0x0, 0x0) syz_io_uring_submit(r7, 0x0, 0x0) io_uring_enter(r6, 0x48e9, 0x0, 0x2, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_io_uring_setup(0xd8, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) ioctl$FS_IOC_GETVERSION(r8, 0xc0105b08, &(0x7f0000000040)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.362612107s ago: executing program 2 (id=1602): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000003c0)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) socket$inet6(0xa, 0x80002, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000e5b000)={0x2, 0x4e20, @multicast1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x2, &(0x7f0000000480)=ANY=[@ANYBLOB="850000008c00000006120000", @ANYRES32, @ANYBLOB="00000000000000feda90da0000000000850000000dd70100008030eb020a57"], &(0x7f0000000200)='syzkaller\x00'}, 0x94) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x484842, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x4000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) execve(&(0x7f00000190c0)='./file0\x00', 0x0, 0x0) r4 = syz_pidfd_open(0x0, 0x0) r5 = pidfd_getfd(r4, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r5, 0xc1004110, &(0x7f0000000040)={0x0, [0x2, 0x8, 0x5], [{0x0, 0x0, 0x0, 0x0, 0x1}, {0x9, 0x0, 0x0, 0x1}, {0x0, 0x3fffffe}, {0x7}, {0x4}, {0x0, 0x9}, {0x0, 0x1}, {}, {0x0, 0x7}, {}, {}, {0x1000000}], 0x20}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000280)='xen_mmu_pte_clear\x00', r0, 0x0, 0xc}, 0x18) r6 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x22400) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x127081) close(r6) 4.278030716s ago: executing program 0 (id=1603): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1e, 0x1c, &(0x7f0000001840)=ANY=[@ANYBLOB="1800000000000000000000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b9af8ff00000000b7080000080000007b00020000000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000006200000076000000bf91000000000000b5020000000000008500000085000000b70000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.276724509s ago: executing program 1 (id=1604): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() (async, rerun: 32) sched_setaffinity(0x0, 0x0, 0x0) (rerun: 32) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) write$usbip_server(0xffffffffffffffff, &(0x7f0000000040)=@ret_unlink={{0x4, 0x3ff, 0x0, 0x0, 0x9}, {0x5}}, 0x30) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) (async, rerun: 64) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) (async, rerun: 64) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x141) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) (async) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000380), &(0x7f0000000740)=0x8) (async) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/77, 0x0}) (async) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x8080000}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000180)) (async, rerun: 32) r4 = syz_genetlink_get_family_id$devlink(&(0x7f00000007c0), 0xffffffffffffffff) (rerun: 32) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000800)={0xa8, r4, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [{{@pci={{0x8}, {0x11}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0xa8}, 0x1, 0x0, 0x0, 0x80}, 0x8810) r5 = syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_DIRTYFB(r5, 0xc01864b1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) mkdir(&(0x7f0000000100)='./control\x00', 0x184) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x18, 0x21, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x100}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@map_val={0x18, 0x1, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @map_val={0x18, 0x8, 0x2, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000340)='syzkaller\x00', 0x3, 0x0, &(0x7f0000000380), 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000580)={0x0, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f00000005c0)=[{0x2, 0x1, 0x1, 0x6}, {0x4, 0x5, 0x0, 0xb}, {0x5, 0x5, 0xa, 0xa}, {0x4, 0x4, 0xa, 0x2}], 0x10, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000700)={&(0x7f00000001c0)='ext4_fc_replay\x00', r6, 0x0, 0x5}, 0x18) (async) open(&(0x7f00000000c0)='./control\x00', 0x573382, 0x113) (async) rmdir(&(0x7f0000000280)='./control\x00') (async, rerun: 64) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x1) (async, rerun: 64) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000600)={0x17}) 4.275095933s ago: executing program 3 (id=1605): openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x410042, 0x0) (async) chdir(&(0x7f0000000040)='./file0\x00') (async) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r1, 0x5760, 0x5) (async, rerun: 64) setxattr$incfs_size(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), &(0x7f0000000140)=0x2, 0x8, 0x3) (async, rerun: 64) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x501040) write$sndseq(r2, &(0x7f0000000280)=[{0x1, 0x1c, 0x2, 0xa, @tick=0x8000000, {0x2, 0x7f}, {0x5, 0xe}, @note={0x7, 0x8, 0x5, 0x0, 0x2}}, {0xe3, 0x8, 0x9, 0x9, @time={0x4, 0x7}, {0x37, 0x10}, {0x1, 0xc7}, @ext={0x99, &(0x7f00000001c0)="c970186dd0d54257e4f47ad7565fae6c06444e2ccda64a3a624850c06246be1a08984051943494c1aeddb39b8ff0cc7e3c5600b1cdc11a54ea80693d42c3d3882d3053e69f605d2593c1043b9be67c59d50d7dc0bb8744a4b3317d314ef408bd241ae836b11b567d4b0863f6b431b9a056e49c7afde3394dd6fead3699cdff770206ca72ac893ce6882f607ab24c99a1095b0cd8834f683f9d"}}], 0x38) (async) ftruncate(r0, 0x1) (async) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x6, 0x1c, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x72}, [@map_val={0x18, 0xa, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1}, @generic={0x33, 0x1, 0x5, 0x6, 0x3}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x6}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x10000}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @alu={0x7, 0x0, 0x1, 0x9, 0x8, 0xfffffffffffffff4, 0xffffffffffffffff}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x2}]}, &(0x7f00000003c0)='GPL\x00', 0xffff, 0xa0, &(0x7f0000000400)=""/160, 0x41100, 0x14, '\x00', 0x0, 0x25, r1, 0x8, &(0x7f00000004c0)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000500)={0x4, 0x7, 0x4, 0x7}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000540)=[{0x1, 0x5, 0x3, 0x9}], 0x10, 0x4}, 0x94) (async, rerun: 32) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000740)={'erspan0\x00', &(0x7f0000000640)={'syztnl2\x00', 0x0, 0x7, 0x7800, 0x2, 0xfffffffb, {{0x30, 0x4, 0x0, 0x4, 0xc0, 0x65, 0x0, 0x1, 0x4, 0x0, @private=0xa010102, @remote, {[@timestamp_addr={0x44, 0x24, 0x47, 0x1, 0x3, [{@remote, 0x4ce}, {@private=0xa010101, 0x101}, {@private=0xa010101, 0x2}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xf8000000}]}, @generic={0x86, 0xc, "0fc6658efe68b580a4b1"}, @ssrr={0x89, 0xb, 0xe0, [@empty, @private=0xa010101]}, @timestamp={0x44, 0x18, 0x46, 0x0, 0x1, [0x783, 0x1, 0x8, 0xffffd04d, 0xe]}, @end, @cipso={0x86, 0x57, 0x2, [{0x0, 0x3, "8f"}, {0x0, 0x11, "f7bf9d2cf9702c792e735efdc9e2bc"}, {0x6, 0x2}, {0x5, 0x7, "d3a1ec9f22"}, {0x2, 0xc, "4dff7f0d6de950c35966"}, {0x7, 0xc, "9867acdfe7e1b9a34ac0"}, {0x1, 0x5, "a1b6d4"}, {0x0, 0x3, "bb"}, {0x7, 0xc, "678a5d4a12e4712c4663"}, {0x2, 0x8, "1de048a58fcd"}]}]}}}}}) (rerun: 32) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000880)={@map=r1, 0x1, 0x0, 0xe1, &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x0, &(0x7f00000007c0)=[0x0, 0x0], &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000840)=[0x0, 0x0], 0x0}, 0x40) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={r3, r4, 0x25, 0x2, @val=@tcx={@void, @value=r1, @void, @void, r5}}, 0x1c) r6 = accept4$ax25(r1, &(0x7f0000000940)={{0x3, @default}, [@default, @remote, @default, @remote, @netrom, @netrom, @remote, @netrom]}, &(0x7f00000009c0)=0x48, 0x800) (async) r7 = socket$alg(0x26, 0x5, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f0000000f00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000a00)=@deltclass={0x4bc, 0x29, 0x200, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x7, 0x4}, {0x8}, {0xfff1, 0xa}}, [@c_atm={{0x8}, {0x14, 0x2, [@TCA_ATM_FD={0x8, 0x1, r1}, @TCA_ATM_EXCESS={0x8, 0x4, {0xffff}}]}}, @c_atm={{0x8}, {0x54, 0x2, [@TCA_ATM_HDR={0x35, 0x3, "35b0917c1af6b9c0874b4beb29e986dfba170f595b7582a607bbf081a580c8067b102d150934f3e969a4534504c23517ea"}, @TCA_ATM_FD={0x8, 0x1, r6}, @TCA_ATM_FD={0x8, 0x1, r7}, @TCA_ATM_EXCESS={0x8, 0x4, {0x10, 0x9}}]}}, @c_cbq={{0x8}, {0x418, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x8, 0xc, 0xffffffff, 0x9, 0x7fff, 0x4, 0x0, 0x1, 0x975b, 0x7fffffff, 0x9, 0x54d, 0x5, 0x9, 0x7f, 0x5, 0xfffffffc, 0xbb1, 0x5, 0xfffffffa, 0x800, 0xfffff540, 0x8, 0x9, 0x84, 0x4, 0x10001, 0x0, 0x764, 0xffffffff, 0xfffffb52, 0x6, 0x8, 0x6, 0xae24, 0x3, 0x101, 0x1, 0x1, 0x4000000, 0xfffffff9, 0x1, 0x1, 0xc000000, 0xffffffff, 0x8, 0x0, 0x6b3, 0xdd, 0x3e044b32, 0x4, 0x4, 0xefc, 0x1, 0x0, 0x4, 0x40, 0x0, 0x8000, 0x9, 0x6f93, 0x50, 0x80000001, 0x1, 0x7, 0xa8d6, 0x6, 0x4, 0x72d, 0x3, 0x1b, 0x0, 0x4, 0x42, 0x8, 0xffff, 0x0, 0x3, 0x1, 0xb84, 0x1000, 0x3, 0x0, 0x2, 0x3, 0x800, 0x10, 0x8, 0x7, 0x400, 0xffffffe2, 0x7, 0xe, 0x7fff, 0x8d2, 0x3, 0xffffffff, 0x6, 0xca8, 0x0, 0xf1, 0x401, 0x78cf, 0x5, 0x4, 0x24000000, 0x8, 0x1000, 0x72e, 0x7b8, 0xc, 0x6, 0xffffffff, 0x10000, 0x1, 0x5, 0x3, 0x8, 0x9, 0x9f, 0x4, 0xe, 0xfffffffd, 0x7, 0x5, 0xffffffff, 0x401, 0x2b5, 0xffffffff, 0xfffffffc, 0xb, 0x6, 0x9, 0x5, 0x3, 0x7ff, 0x1, 0x4, 0x9, 0x0, 0x3ff, 0x8, 0x3000, 0x1, 0xe2fb, 0x8, 0x80000001, 0x10001, 0xd8277dbd, 0xc, 0xd, 0x6, 0x4, 0x5, 0x7, 0x7, 0xe, 0x4, 0x5, 0x878e, 0x0, 0x6, 0x4, 0x7fffffff, 0x9, 0xffffffff, 0x6, 0xfffffe00, 0x3, 0xe9fd, 0x98c, 0x4a5, 0x1000, 0xffff, 0x8, 0x80000000, 0x3, 0x6, 0xdd02, 0x9, 0x80c, 0x4, 0x0, 0x9, 0x1778074b, 0x7f, 0x7, 0x53d, 0x3, 0x1, 0x3, 0x4, 0xd, 0x7, 0x9, 0x7, 0x8, 0x6, 0x1, 0x6, 0x1dd6, 0x5, 0x800, 0x1000, 0x3, 0x2e7, 0x2, 0x10, 0x100, 0xfffffff5, 0x4, 0x7f, 0x10000, 0x5b1, 0x2, 0x6, 0x269ce3d9, 0x2, 0x5, 0x800, 0x7fffffff, 0x0, 0x1, 0x2, 0x342, 0x5b, 0x80000001, 0x5, 0xf1c, 0x200, 0x2, 0xabc, 0x4, 0x4fb, 0x2, 0x2, 0x5, 0xadf, 0xffffffff, 0x0, 0xfffffffa, 0x7e421ebc, 0x8000, 0x800, 0xb, 0x9, 0x4, 0xd, 0x8, 0x4, 0x1, 0xffff, 0x1, 0xb9, 0x2, 0x1]}, @TCA_CBQ_WRROPT={0x10, 0x2, {0x80, 0x3, 0x4, 0x5, 0x80000001, 0x100}}]}}]}, 0x4bc}, 0x1, 0x0, 0x0, 0x24004000}, 0x4000011) getpeername$tipc(r1, &(0x7f0000000f40)=@name, &(0x7f0000000f80)=0x10) (async) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f0000000fc0)={0x0, 0x1, [{r1, 0x0, 0xfffffffff0000000}]}) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000001000), 0x800, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000001040)={'team0\x00', 0x100}) (async) getsockopt$sock_int(r6, 0x1, 0x28, &(0x7f0000001080), &(0x7f00000010c0)=0x4) listxattr(&(0x7f0000001100)='./file0\x00', &(0x7f0000001140)=""/153, 0x99) (async) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001240), r1) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f00000013c0)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001380)={&(0x7f0000001280)={0xec, r9, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_RX={0x5}, @ETHTOOL_A_PAUSE_AUTONEG={0x5}, @ETHTOOL_A_PAUSE_RX={0x5}, @ETHTOOL_A_PAUSE_HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_PAUSE_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}]}]}, 0xec}}, 0x4000) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001400)={r3, 0xffffffffffffffff, 0x37, 0x0, @void}, 0x10) (async) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) (async) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000001440)=@hopopts={0x2c, 0x201, '\x00', [@jumbo={0xc2, 0x4, 0x3}, @ra={0x5, 0x2, 0xff}, @enc_lim={0x4, 0x1, 0xd0}, @generic={0x7, 0x1000, "723daa1df31efe752c9fb829600a1729b767b93be02b455e18dd3fdea2e4f91615c75e8da820ee5b44744fabccc7bb69cc5d7424f59f4bd2fb98c6a20ec555fad1d512dc2ab8a4f8c1cd67d2d239a9bba1256aa37394ec72709afa90427723d6ceec43f6d5d825fc365eb475be10ad238a876183754c4ee6c8d09da4faf28cbc06c86ae5eecfb0fc85be4b78e1a9603575a24719de8b9b0d0fcd1a153d83cc0d731d03eecc123ebdbbf8aa040dced797de29d8084f05feafc2d46615a9e965cb046537d83d044f141b03f3ef90c75033197d0227b446145579455005522be9f6db809117ea69e5dc142d82e2600b3cb1b7a4b374151e01b8be1457b0cdcef7aa4959341faabeceabe64a4afbd8dd5210708d4501db6b138f29aaba3536b171a250766a764538368a0bd14affc0d75f2146bb41fe934cb23340cc683965615793787dd00c4bee957697006fbac42c8c80fb6d17ea8ec183d82fb172b83ca344192e2986e2d6d548d2bb613e840e1625d92d88eca57c54f46fc9852424a59a8b5d52cb0790fceb53452c437ca16c02781b31037bf351948aacb1b5fb19dbc8749171db80a6f738c60ba5576d6c09e70e734787594ecaae92b006fb61b4b78a230524ca07987690b29b8485d4a4ace4a3b16c322780f390464a85b5d82934c189ba318dca7221144c1819123e4772efc5d850e3ea5efeae591eecd66ba51926393f5d5cb6ceec1afb581f3711b5d685c176a4c1c33579defde8bbc4b39049b8ff767317a4770dd8372c122c30e35ab89198ecc228548c0db06cbcc8a0bc7101c14e0f3260bee2170c66beacd8ad68afa7a7b1aef459376cc34ed74a6e130db246ffbda58a0b088d36b077e8dbd2c254ccfb81e765670e1c3361affb3fe069082d3ba08c1595c56baf39e41831f0eb600458bac7effc2f48be4edef2e68a67c1fc49f043dfa6acf68d4c791888cd53858316b6db7ff33ae4ab36a69fe7afe42cbedc5f8a7e2f26efabc90eba7120c565aead8c864d7de4c5777b6b212acf9638a0aa7ad6171550a48dcb08d12ebad394f7ff5c79a7a8febd225ce634287bca3ffd38f654d2b7713c6b141796da7973f1bd1868366506d3eacabe2d854cbb9e3c50c6dcdb9a003ac8f218ebafb344579aeb19f4753e59bd212db0726332830e43af6d187dda12be71e9c49a3eaa01c8adb378f3c2a776dce4d0cb7a155da57c6059f000e5ce9f170517aa99224647f160c3b78c03a766761b1c5f5b311e118433f71d72eb5eaa9f44a63e32fafb00b8c82973f6e18aa9e2789eef054d51965243f37cd58bd43aeac5bf554e4dadaab6f442f8b6082e6d6730cebdfeecd0c570989fb13f3dbd56c983b66698e423f6c60905eb654c30fa831a5f744e32de16ba51c2017893164a69380aa3bfe7c396d20f54d1adf6ca68aada503e8104eb0a82482668dbdc1f9ee1c5c8c7b353a13163d9b244bf4fa29c6503ec7110784a910496f6e2e270cedb9786854f43022af89f42eebdf8035b8e91801378cec4d9e805e1541da7bee8606e0a3a46c2b0aaa473d31c005003dcd8c11790d69b06e3c42702ed11d5aa919391d83def028cca332b3ed6feb2c41a477d14edd36e4cb28ffff1d636ce317ab43eae482f8c8c1478ca15cce3e09a40eab850b16207d3b66d02791739a5579f6dc0eede5d9cddfaba45faeaa52bcae50ba6ad1396a0bd61ba5dfdf3ff9e411336fa9de046a5d9bf93193d932099a5a4cc72fce46662d7c58dfef345a5787be1f5663353438d7f23ca76bea97cc8689046922786e996a5722b57cf5944158d9c765f3827ca570ad13f8f055edd435ad05a838cfb6f669b03855d21b512cf3d7ec88c11cdfb2c819810f6b244836830eeb3a00e02f1706ed2c13140ed69940f19ac321f4c1b49fc7ead7cfce1b0964f67e61d9066207bea2c75e4710b125422ba4d152c2ca76c757f56b5e51a56473bb0647d5b966b754f4769707b04b2da4cc55510702dd98322900929eb0acaac0d8b38d66c5eba92be0f22bb7a82e561bbadfe5ca2144ca0b1d57f1ab6f20bfb4dcd7c5190b95972f983771a9febeb8af96afc10be57adb9e604531a20b5800345a78a5217fd3c78c3eb43c6105b050cf74f4411183b17605ed87e5628663c870225c36e04235991df15750d6a3b7f089ca27a0b527dd5374350281f9ac7104c43fb03a72ef525b628cf42d72eb79e1a01b199dd39f394548a91c98f630d1a5eff3802e3eb851b2e0b975361b8b4bd167f7a57ebabb1c1d93404a5d085129b5f5e78c487835dce20350701f5a265bc8db5ed49abe6571a731c1b904e97b6cb61f6be2051029e3c20b60783edacc7fdc7161747eb03aad96ea048e6ac5f39fcb636da56d523e8fc9d5d0a95eb7e08b289956ef94210b3216b3c6383f6d77ad3e83d936e15ec78b0528476fd8108c7c8b58ce05e548f80bce53d2daeb5f19d9db0a540e811fd92c6f96c760444f15783b17dfae6389b4689c88d3cb65893f43ba04ce20894c27a42eb17cbdaf76e610c93276fe6b24d61bf378b995b70f80f664aeda849281fe91d9399feae26139a6551607af6a187759bff76bbe9806b4f5043bfcd2396c2a0566c191790bdd50985963ff59e35372f139a51d50e120b357d25a6c50d7e729548674b5f5c7429ca2828fbd5d8fcae4db5d8f27496065380a8175d1071d5a756bdb576a279b103a98508e0bf4a311efdcbbdb8c7fe36312f302db5cab855eef51b484061792799c8cd0ccfe20d75213f32f91b0a8792cc2f9e01f17c8c89a8302e0c98b247f402e9cef5a38aa99b4194e425d2da2be29b5e0f0465f15eb9eafbf60b2da69d2ab9a377ea75fa50583fd716e989769fef4ebc04913cb5d0529755d848d7b0f730db7855f64d4b3faaa90f1bf4c096e690ea795d5961a3c1776ba6d4b8ba02b4fa5be49a5fb4e9b80780cca20498ec18cfdb939dabf9eacd0d9ec3ed5febb982f9db705b479203de3bd1da00b444976db923119187bb0364a25891c0f2b0c7e3794d8a3d1ac821d15ffb48cc8bb7737ef63b39166c23fe7c06f2d404dea8354bc5bef19aaac8f7eeaac83caa47464031dcbe1e078540e2a236b7392cd6550c28b7ebee46afa80cb66307afce4f4ce532ff3934272c84936990d3ef5f67001cff2af789bc54ef3a2873e0c2a44a272800deaacd4bc4b4c3dbac397eb49b2d55c8d8aa9925261bacdd6264c46997531352fd64b65aaec4cccf74413b7473f41f611df8014599ff35f7e005b8c115ab5ba6cfaaae61928abb612c2259629f6bbe18ee58b32eea3abff851f8288c11e569b7a598f9943fa09dfbb69a46c60e7a9c3009265e451ba5df236853288b7b9ba11216ed1711a82a9b97a1b614c518801f8fdc1b30a5b8f7a1b5b10418c84c8c0b37dc89b3d52bc21149f14919db658966999290a18b77e6199f047c8dd47a9a91b5b6140e355978ec8db14a1ea8c45fd7fd06e644b4477bdf18da66cad37dac641e34ec6814ed75b58b28f84f1619afa9595bc9615c22025c9017dd89c851db962352aaa0a01a656010d0c99e771beda1da048830d52b84fff5faaa043b6d622b8cf907dbc6daf0d302cb577f0caaf8cd3aecc632c22a90d142f1b37334907d7bb12d4c960237168bbfa01134c459c7f34fa8b978a4041d3456a3c0077f347a97a1b34c68b794dc9879e24cef33b9b88394714910e3093af1f53a8db0304f84198b7fc62bf081d07632bbbe2c70632c93d2ed8e430e5ef3694540b0d20986af66af7a55788a065cb9182157d8d1834f410693c0231389157a19cabdec1d7451a23575252e4c8462b3273ec869ecbf341d8a91277056c85c56285f8b4bd3ec5bcd90211877cc6f4adf82706b26bd834590dd6bbe2a83dc0e46158771c5dbce8d2ea09595e0cd80217f6382ece2677086275ce144444b6911530bd80c73e6be5b1e7d98228fb6160e2736ac33d6da91798be277e84d8b6ee6a7370a7b25cf598f2acd7420ed5e46bef96115e113da35ad7ca6a9b609ebf2723efe9f63b57fec82c7d2fa76043d59c8f9e0902174a3ac8a426f4b4d718ed241b9fadea7b58687cd0b81f827a4bea7d60a6537750123246fe63784800cc5efb7c85638737f411cbfd2627d9cf0d5981a5495689a13727445c755082d8463c4c6550b1049e4eab6ed07e79e8c5563b3271031b31184fa971081ac5cd46a49f264851c7a6654e58861463378a838188063f4f8de745164530beba9ab51bd30c3110090868933734a8f7d6c661f945645ed58385fa04c2a653427c030372058b49ac084df0fc05c01013cdd70f07a9ec3559f0456f7b4374595592563ddd7d632f526019c77075487f598bfcfe0fc3b002471d03059913f7e02e98696d67d1061a34e113f9faa64b6ccd0cf504a57235153820ec73ddad16c8d5ccb5a2b4b30c258bdf38a945de205d8173c7727134c7fa54385525db45f7f5508f7472ae9ce4e7918fc19aaaa91a0a02113841b8343db7b7669676c38d908100e7b1cf540f4f3cd71f7566f1947ec0be67ba270e5183f5c403857ff7d9da23a817830ae6f5f9da51d4bbe6441d37fb19c007287c4ec19689740daa6d7b7111b3334c2bbb6970ceaa835a9b17dd814babb65ff24dcc48c7d2922e85f5ab7c28b95102d89331d6bc00722f54bbec07b08699ce55e84a5ba68c1ff4c49fc7f901e8ccd04e04642fb1a7dff8fa1caa19313267a3ddba946211177976dc3348b9917d2037efa63d949473af941f53560ccaca27f1c77a3fd32e007d0fd21061aebdd28b2149596c035a45e5b1b3b23992d8a0bf5eeeae2623ee98f6a27616fee5b91ba8e25c5b2823227dd4d00782d0defaa227c173589308c48db2edd2c85df3e1d46caca8d0675b51a7a16cc1deb255bd0e209f220339abdedad0119cb12c6d22f7b32c814ffb759f9571edf0d86046aadbc7aa0d46d1735a80b54c0c087664265e920817e4cb4a3e2bfcfb459e7f376e47eb0d0b2914fb1618010cfbc23f21ddc10c4938388a08ae2883a6ccc4911a4c972339d82ede7447cf1bb337a4556d1fdb4c6704fa7770940843b65a02e84e1d75205763df9c7a5ef125c73e1061dad7ebcd2ccfb0b6d5821a2fe20a1367e1a168338231250a8c7a17f99998e1f9a95f36cd3b63ccf5898f364e6e0bd7e081c28bb98a38e345916d5a9b452cf73692f86b06fd2c5c0145865eb2be12eb5f7e3f3508a6e2100b2a7a4f70da792b7ab10d930b9529446ead3da5a1bcd88913bac0fec971521b158c838294253a7ee57b3b79c3d353d51f6f37ae0389676ad189ee96bf259dc607f5d9d7ea97b946d055972a503a589a3bb914da424fe6b52280663796e3b04c2282f1a4b273ced32f00385609aa611a6851c2259d680e90310fe0358b234789cc7fdcb1ae03ae96aec4c2542a3e20de18b8c62c7b01f754dc5086efe274d343cc1dfa0815ee23c5740a0150b14c02dd406b14e25bc0ef1b91ad868e4bbf7a8c098ea82448b5e7a58f80aaf27b1c25630bc69cec475e5574f9ba2fe9052323be189c059f2b030dd3d0f27a8f6bf79e9d02f7494d439561c71067c5501ee4a7b0ce226d0fc58ee16b94e0eb6f7cf85d1fa49fae29d3802dcf28458b3594c30f69278cbdaab583dd4a27c19d4c2012dabe2e7fc2793447d77401be2beac8a2717a090df82e40799056409a9587791b70b5f93a63aeb7e21a8a15daf7befbc382fba2f046c7b8250834b91454d2e43fc427a7842a930184427138ec1e68f52bbdaab6472ca2372a193afd63f793621c73430f6"}]}, 0x1018) (async) setsockopt$CAN_RAW_LOOPBACK(r1, 0x65, 0x3, &(0x7f0000002480), 0x4) (async) ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f00000024c0)={0x10, 0x6, 0x80}) 4.264876984s ago: executing program 5 (id=1606): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/5, 0xc000, 0x0, 0x1003}, 0x20) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x200087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) syz_emit_ethernet(0x7e, &(0x7f00000001c0)=ANY=[], 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, 0x0, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) accept4(r3, 0x0, 0x0, 0x80000) creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) r4 = inotify_init1(0x0) inotify_add_watch(r4, &(0x7f00000004c0)='./file0\x00', 0x144) inotify_add_watch(r4, &(0x7f0000000080)='./file0\x00', 0x20000004) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f00000000c0)=0x40, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000280)=0x20, 0x4) bind$xdp(r1, &(0x7f00000001c0)={0x2c, 0x0, r5}, 0x2a) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000080), 0x0) 4.264327449s ago: executing program 2 (id=1607): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) r1 = eventfd(0x0) io_submit(r0, 0x2, &(0x7f0000000280)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x100, r1, &(0x7f0000000100)="0000fd6000000000", 0x8, 0x3}, 0x0]) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/cgroup\x00') io_submit(0x0, 0x2, &(0x7f0000000280)=[0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2, 0x24, r2, 0x0, 0x0, 0x10007, 0x0, 0x2}]) syz_clone(0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) sendmsg$inet(r7, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000003c0)={r3, &(0x7f0000000300), 0x0}, 0x20) 4.04535878s ago: executing program 0 (id=1608): pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) r1 = dup(r0) write$FUSE_BMAP(r1, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="38010000fe0000", @ANYRES64, @ANYBLOB="f4b02b86df87851e7be7b383760d80"], 0x138) r2 = fcntl$getown(r0, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r2, r1, 0x0, 0x1c, &(0x7f0000000000)='/proc/1/\x00\x82q\xee\xe5\xa0\xbd\xc2\x98#Y?0W\xb3W\xd2\xbfP\xee'}, 0x30) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r3 = syz_io_uring_setup(0x7fbc, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x2000000}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_MADVISE={0x19, 0x40, 0x0, 0x0, 0x0, &(0x7f0000000000/0x2000)=nil, 0x2000, 0xf}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x10, 0x2007, @fd, 0x8, 0x0, 0x0, 0x2}) io_uring_enter(r3, 0x2d3e, 0x0, 0x0, 0x0, 0x0) rmdir(&(0x7f0000000000)='./file0\x00') 3.881156807s ago: executing program 1 (id=1609): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)={0x38, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x2a, 0x9, 0x9, 0x6, 0x8084, 0x3, 0x2, 0x2]}}]}]}]}, 0x38}}, 0x0) 3.147307245s ago: executing program 0 (id=1610): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, 0x0) dup(0xffffffffffffffff) landlock_restrict_self(0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x400000000008, 0xfffffffd, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioprio_set$pid(0x3, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0xc0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) flistxattr(0xffffffffffffffff, 0x0, 0x2d) r4 = socket(0x1e, 0x4, 0x0) connect$tipc(r4, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$unix(r4, &(0x7f0000004400), 0x400000000000203, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000100)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x80000006}]}, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b707000008000000850000006900000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.073211821s ago: executing program 3 (id=1611): syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYRESHEX], 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r2 = socket$key(0xf, 0x3, 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x5, &(0x7f0000000640)=ANY=[], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r4, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="9d", 0x1}, {0x0}], 0x2) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_BINDTODEVICE(r6, 0x29, 0x19, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x9, 0x2, 0x200, 0x0, 0x8}, 0x0, &(0x7f0000000200)={0x3ff, 0x0, 0x0, 0x9, 0x1, 0x0, 0x7fffffff, 0x100002}, 0x0, 0x0) write$binfmt_aout(r6, &(0x7f0000000340)=ANY=[], 0xffffffffffffff48) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000100)=""/49) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f00000003c0)) ioctl$TCSETS(r3, 0x40045431, 0x0) r7 = syz_open_pts(r3, 0x0) ioctl$TIOCSTI(r7, 0x5412, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="020d000018000000000000000000000005000600000000000a004e2400000000fc010000000000000000000000000000000000000000000005000500000000000a000000000000000000000000000000000000000000000000000000000000000200120002000200000000000000000006002b00020000000000000000000000fe880000000000000000000000000001fc010000020000000000000000000000040004"], 0xc0}}, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x800, 0x0) 3.04237841s ago: executing program 1 (id=1612): r0 = socket$l2tp(0x2, 0x2, 0x73) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x139b41, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00'}) r6 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r6, 0x8916, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080), 0x101403, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) r11 = openat$incfs(0xffffffffffffffff, &(0x7f0000000440)='.pending_reads\x00', 0x2100c3, 0x36) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000007b80)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000140)="549822c78d5b48fed1fdaea2170e7cc03dd239f0f4839ea0ac5208f67117d4f90a40def59eb46af70925e5c4745173faec5d1db19bd1be2c4274b5c1b107cd164b69470f35e2fc0353b686e9b3ce3889b2627585fb073fe3710e24f9c84023", 0x5f}, {&(0x7f0000000280)="5bdf6881dafccc239383bb3aaf6b641bae95b790ccb3dd43df129d475888475e313f54b4d75790f777785507dc31ea33fec75b4aac56f0798b4e6f0afc4d5533e1c6209005cbe3056bd6cb6448215d6b114838e01b51d246fc0ab394d7814738dd35d067e3bcfd79f5f2e3bd80b375cee88a76ba96d370e7f07ade4f65cd596bae32a90ff926ade2717558a4cd5e26e1ecb87cc2a6dfd456d14c674c85", 0x9d}, {&(0x7f0000000040)="ab6a6cc3cd2b9ae0b16a065dac7485b4a264d9fa3b495f161ef4f6cba129f0921606808ce3b9608942fe6e6a1b99bf5fb9e6c14ba0f18ee5858b780e1f17", 0x3e}, {&(0x7f00000003c0)="ffa9e2800edacca14437b342bf66cb172dbb1a0023952a832a579a29f02a788e9b1d9c4ce528d6bc23e97c83b6df89927f2d2603b3885ac7734d287fef46899eae9fce0c6bc0b25cf98957a5cd247ace577c5ce087", 0x55}], 0x4, &(0x7f00000005c0)=[@rights={{0x30, 0x1, 0x1, [r1, r9, r2, r3, 0xffffffffffffffff, r1, r5, 0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [r2, r4, r9, 0xffffffffffffffff, r0, 0xffffffffffffffff, r7, 0xffffffffffffffff, r9, r4]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee01}}}, @rights={{0x28, 0x1, 0x1, [r9, r1, r3, r10, r8, r3]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee00}}}, @rights={{0x14, 0x1, 0x1, [r10]}}], 0x108, 0x20008000}}, {{0x0, 0x0, &(0x7f0000006300)=[{&(0x7f0000000480)="b231e3c690213fa719f08d97d5639e413e8851f0f161974d6d15501c2445e3abf22cca2c111540bf9be721", 0x2b}, {&(0x7f0000000740)="1598b2895ab9a43aee134c563865622bded431228747c3eb6619d180b97d6bc5674f6316a986dc3ba54e41251e0ed5258a9d2ed16a6f98662ea6d274932cdd6134310d4a17546423aa2751a90c11c47edc13a8c42bdc1a67584c07a9706bf7f387b1c6bbbcc6389963e9d98d82a5cfa4d7dd28abae011cb34cce80397ff002e6138e7ad88200813f191c57ed89b92dfd4adc4918082ea97dc30ca1cc26f0c0a8f0723f5954f7e910cd03b54020b9f44aadac003027f4a68366deaf24b28942589cc6afb528eae9ca01595f9cbd16707dd8ef50f010ebe01e9c853bbdea61b08de8bbfc5615dd1ba20ad1a96a49b050013c1304", 0xf3}, {&(0x7f0000000840)="97d2f9a35f07f3647ac25da8668b25c572423bc7ebf1bab740425c1f5a7ffdc0a8401c2c667e2da197cec039e6b2a3c9856428540ce72f59f7a08a2b5cfa75e32f21ac753a27c724cfa1dfa1abac14311263b886682f0139d204256c9f1ef854999f5ab572d3928a7b2537d3b54de79bfbc7661dc397e2009549631c3a7977c5c82ed7235d014bd2c322d75daf973380add719282b7d43eb24a847676439c550ddca76c92e6c8dd9a6d977c175859e9d89d0353eead8", 0xb6}, {&(0x7f0000006280)="ed5cc9820b449908fa6eec7d81aee0949f688425278eacba802451605059ee5882764a7d9bf6a98c8833a50b8b4f52822ba239fbbda3ccb7d3f4b394529e9b853279170f032043096f9c9691c173e3fe574f715d6a124df695dcb0584d2f3ff492f05fa2e9413d", 0x67}], 0x4, &(0x7f0000006340)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60, 0x8000}}, {{0x0, 0x0, &(0x7f00000076c0)=[{&(0x7f00000063c0)="b9ef9f23853fd27c326ce44879ff267e846c7d9030d329ab5f074fa48be0405cd46b10f023ff9b77e8a6a58a9294457d4fcd08eb5104eb4c4a7adf9580ba435e4475a5b87063fb0953d67351d7b17a672eab0350", 0x54}, {&(0x7f0000006440)="b8d05c738cd40ad772979058a014cad32a071e688fb34a7c9b7b10ecfeca9d27b26b238a455cb9d3f00ba619f6ca80a893d7f496b5ab8d4bcf07f8a9e6efb06482393e6ace217ff0beaec65bb35df33a4b6782190e45284255cf8907f758", 0x5e}, {&(0x7f00000064c0)="ddaab51a25394cd0c37693df1a9a061b0fafb6ee20cdd60bee5027f5c2a8c72f75ade3b84011a0e0c1d6ef6bb1434b182f9f62e71b9ff87c2472c47873a9d027c9ce3d649b06c5f9778f56a36d6d3d5e816bfee0d4c95bd99d1d0bd99dfc049aab0a90414ac4d2eaa15cc92c276354d78278307a21cecb64041cd3752ae850", 0x7f}, {&(0x7f0000006540)="70d4f7206eeb56c68f7e71f0a1751d7fb8c96ddc81aa4ba13f27c4b5fd0403c2c2f0d386910f069630287830311838f4aed4dc2df92ff40ddbd63b0a745fb33ac3731a029cffc71d49e8bb6d6ade855fd61e98fa55592385be29faeac4b102", 0x5f}, {&(0x7f00000065c0)="771e714926566a065101fe5a1715eec21b50bee4509f25fd9c9f31565a9899a774702579527d6394332a404084e749848d65b70a2fbce9fea993cef1e01bf0fa889fd393a1d019daa4ac0f0cf6e4c66e4484fd09930ea8bce08a68926a52f3cf712f2c2463c14bb9714b465eb07d754910d4fb7a5371f84de00318c5c062a49c5ee91721d536e43ebd9d5005072924dabd5ae5c9386161f9472d303ab30064cd39cbee18bcdd7185f1b713c4013427e30f7673c66e44e61520d4a9a6563abca024b1303b99ebc5c56796322f71e70a3cf0fa05167b832660fba2dc9120889939b51c8acd9a04fefed6d7825c0658c556075f7feccdd0099beca7bab45864f556d9dc589acec83e2e8df6f4188776c563d9f2869ff42aa70c8bafb9ceb78ba1c2cdf2c25674a93f3ac86fc93875c3284df1f00ca18a3f7b2e325bdcab630f2da53e6156c3b049b2b37f5126a5e676d19c87d36fda8c4ab7088b092f484a60b2e7ee3442abd0efc206b01ad5d015846038f7b385fcae6ab9a3ac2bcb230865989a835ca4bef1e75113e7e61e27747650c56934f50671fd2ca7e784cdc6b2eae264eb5d3ba6a027cc123c92465fda15e8806d3147138b8155e52fc1dfdd923f99c2ead56feb56c5e853835e322a12551b916a808bce58a5c462c16b30de3a01285401c3e5a67245b04ec450795e095002bb0780818eea6e7a28e72651c5bc762cbc77764bd6b35c4f7a8b8d1cd834112e63325b87a33c0ef002e48afaf7db496698e96b018c362552203dbcc8f2c365607df0c621b66450807b453ccf7d73383643508eefd3bed327379b9d39620b3a2ec59f94ba79486e73ac9e44032919729e48baf91d9631f75108098963465d3823ce38ac18934bf5ed5ea5e1713069af2bd5a91d2dd87911ffedceec6c500b52ea25ff3a66d47bdae6faa6b5d8fe436570d9643cc896d78ad8d153f690c3ab795926e9e866cfb549e4ac9da524b0b2cde559af9955abd5d73ac73075208f5a0788a996e550c35c4e12c8569c23f28db6f2797a81a161043de48100127037075edbe6afe68c1d07d33ef77cf48a2d5f6e1d3b86f6993d6b5bf36be0faea52fae35a3c32eb3cba1b9972704e34337312f1b153156396218e01d3579816ba6bdfe6865793ee817d105c854ec2194de87a5c9e159a7a94bcbb624e5653c899d5d6398f3ea2d07bbda4c76e13df565192c7009107a2f82f8841869d00a2925d8a9fded5773a409812c0d803dcb8c2581bd1fffbf0c1fa038d3c8b30b6ce6e1ae6f391fc1dc5b6beb717f43f3248ab98d05f38f8298656fd171d2d8e654ccd5bbe751401f8add41654e18e9264da823fdb245d61475b2c9436bf774f94c773763a341306dc0d359503168f7be7f3fb9929f5f2a10c063ba341aaad62f9af75c39768dd7b5bae6f88125e31e4cb05cdd82322eac3c643eb8d2d44d4e67a8ac254654347ee8b6ccd0a25bfc140222dc0d77c9194a54411a2d6937f03edf5ce805f46c92e821bd3a031efc6536495c2c8f4f56d083b871a7895f4c2c1ab499e3c7857397c17a6951b097e2a358b357ca48d554c03f607b4eea62e19f342faa1fb2e86a4f564c462299c6b973288818b9d8a38d40676bfe23ccdce3713f9419980b51b80317cecb6e2b067ddbc0676f29eec8e1f2ad44cabb58a7d8b3e2cdbcf820da30b8efe98be40cf468590da2caa4ff77430135cbbf1ca6b474b32979cee3dc99d13472c99f474c0e02cacd6f47539a4dfe960e8b0fa3a0d0e15157c4ad45f4ca47be017a1466c0f1e1b90a809af877307fdd8b7e09876055f9d360238c29691839c7b10adafaaba427629818420af72073328a19e24c279dffdf98971974d4f31841a3e3c29616633e192cc4491f173ecfdbba8fc9d7401362cabd464a73300fc5348eeeb6da7959dc800b9273e2969d8c657b89e9c2f5975d91da06c2f67f78739a63f28f2f1a8c2c88b63902ed56f407755497927f94a2a6d6b8921984509691e5a5e0aae64b9de2bbc62bb5be7692f781e4617664a9f6bca2c13593e8c74c2c7af68771c26722e45fa520b322114d5a49c95a090edc911cc23917dbe07da9752058b97fc8add2c204f0f4f5f46599b9c0f37ed93f701fd6b5d62a563901f9771e57dae66b9f224035548c5f56c30acdc73099ef744832c4ca9f6f5d60b45e81bfed164b5afcbe7ee2f9addbb0171b5e1fdc36cda44e179bac5bd48f796e9a71a3905aed4bac68f6f78e17c6c3176452426264477cda310e1448c7bb95589dbc97916566b26875f671176da32805723e6170f31d6fad4da71ae7b43ea938eac20b5e2246ca65518371a3fce2c06e4891cdeea51cbc98428c6b58032118d1b386ff9711d1959e8117ed1004cea8c3b76725ae1788243587c9fd70601f7d43fa3ab90c5dc326fc8c9a1556190fecbe2c0c5bdb61d66c3558c2287f4f30660a7b8ca0861f8c92c59604355a51c1b4940ae9ec9c56ed4c959143f1991a8d01462d9cd19fbedd0435edfba72d355434f1e3fc246322964f0367e632f31174703103b3adb0bc7dec78a09bd27d6a145ce7f76fc78bac22f20f7161986cc891b849e85fc0d96b7e09a240d2690b933819b76d20702eaffe9e1c9dba5ebc2b5dcb9d5f2253cc76db187ecbea18a4d3b032c5c86b48059afcd718524966a4a3871c303f39ff7c4bfdb913c4a03f2339cf25d9ac1d5c15407e7e5865212c08bd71c7c3868a45a1b14b231fc66ba92f91223847918f317f50f921b8f15bc5336a780ea898ebf61454e2017e0207d58ff452a61ac05fa642e610c8ce4a2e742c291f7f5531b6705e6a90e0e861d17861822c975a11e0e148289f11357c6cccd763d6224b25f08fcd373d28ea884d1a2d5ed903a43daf8143062386faf290bcdcc11e2b812e5ee2abe4f4fd61f7b78b53b63385bd8b4d8d07b9cb5a8d8572d4ea594a81f65d27c8710b74c0c4d176628d52bcf74203a9533fb2aaee1978f6b88351dc4a133e8b885b150b8dc06cc31edb0b8210d65b2662fdabfb134b33868987f24464915778585e50f5e9858745431470639e378e5f162639f03bd0af710c13b2b33dc04b5fbda7028c1ad74f6cbf33df80992c15d8fcb9e93e15642deaa470eb267ac6043910a6d6135197bf726332e6927d70e6fa6ce931b49f4f252cff99ce9d8b90dcdbbdc889a0862a41bbc2710ee98dc7e6ffa5156b17292374cd398b829b0e4ae101880319be2d925d598cc1961ca9d9b25b9ea7556b62a0a475cd7a3ccc1cfddef6abdf163d10139507f6d5dcaddc479d7a3a5482412a56341026ca941c3e014a3bd3ac944c80e091cacd26ac0dde8cd039c41f5e481a5208c31f7d1a63f324ded549021cb6d0dc151013ede796ce2e0f52feaae1541ee5a69fc6204f8bc3149a08d72f6b9863c3e71603e39c4f2c6bf11f03f48143055af71fa20ba628bd86974f38819433927ca3187caf5bdc7aaae0cb7e5d95a0a8a881ae18ea81ab1de85e79956384f1acd14e368f88211dfc43315c4ebb93bd3bb3e1161716b9f2c2bcbad676b8d6fac863ff64402958f46737be28e0fe370808fb5b7dc48ff2c6bd04522c9156609e36ff9f2decdaadbae2afda1270e8fc3b771eee128cf74994c532c5a86fe39956e974a889f5b1dcd2d6ed4d753991ffdefb6a3209241fe55bf31e0e0dc894e563399c37ac71a8f72b764fe23b73fc3ba5820d4d5e9230fcde59047d60070b4c873292af12f06e461e0820c460184f2593a1d36cd1fcd50c0327ec8cf20ed3afeec606ad21f37c53d5394e62170090eab615f936bbf05d3e1e358993b9900f794207d6d159ad04b8ad6ab13fea8eeb2c825d1b736babde7b95efb936791693692371057ba079246ca271791eb167316ea84ce067d7be81cc95af43cb89ba9fb18d32b2f9243a977a583a411bc10cb0a912cb77d4fb7802dc86b4a2876bcff37a51df48580aa194008bf2d2dd4ed68a9485f254ea339ec7f12880f6d8eac956fc4dc3268151457389c715ac2d228191a828a60e91a813c44f5873b3b8fb4dc33286094d26047a33096313ea0da32323bc1e96ae5961380443f57667517a3e9dba6947ef56ca10384d96a80b601c175c76bf27e7086c9d2d3a630be717703f2e7c45a736eb53a7c982e85ab566b7469124da34fa26d3fc879891d6838a35c394ed7b96a7c403e2ac5b1cab15c367c8fe57839410a9e0d6b768bbc2498678ecab920d6e722b9759837539c3ff0c2513f7e78819179531c0c8a02fc70b71f5d0d2c9d26c33f66bbb4ac0f9019062cf8e3be2b6d839d2ab3fd0b027eec1904442a0f44b9f6e9051aad3df5731a57e05c965a412fa60e670f5334f2e74414c72b26b7c3157309b79bbcfe5fd6bb25327a66d1427f1a44ca8780f664c73c07293eb688c709c9562e1c16cb8a69021eca9f984cb3b7154bafa846cf9b6776616af0983b1e31e25dc463be5cf36a54089d2533ac9218835f1e3c159cd02c96da3cfffa0b35023d0610e1e6a001140596c51023f0d77bfe9301f638d2575f658b32f5c3c045e666ca6a87ce3b31ee1c8cf0e21ff4a7f78e4065634ef7aa4212885da7305758a1643339a5f1cd570ec86a9aec8024f33d0cb44186c65969d2640e11b08c3e6ad9eb64998be249de97e29227296cb88efcb92fff6c8f9690672a559f2cef78dfa8da9837faff88e2ad91eac2f2f6f23415702da3c201669cf00681e94993299152876016fa551d5c0978302a3a41103c911cf1849fb88558531274c0dc757ea46eafad8873fe267909d9f818f44848b47e86190eaf4adf36d59179dbcad73d69a83d95f6c9e84f8fc9954a4ed299e09b43808696b0e3d0e402d8e3b43294f789c58199747574b20d2bef690356197d9596ec57874c25dc273c4f954aa1444b506b4e5edba527cf0396ff40be653085a9b0cbfdddeacc0e9297633330d9bdc68825edfbe168e828622af8134ad36e9c49d611eafc0c7897fd157f406d8dd4457f67acc1eebe1ef4df1428cf837bc2d9e1b97b58a361046b6747d086ee61774372f978f96d2932406142c460d12e1267b220b379a5a3718a440646f8788cab16c81c372aa23cf95502dce1c8d329c70caa23cbda7c2284581accc0988e3867de36ffd183ac394cc716725a3f6da49aa1ec280bd960857f00a46623dd3d42038c01ab688b33bbed3f52502c72d67224196c0fb7a5a549fdda36d3dd5c75758a5df60e4c372152ae42a7a0270a5d1b03d777a30a4b20f56cd9794a3319a7badee0875fed1b749d17b0462a5b1a34e2edf80366b7fd072274c3377af76a3156a14eb68c0d8f609c46bf78e69f0058638550de0c850b37f705b955f905351344dea39e87dc22cce3ac79ab02ac4551917eabc07dfbaeb82790765345a05bc4463b08bf4884e5e0729d365a83d3c0680e551e3a0039de5dbc21dc8373cb210802856a091653ec1e9770c8980d71e1e5f9b09f54d5d079b06895622766ebf2795f6732e5958764665f6b63f0fc5fe8c1faf0f6dbf02ed0ef3ccfdd2e40c7fa6c5c1c7a49c7c043d45f0d61ae3550e5d0343438a172d80b4e34228a2f58d215bb699bb66bf36fcd9ffb6759e4ae040897b785c6ef1300d1d6d9d80796ba15e8e6d39aa845275192bf1f1be6e253434b0ef002935f0d78fbcabf7d4e85d7a336e40b2057a040fcadc6f071048cccc5463dcb373c923712a440436c2bc150ca5433ed5a0e155fa5fa81aba913e44462088b2dc2743a8bdf646ef1c0d3b6fb97f6e695dccf170fdcd653dff6940d53855ec1f5cbe5b8", 0x1000}, {&(0x7f00000075c0)="d0ac802fcdbdb7039926d4de4428fb1b4746e483077b8715f4769fcf411b0150f8972e6ede184dde6fb93f30060197bf38cf5d747750366e6e3b3848ec60ee2bc66acbd3aac0834e49383e63ef54e99bfa217d3120f3a199287ec4cf9afd4066e745", 0x62}, {&(0x7f0000007640)="f52ec8727b4bfd55d99c7b47488a24661021a53e837545d937ceecef24538126a4479240ff96bbc5c197ad0a23a1ef79f0f9828d817486d05000b1173e1fbf4c0530808d127c033ec799acb7b7ffcf9fb24979a809248d6658e6a1f6c4caa8d769293abbc7282e4b", 0x68}], 0x7, &(0x7f0000000940)=ANY=[@ANYBLOB="1c02000000000000010000000100000092852823d8dadb824f4cb8761226722d2a63b14d24de515cd845c47386d6dcc684358ef20222571106a7c09d89b93899edfaf18936bb7c3c761a05639470b08b6d9a9ed4cc1e1cc86daef865db5a6e9544ae2561f039407d69ca630e5d7cc29fd51d646c8735df14f30c9486ddfef801b320890f155976862d063a517aafa291a1ea1e786c1e4504827b2878c81dd7736ff313ace64051cce208101457ad651dc9deb5c29173245a8c39fa252c0fcda9b5ded6a49c95acfca7832657fc98fa6964188947dfc8cca67c05bc1d", @ANYRES32=r1, @ANYRES32, @ANYRES32=r11, @ANYBLOB="000000002c000000000000000100000001000000", @ANYRES32=r0, @ANYRES32, @ANYRES32, @ANYRES32=r7, @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x50, 0x4000080}}, {{&(0x7f0000007800)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f00000078c0)=[{&(0x7f0000007880)="825fd9d713c2231ba0d225534de4", 0xe}], 0x1, &(0x7f0000007a40)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r4, r3, 0xffffffffffffffff, r3]}}, @cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [r5, r5, r1]}}, @rights={{0x30, 0x1, 0x1, [r8, 0xffffffffffffffff, r3, r4, 0xffffffffffffffff, r8, r3, 0xffffffffffffffff]}}], 0x108, 0x4000040}}], 0x4, 0x800c090) recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r12 = dup(0xffffffffffffffff) ioctl$KVM_REGISTER_COALESCED_MMIO(r12, 0x4010ae67, &(0x7f00000000c0)={0x0, 0xc000}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000491000/0x2000)=nil, 0x2000, 0x1000009, 0x4042811, r12, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x360}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa08, &(0x7f0000000340)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x1}) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) socket$rds(0x15, 0x5, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='wlan0\x00', 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) 3.0346273s ago: executing program 5 (id=1613): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @pix={0x434c, 0x8, 0x584e4f53, 0x4, 0x2, 0x7, 0x0, 0x5, 0x1, 0x4, 0x2, 0x7}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040), 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = dup(r0) ioctl$KVM_SET_CPUID2(r1, 0xc008ae09, &(0x7f0000000000)=ANY=[@ANYRES64=r0]) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x32, 0x701, 0xfffffffc, 0x0, {0x6}}, 0x14}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r4 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) prlimit64(0x0, 0xe, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000001a300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) 2.705196587s ago: executing program 2 (id=1614): ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x1}) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x19) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000040)=0x0) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x2, 0x2, 0xf59, 0x8, r1}) recvmsg(r0, &(0x7f0000000280)={&(0x7f00000000c0)=@isdn, 0x80, &(0x7f0000000240)=[{&(0x7f0000000140)=""/36, 0x24}, {&(0x7f0000000180)=""/1, 0x1}, {&(0x7f00000001c0)=""/96, 0x60}], 0x3}, 0x80000020) write$P9_RRENAMEAT(r0, &(0x7f00000002c0)={0x7, 0x4b, 0x1}, 0x7) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x202000, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000340)={0x8}) r3 = socket$inet_smc(0x2b, 0x1, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) getsockname$packet(r2, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000440)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000480)={'team0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x78, r4, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x8}, @ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x27}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0xfc}, @ETHTOOL_A_LINKINFO_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x16f42424e9dbdb51}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x2}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0xe}]}, 0x78}, 0x1, 0x0, 0x0, 0x14000004}, 0x840) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000005c0)={0xc, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000600)={0x48, 0x7, r2, 0x0, 0x1, 0x0, 0xa, 0x2212d4, 0x3e737a}) ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000680)={0x48, 0x6, r7, 0x0, r8}) r9 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000700)='/dev/comedi1\x00', 0x40000, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000740)={{{@in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@private2}}, &(0x7f0000000840)=0xe8) quotactl_fd$Q_QUOTAON(r9, 0xffffffff80000201, r10, &(0x7f0000000880)='./file0\x00') ioctl$KVM_CAP_STEAL_TIME(r2, 0x4068aea3, &(0x7f00000008c0)) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f0000000940)={'team_slave_1\x00', 0x5}) socket$packet(0x11, 0x3, 0x300) sched_setaffinity(r1, 0x8, &(0x7f0000000980)=0x54) r11 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000bc0)={0xffffffffffffffff, 0x97db, 0x10}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x2, &(0x7f00000009c0)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}], &(0x7f0000000a00)='syzkaller\x00', 0x3, 0xe9, &(0x7f0000000a40)=""/233, 0x41000, 0x4, '\x00', r5, 0x25, r0, 0x8, &(0x7f0000000b40)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000b80)={0x5, 0x7, 0x4, 0x3}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000c00)=[r2, r11, r0], &(0x7f0000000c40)=[{0x5, 0x2, 0xf, 0x2}, {0x3, 0x2, 0x6, 0x9}], 0x10, 0xd75}, 0x94) sendmsg$NL80211_CMD_GET_WOWLAN(r0, &(0x7f0000000e00)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x30, 0x0, 0x3f9f049c068154ed, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x3e}, @val={0x8}, @val={0xc, 0x99, {0x2, 0x2c}}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0xc004) socket$kcm(0x29, 0x0, 0x0) r12 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000e40)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write$tcp_mem(r12, &(0x7f0000000e80)={0x9, 0x20, 0x7, 0x20, 0xfffffffffffffff7}, 0x48) sendmsg$key(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000f40)={0x2, 0x17, 0xe1, 0x9, 0x20, 0x0, 0x70bd28, 0x25dfdbff, [@sadb_spirange={0x2, 0x10, 0x4d2, 0x4d6}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x19}}, @in6={0xa, 0x4e22, 0xea, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7}}, @sadb_x_policy={0x8, 0x12, 0x1, 0x0, 0x0, 0x6e6bb4, 0x100, {0x6, 0x3c, 0x40, 0xfb, 0x0, 0x4, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, @in=@remote}}, @sadb_x_nat_t_port={0x1, 0x3, 0x4e20}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x4e24, 0x1ba, @private1={0xfc, 0x1, '\x00', 0x1}, 0x10}}, @sadb_x_filter={0x5, 0x1a, @in=@loopback, @in6=@loopback, 0x2b, 0x2, 0x10}]}, 0x100}}, 0x20004001) 1.737226748s ago: executing program 5 (id=1615): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000820004000000bae59f682b16b2aaccbcf237000000"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x57, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x8b}, 0x0) pipe2$watch_queue(0x0, 0x80) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000100)='htcp\x00', 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000b40)=[{{&(0x7f0000000240)=@nfc, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000500)=""/103, 0x67}, {&(0x7f0000000580)=""/79, 0x4f}, {&(0x7f0000000600)=""/103, 0x67}], 0x3}, 0x40}, {{&(0x7f0000000680)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000700)=""/190, 0xbe}, {&(0x7f0000000880)=""/228, 0xe4}, {&(0x7f0000000980)=""/139, 0x8b}], 0x3, &(0x7f0000000a40)=""/222, 0xde}, 0x6}], 0x2, 0x2, 0x0) r4 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4c2b, 0xb, @private1={0xfc, 0x1, '\x00', 0x6}, 0x4}, 0x1c) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) pipe(&(0x7f0000000400)) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r5}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x8a}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000800)='./file0\x00', 0x148) 1.690587171s ago: executing program 1 (id=1616): r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x7e, 0x6, 0x10, @mcast1, @loopback={0x0, 0xffff888101827518}, 0x40, 0x8000, 0x5, 0xffffffff}}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) write$UHID_SET_REPORT_REPLY(r3, &(0x7f00000006c0)={0xe, {0x4, 0x22, 0x8, 0xd0, "d81560fcc0cf7217d5f465759dffce9474a20e566e9e50e7707059fd5a342b2469a73cc2c8e89e6ac9e07d1b341e63ca78c3287a060a9ec74dcb4c344001585c5a8c60847d079db7c39d264e43698d185d9d50084ed73a02020f0d25136700d5e5f7af8ac249d339edca4e80e2293009bd4a8eddc762c5c17e1beb29448e9e267ca3e8bc7d0e8a4c3c44105dabf1b6802300ca78952ed44900b18349c15cac4cd7474dc00bdfe3569f6ac5b515d18978bcfbbdb6c70fc0ffa8cc00b1aaf031cf97b3c01dcd61d9d2fd82e00d84419e20"}}, 0xdc) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000440)={@flat=@handle={0x73682a85, 0x1, 0x1}, @flat=@binder={0x73622a85, 0xa, 0x1}, @flat=@binder={0x73622a85, 0x1000}}, &(0x7f0000000240)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x6d, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 1.421250056s ago: executing program 3 (id=1617): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, &(0x7f0000000a00)={'ip6_vti0\x00', 0x0}) (async) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, &(0x7f0000000a00)={'ip6_vti0\x00', 0x0}) socket(0x10, 0x3, 0x0) (async) r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x4, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xa, 0xfff1}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4, 0x5}}]}, 0x34}}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) setitimer(0x1, &(0x7f0000000080)={{0x77359400}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f0000000800)) (async) getitimer(0x1, &(0x7f0000000800)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) syz_genetlink_get_family_id$nfc(&(0x7f00000000c0), 0xffffffffffffffff) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r7, 0x29, 0x35, 0x0, 0x0) r8 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r8, 0x8b2c, &(0x7f0000000040)) r9 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x200003, 0x168, 0x20}, 0x18) utimensat(r9, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={{}, {0x77359400}}, 0x0) 1.420472262s ago: executing program 2 (id=1618): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1e, 0x1c, &(0x7f0000001840)=ANY=[@ANYBLOB="1800000000000000000000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b9af8ff00000000b7080000080000007b00020000000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000006200000076000000bf91000000000000b5020000000000008500000085000000b70000000800000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 692.060739ms ago: executing program 5 (id=1619): bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) clock_settime(0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioperm(0x0, 0x6, 0x2da3b9f3) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0xb001, 0x4, 0x418, 0x110, 0x0, 0x110, 0x330, 0x330, 0x220, 0x7fffffe, 0x0, {[{{@arp={@empty, @local, 0x0, 0xff000000, 0x4, 0x86, {@mac=@multicast, {[0xff, 0xff, 0x0, 0x0, 0xff]}}, {@mac=@local, {[0x0, 0x0, 0x1fe, 0x0, 0xff]}}, 0x1, 0x2, 0x7ff, 0x2, 0xfffb, 0x6, 'bridge_slave_0\x00', 'veth1_vlan\x00', {0xff}, {}, 0x0, 0x28}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@multicast, @local, @broadcast, 0x8}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1e}, @loopback, @initdev={0xac, 0x1e, 0x2, 0x0}, 0x2, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) 418.978567ms ago: executing program 1 (id=1620): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x2}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x3ff}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004080) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x114, r2, 0x100, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x10001, 0x3c}}}}, [@NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x5}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xe4, 0xac, "494ea110fbe6143e75dbe40313cf9c989a9174e7bd522437d558a9362b65759bddc56817711f5e2855c290ff89e05bbfe12b8b2c3a07edbe532a61be6f9abbd92e232e41a8841ae78cd7f7307c9c129b34b5bac832c7418a32eda1bd413eacc36e988b0bb2c1dc126438bfb08770883d9cec80623afe551f635de5593876df11eb34d90f8484d7ff72cc9ce03a930f55413cbd33dd92775b59d59bb1c42a4f476758590d71429cda0ca0702ff391d7ce3340c3a31463c1c61b7e0e5d5a6640c4f70e36fc14ad815e4de6bdca617725f44ab50fdff3b839079b097f8e9e24d552"}]}, 0x114}, 0x1, 0x0, 0x0, 0x240400c4}, 0x810) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x14, 0x1, 0x4, 0x101, 0x0, 0x0, {0x7, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x4048810}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_KEY(r5, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x28, 0x0, 0xe06, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14, 0x30, "678d195d1c93e868146453bf091bc351"}]}, 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), r0) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x5c, r6, 0x1, 0x70bd28, 0x25dfdbfd, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) r7 = syz_open_dev$usbfs(&(0x7f0000000740), 0x9, 0x43) ioctl$USBDEVFS_RELEASEINTERFACE(r7, 0x80045510, &(0x7f0000000780)=0x4) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(r4, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x34, 0x2, 0x9, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0xe}}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x79}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x10) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000900), r5) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r5, &(0x7f0000000a40)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000940)={0xa4, r9, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'sit0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast2}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'virt_wifi0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x22}}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'vcan0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_virt_wifi\x00'}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40000}, 0x800) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000ac0), r0) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000bc0)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b00)={0x48, r10, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x101}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa53}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x48}}, 0x0) splice(r4, &(0x7f0000000c00)=0x7ff, r7, &(0x7f0000000c40)=0x7913, 0x3, 0x4) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000c80)={{0x1, 0x1, 0x18, r0, {r8}}, './file0\x00'}) clock_gettime(0x0, &(0x7f0000003000)={0x0, 0x0}) recvmmsg$unix(r12, &(0x7f0000002fc0)=[{{&(0x7f0000000cc0)=@abs, 0x6e, &(0x7f0000002f40)=[{&(0x7f0000000d40)=""/4096, 0x1000}, {&(0x7f0000001d40)=""/35, 0x23}, {&(0x7f0000001d80)=""/4096, 0x1000}, {&(0x7f0000002d80)=""/224, 0xe0}, {&(0x7f0000002e80)=""/53, 0x35}, {&(0x7f0000002ec0)=""/124, 0x7c}], 0x6}}], 0x1, 0x2100, &(0x7f0000003040)={r13, r14+10000000}) ioctl$EVIOCGPROP(r11, 0x80404509, &(0x7f0000003080)=""/43) clock_getres(0x3, &(0x7f00000030c0)) io_setup(0x3, &(0x7f0000003100)=0x0) io_getevents(r15, 0x0, 0x2, &(0x7f0000003140)=[{}, {}], &(0x7f0000003180)) ioctl$BTRFS_IOC_START_SYNC(r7, 0x80089418, &(0x7f00000031c0)) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r12, &(0x7f0000003300)={&(0x7f0000003200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000032c0)={&(0x7f0000003240)={0x64, r2, 0x300, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x12}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x50}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x4f}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x2c}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x67}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0xb}]}, 0x64}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 289.499681ms ago: executing program 2 (id=1621): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='uid_map\x00') r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000600)={0x0, 0x101}, &(0x7f0000000640)=0x8) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000100)=""/120) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x23, &(0x7f0000000040), &(0x7f0000000200)=0x38) getsockname$netrom(r0, &(0x7f0000000040)={{0x3, @null}, [@remote, @netrom, @remote, @null, @remote, @rose, @default, @netrom]}, &(0x7f00000000c0)=0x48) 275.230013ms ago: executing program 5 (id=1622): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)={0x38, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x2a, 0x9, 0x9, 0x6, 0x8084, 0x3, 0x2, 0x2]}}]}]}]}, 0x38}}, 0x0) 98.584894ms ago: executing program 2 (id=1623): unshare(0x20000400) r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000002200)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x4, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="9a", 0x1}], 0x1}}], 0x1, 0x4000000) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000480)={r4, 0x9}, 0xc) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={r4}, &(0x7f0000000040)=0x8) fcntl$getownex(r0, 0x10, &(0x7f0000001140)) unshare(0x20000400) (async) socket$kcm(0x10, 0x2, 0x10) (async) socket$inet_sctp(0x2, 0x5, 0x84) (async) socket(0x2, 0x80805, 0x0) (async) sendmmsg$inet(r2, &(0x7f0000002200)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x4, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="9a", 0x1}], 0x1}}], 0x1, 0x4000000) (async) socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000480)={r4, 0x9}, 0xc) (async) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={r4}, &(0x7f0000000040)=0x8) (async) fcntl$getownex(r0, 0x10, &(0x7f0000001140)) (async) 13.450224ms ago: executing program 1 (id=1624): r0 = memfd_create(&(0x7f0000000ec0)='\x103q}2[\xe0\x9a\xee\xaf\x03\x97\x9et\v\"|Ma\x86\xe7\xc0\x14\x9f\xb9h\xb1\x96\xe7=I\x860S6\xb5\xa8\xc2\x95Je%\xfeG\'e\xe5\x8f\xf8\xd2\x1c\xc0\xfb\x1c\xa6\xab\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94k\xcd\t\x00\x90k\xd6\x05\xb6\x03\x00\x00\x00A\xc5\x9c_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2Oc\xc0c\x03gB!\xb0\xb8n\x01\x9bT\x95\x10\x86\xe8$\x7f\r[\xf9\x0e1v\xb1\n\x88\v\x95uy\xb5:`\x8b\nC\x18A;\xaa%\xaf\xc7\xa3\xac\xa2D\xb5\xe2\xe1\xdc(\xfd\x05\x9fB\x84O\xfe@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\xa0\x17\xe3\xac\xe9\xc9\xa7\x8a\x1b\x03\"&\xac\xcap>\xccZ\x01\xbc\x18\xc1\xb9\xe9\v\x8b\x9c\xb4Q\xd4\x96EV<>\x99\xca\xb3\xe0\xc4tL\xed\xf5W\xbd#\xcf\x8a\x84\xed\x9f/\xd4\xbb\xea;-Dp\xf8\xd0F\x90\xf8\x92Ip6\xf4\x16\xe8\x14\xe0\x92!\x92-F\xe2\x14D\x91\xa8b\x04\xdd\x1d\a\xdc\xe0\x18\x85{\x80Q\xf6k\x96\xfaQ\x9fW\vO\xf0\xe4O\\\xceS\xf2\xde\x049d\x06#\x88\xc3\xdf\x85O\x1c\xc3\xad?r\xd7\x0e\x00\xd7\x83\xb0\x88\x9c\xf6Y-F\x98\xdd\x9c~\xfd\x95\xc3\xb6lC\xaa\"Y\xa2K\xecz\x84:*\xf5Y\xd1\x9b1\x91\x9b\x15\xd4\xec\x02o\x01&\xaa\x90w\xc4\xc7yn\xb5\x1ag\xab&?\xbe\xcb\xe8v\xa8\xe0\xa4\x81sW\xacf\x149\xd2}\xefCGa\x9a$4\x8c\xa5!p\x83\x05\x96%\x02%\xabj\n\b\xc8NC\x91}&y\xd3\xe1\xeep\'\xc5\xab\x19GsX5\x8c\n\x9fh\xee;4\xb1%V\xe0\xa9\x8e\xf30:\xd8\x18N~G\x139\xcas\xf4D\xd4\xd0s\r3\xcb\x9a&\xdf+(\xc9S\x9eL5\x84\xb1\x90pN\xe7/\r\b\x9a\xf13Q\xf9\xdf\x7fX\xa0\xafK\xefh\xbfOv\x9bh\xb3\xc0\xf5\x80\xba\"@\'\x02\xafi\xeaE\xa6a6F\xde\xd4\xfa\x84\xe4+A\xb7\xa2\x8f\xc9\xee|xxn\xefw\x93]%\xd0\x19\x132\x86\xabn\xfe\x91\xb6Cl\xcf\x04\x1cq\xc1\x1d~\x8d\x01\x83\x93_\x83\x8a`v\xb0K,|S\xe4\xba\xb1\f\xc8`\xa6s\xad\x11\xd4wG\x80u\x87u\xff\x87\xee', 0x2) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x940a, 0x1000007}) fcntl$addseals(r0, 0x409, 0xb) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14, &(0x7f0000000080)={0x0}, 0x7, 0x0, 0x0, 0x6004a014}, 0x600c010) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x210800, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_START_SCHED_SCAN(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022bbd7000fbdbdf254b000000080003000940da047e4fd34607fc9afe9e052efeba7dc305f392130daf204a736bb314cd89e8d35ee024104458bb31788419fc799931addaddbcba7f988faf749f53db05b1152e0d6f78d2b9aa536f64138b78efc4bd0eff343993ba054b37d614f12072730ebfc2e25f489e8c7d2ee1ee3230802bc3844e875d8330c951fe8793a99057afb3753c7ce1533eac546a7e2f4e2c5eabf96069cbeccca7cef0ed44c9e3a448cf2aea582e474b8f09a7f1eb818c605fe8535a2931a832f1b1d30fede9cb60c2426c89a30a8155533ff764638aa98d85b06be547f4350eedf7d1090a360b3e6a", @ANYRES32=0x0, @ANYBLOB="0c00990009000000080000000c002a0004060507060003000800dc000d0000000a00060008021100000100000400ff00"], 0x4c}, 0x1, 0x0, 0x0, 0x4040800}, 0x40) uname(&(0x7f0000000080)) memfd_create(&(0x7f0000000ec0)='\x103q}2[\xe0\x9a\xee\xaf\x03\x97\x9et\v\"|Ma\x86\xe7\xc0\x14\x9f\xb9h\xb1\x96\xe7=I\x860S6\xb5\xa8\xc2\x95Je%\xfeG\'e\xe5\x8f\xf8\xd2\x1c\xc0\xfb\x1c\xa6\xab\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94k\xcd\t\x00\x90k\xd6\x05\xb6\x03\x00\x00\x00A\xc5\x9c_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2Oc\xc0c\x03gB!\xb0\xb8n\x01\x9bT\x95\x10\x86\xe8$\x7f\r[\xf9\x0e1v\xb1\n\x88\v\x95uy\xb5:`\x8b\nC\x18A;\xaa%\xaf\xc7\xa3\xac\xa2D\xb5\xe2\xe1\xdc(\xfd\x05\x9fB\x84O\xfe@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\xa0\x17\xe3\xac\xe9\xc9\xa7\x8a\x1b\x03\"&\xac\xcap>\xccZ\x01\xbc\x18\xc1\xb9\xe9\v\x8b\x9c\xb4Q\xd4\x96EV<>\x99\xca\xb3\xe0\xc4tL\xed\xf5W\xbd#\xcf\x8a\x84\xed\x9f/\xd4\xbb\xea;-Dp\xf8\xd0F\x90\xf8\x92Ip6\xf4\x16\xe8\x14\xe0\x92!\x92-F\xe2\x14D\x91\xa8b\x04\xdd\x1d\a\xdc\xe0\x18\x85{\x80Q\xf6k\x96\xfaQ\x9fW\vO\xf0\xe4O\\\xceS\xf2\xde\x049d\x06#\x88\xc3\xdf\x85O\x1c\xc3\xad?r\xd7\x0e\x00\xd7\x83\xb0\x88\x9c\xf6Y-F\x98\xdd\x9c~\xfd\x95\xc3\xb6lC\xaa\"Y\xa2K\xecz\x84:*\xf5Y\xd1\x9b1\x91\x9b\x15\xd4\xec\x02o\x01&\xaa\x90w\xc4\xc7yn\xb5\x1ag\xab&?\xbe\xcb\xe8v\xa8\xe0\xa4\x81sW\xacf\x149\xd2}\xefCGa\x9a$4\x8c\xa5!p\x83\x05\x96%\x02%\xabj\n\b\xc8NC\x91}&y\xd3\xe1\xeep\'\xc5\xab\x19GsX5\x8c\n\x9fh\xee;4\xb1%V\xe0\xa9\x8e\xf30:\xd8\x18N~G\x139\xcas\xf4D\xd4\xd0s\r3\xcb\x9a&\xdf+(\xc9S\x9eL5\x84\xb1\x90pN\xe7/\r\b\x9a\xf13Q\xf9\xdf\x7fX\xa0\xafK\xefh\xbfOv\x9bh\xb3\xc0\xf5\x80\xba\"@\'\x02\xafi\xeaE\xa6a6F\xde\xd4\xfa\x84\xe4+A\xb7\xa2\x8f\xc9\xee|xxn\xefw\x93]%\xd0\x19\x132\x86\xabn\xfe\x91\xb6Cl\xcf\x04\x1cq\xc1\x1d~\x8d\x01\x83\x93_\x83\x8a`v\xb0K,|S\xe4\xba\xb1\f\xc8`\xa6s\xad\x11\xd4wG\x80u\x87u\xff\x87\xee', 0x2) (async) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x940a, 0x1000007}) (async) fcntl$addseals(r0, 0x409, 0xb) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) (async) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) sendmsg$802154_dgram(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14, &(0x7f0000000080)={0x0}, 0x7, 0x0, 0x0, 0x6004a014}, 0x600c010) (async) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) (async) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x210800, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_START_SCHED_SCAN(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022bbd7000fbdbdf254b000000080003000940da047e4fd34607fc9afe9e052efeba7dc305f392130daf204a736bb314cd89e8d35ee024104458bb31788419fc799931addaddbcba7f988faf749f53db05b1152e0d6f78d2b9aa536f64138b78efc4bd0eff343993ba054b37d614f12072730ebfc2e25f489e8c7d2ee1ee3230802bc3844e875d8330c951fe8793a99057afb3753c7ce1533eac546a7e2f4e2c5eabf96069cbeccca7cef0ed44c9e3a448cf2aea582e474b8f09a7f1eb818c605fe8535a2931a832f1b1d30fede9cb60c2426c89a30a8155533ff764638aa98d85b06be547f4350eedf7d1090a360b3e6a", @ANYRES32=0x0, @ANYBLOB="0c00990009000000080000000c002a0004060507060003000800dc000d0000000a00060008021100000100000400ff00"], 0x4c}, 0x1, 0x0, 0x0, 0x4040800}, 0x40) (async) uname(&(0x7f0000000080)) (async) 0s ago: executing program 5 (id=1625): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f00000002c0)='rcu_utilization\x00', r0}, 0x18) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x14) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="160000000000000061b1000002"], 0x48) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x105042, 0x0) mmap$binder(&(0x7f0000ffa000/0x6000)=nil, 0x6000, 0x1, 0x11, r3, 0x0) sendmsg$TCPDIAG_GETSOCK(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000003740)=ANY=[], 0x12fc}, 0x1, 0x0, 0x0, 0x24000801}, 0x4) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r3) sendmsg$NL80211_CMD_GET_REG(r3, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="80000000", @ANYRES16=r5, @ANYBLOB="00012dbd7000fedbdf251f00000064150507002100616100000800010048000000070021006161000048000080140000807427cdb3b48810a1c2f0b7bac5080003000500000008000600ffff00001400000100c8d3fb1b0d92e59917437db90000000000000008000400080000001c00ec7541ed030003020000080004000700000008000300050000"], 0x80}, 0x1, 0x0, 0x0, 0x81}, 0x8000) syz_open_dev$MSR(&(0x7f0000000340), 0xffffffffffffb9ce, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r4, 0xc004ae02, &(0x7f0000000080)={0x40000000000000c0}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, 0x0, &(0x7f0000000040)}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) kernel console output (not intermixed with test programs): gspca_sn9c2028: read1 error -71 [ 369.257176][ T9] gspca_sn9c2028: read1 error -71 [ 369.338583][ T9] sn9c2028 3-1:220.0: probe with driver sn9c2028 failed with error -71 [ 369.341804][ T8974] team0: Port device bond0 added [ 369.641892][ T9] usb 3-1: USB disconnect, device number 27 [ 369.786894][ T5960] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 370.001187][ T5960] usb 2-1: device descriptor read/64, error -71 [ 370.083034][ T8992] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 370.360594][ T5960] usb 2-1: new full-speed USB device number 36 using dummy_hcd [ 370.368184][ T9008] fuse: Unknown parameter 'r' [ 370.416100][ T9009] netlink: 16 bytes leftover after parsing attributes in process `syz.3.811'. [ 370.450913][ T9] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 370.490604][ T5960] usb 2-1: device descriptor read/64, error -71 [ 370.632025][ T5960] usb usb2-port1: attempt power cycle [ 370.650612][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 370.656705][ T9] usb 1-1: too many configurations: 106, using maximum allowed: 8 [ 370.666919][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 370.674815][ T9] usb 1-1: can't read configurations, error -61 [ 370.749250][ T5961] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 370.837545][ T9014] netlink: 8 bytes leftover after parsing attributes in process `syz.2.814'. [ 370.846539][ T9014] netlink: 8 bytes leftover after parsing attributes in process `syz.2.814'. [ 371.400947][ T9] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 371.482417][ T5961] usb 5-1: Using ep0 maxpacket: 32 [ 371.493282][ T5961] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 371.520671][ T5961] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 371.541282][ T5960] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 371.563622][ T5961] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 371.581133][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 371.591023][ T5960] usb 2-1: device descriptor read/8, error -71 [ 371.601767][ T9] usb 1-1: too many configurations: 106, using maximum allowed: 8 [ 371.607946][ T5961] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 371.627004][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 371.631613][ T5961] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.640887][ T9] usb 1-1: can't read configurations, error -61 [ 371.661187][ T9] usb usb1-port1: attempt power cycle [ 371.674329][ T5961] usb 5-1: config 0 descriptor?? [ 371.680157][ T9008] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 371.691357][ T5961] hub 5-1:0.0: USB hub found [ 371.840988][ T5960] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 371.887202][ T5919] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 371.911339][ T5961] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 371.931215][ T5960] usb 2-1: device descriptor read/8, error -71 [ 371.986671][ T9026] fuse: Unknown parameter 'fuse' [ 372.016320][ T9] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 372.805457][ T9028] fuse: Unknown parameter 'r' [ 372.812590][ T5919] usb 3-1: Using ep0 maxpacket: 16 [ 372.842143][ T5919] usb 3-1: config 1 has an invalid interface number: 105 but max is 0 [ 372.879759][ T5919] usb 3-1: config 1 has no interface number 0 [ 372.894689][ T5960] usb usb2-port1: unable to enumerate USB device [ 372.921848][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 372.928122][ T9] usb 1-1: too many configurations: 106, using maximum allowed: 8 [ 372.938503][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 372.946658][ T5919] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 372.946784][ T9] usb 1-1: can't read configurations, error -61 [ 372.984815][ T5919] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 373.008216][ T5919] usb 3-1: config 1 interface 105 has no altsetting 0 [ 373.016112][ T5961] usbhid 5-1:0.0: can't add hid device: -71 [ 373.022464][ T5961] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 373.037286][ T5919] usb 3-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 373.057169][ T5919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.066507][ T5919] usb 3-1: Product: syz [ 373.076781][ T5961] usb 5-1: USB disconnect, device number 26 [ 373.082860][ T5919] usb 3-1: Manufacturer: syz [ 373.087700][ T5919] usb 3-1: SerialNumber: syz [ 373.090985][ T9] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 373.107732][ T9016] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 373.115666][ T9016] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 373.201847][ T9] usb 1-1: device descriptor read/8, error -71 [ 373.363244][ T9] usb usb1-port1: unable to enumerate USB device [ 374.062903][ T9046] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 374.070221][ T9046] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 374.416246][ T9016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 375.068815][ T5919] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x20) reg index 0x0000: -32 [ 375.080058][ T5919] aqc111 3-1:1.105: probe with driver aqc111 failed with error -32 [ 375.094653][ T9016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 375.704743][ T9074] netlink: 12 bytes leftover after parsing attributes in process `syz.1.831'. [ 376.995839][ T5960] usb 3-1: USB disconnect, device number 28 [ 380.391824][ T9128] netlink: 12 bytes leftover after parsing attributes in process `syz.3.843'. [ 381.089281][ T9139] comedi comedi3: comedi_config --init_data is deprecated [ 381.594360][ T9135] ceph: No mds server is up or the cluster is laggy [ 381.603151][ T9142] ceph: No mds server is up or the cluster is laggy [ 382.254627][ T5919] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 382.917028][ T5919] usb 5-1: config 0 has an invalid descriptor of length 251, skipping remainder of the config [ 383.001162][ T5919] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 383.060579][ T5919] usb 5-1: New USB device found, idVendor=0c70, idProduct=f014, bcdDevice= 0.00 [ 383.070769][ T5919] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.119600][ T5919] usb 5-1: config 0 descriptor?? [ 383.256750][ T9165] netlink: 24 bytes leftover after parsing attributes in process `syz.0.854'. [ 383.396843][ T5919] usb 5-1: string descriptor 0 read error: -71 [ 383.418100][ T5919] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 383.457240][ T5919] usb 5-1: USB disconnect, device number 27 [ 383.776367][ T9184] netlink: 20 bytes leftover after parsing attributes in process `syz.2.860'. [ 383.819159][ T9187] netlink: 4 bytes leftover after parsing attributes in process `syz.3.861'. [ 384.413445][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 384.726997][ T9189] pim6reg1: entered promiscuous mode [ 384.733508][ T9189] pim6reg1: entered allmulticast mode [ 384.745253][ T9193] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 384.758416][ T9193] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 384.783708][ T9193] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 384.795494][ T43] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 384.900879][ T5965] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 384.915710][ T9204] vlan1: entered promiscuous mode [ 384.922322][ T9204] vlan1: entered allmulticast mode [ 384.927496][ T9204] veth0_vlan: entered allmulticast mode [ 384.955879][ T43] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 384.980670][ T43] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 385.017063][ T43] usb 1-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 385.048382][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.096090][ T5965] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 385.107599][ T9208] netlink: 'syz.3.867': attribute type 9 has an invalid length. [ 385.113549][ T5965] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.144956][ T43] usb 1-1: config 0 descriptor?? [ 385.252173][ T9208] netlink: 36 bytes leftover after parsing attributes in process `syz.3.867'. [ 385.291014][ T5965] usb 5-1: config 0 descriptor?? [ 385.643058][ T5965] cp210x 5-1:0.0: cp210x converter detected [ 385.645981][ T9199] syzkaller1: entered promiscuous mode [ 385.712091][ T9199] syzkaller1: entered allmulticast mode [ 385.912757][ T43] hid-steam 0003:28DE:1142.000B: item fetching failed at offset 4/5 [ 385.922414][ T43] hid-steam 0003:28DE:1142.000B: steam_probe:parse of hid interface failed [ 385.941245][ T43] hid-steam 0003:28DE:1142.000B: probe with driver hid-steam failed with error -22 [ 386.060391][ T5965] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 386.084741][ T5965] usb 5-1: cp210x converter now attached to ttyUSB0 [ 386.456856][ T5823] usb 5-1: USB disconnect, device number 28 [ 386.475359][ T5823] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 386.488649][ T5823] cp210x 5-1:0.0: device disconnected [ 386.645702][ T9231] netlink: 12 bytes leftover after parsing attributes in process `syz.3.874'. [ 389.035958][ T5912] usb 1-1: USB disconnect, device number 27 [ 389.118227][ T5823] usb 2-1: new low-speed USB device number 39 using dummy_hcd [ 389.330994][ T5823] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 389.372525][ T5823] usb 2-1: New USB device found, idVendor=258a, idProduct=0036, bcdDevice= 0.00 [ 389.439431][ T5823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.501994][ T5823] usb 2-1: config 0 descriptor?? [ 389.664647][ T5823] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 389.687453][ T9265] IPVS: Unknown mcast interface: vca.0 [ 391.961860][ T9299] Smack: duplicate mount options [ 392.602293][ T10] usb 2-1: USB disconnect, device number 39 [ 392.742765][ T9304] xt_ecn: cannot match TCP bits for non-tcp packets [ 392.760892][ T9304] tmpfs: Unknown parameter 'usrquota' [ 392.960909][ T5823] usb 1-1: new full-speed USB device number 28 using dummy_hcd [ 393.185588][ T5823] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 393.790563][ T5823] usb 1-1: config 0 has no interface number 0 [ 393.796740][ T5823] usb 1-1: config 0 interface 29 has no altsetting 0 [ 393.853531][ T5823] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 393.880452][ T5823] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.911275][ T5823] usb 1-1: Product: syz [ 393.925755][ T5823] usb 1-1: Manufacturer: syz [ 393.940564][ T5823] usb 1-1: SerialNumber: syz [ 393.971190][ T5823] usb 1-1: config 0 descriptor?? [ 394.276006][ T5823] peak_usb 1-1:0.29: PEAK-System PCAN-USB X6 v207 fw v188.0.0 (2 channels) [ 394.461179][ T9301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 394.561165][ T10] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 394.597694][ T9301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 394.806482][ T9323] IPv6: Can't replace route, no match found [ 394.882151][ T5823] peak_usb 1-1:0.29 can0: unable to request usb[type=2 value=5] err=-71 [ 394.919909][ T5823] peak_usb 1-1:0.29: unable to tell PCAN-USB X6 driver is loaded (err -71) [ 394.929567][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 394.950374][ T10] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 394.962607][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 395.036023][ T10] usb 2-1: config 0 has no interface number 0 [ 395.067087][ T10] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 395.092091][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.132168][ T10] usb 2-1: Product: syz [ 395.160635][ T5823] peak_usb 1-1:0.29: probe with driver peak_usb failed with error -71 [ 395.187545][ T10] usb 2-1: Manufacturer: syz [ 395.192699][ T10] usb 2-1: SerialNumber: syz [ 395.250949][ T5823] usb 1-1: USB disconnect, device number 28 [ 395.331521][ T10] usb 2-1: config 0 descriptor?? [ 395.399346][ T9331] overlayfs: failed to clone upperpath [ 395.471020][ T10] asix 2-1:0.251: probe with driver asix failed with error -22 [ 395.731765][ T10] usb 2-1: USB disconnect, device number 40 [ 395.861127][ T5823] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 396.303363][ T5823] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 396.320939][ T5823] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 396.573734][ T9346] netlink: 36 bytes leftover after parsing attributes in process `syz.2.904'. [ 396.583312][ T9346] netlink: 36 bytes leftover after parsing attributes in process `syz.2.904'. [ 397.124665][ T5823] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 397.136542][ T9345] xt_ecn: cannot match TCP bits for non-tcp packets [ 397.153261][ T5823] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 397.181893][ T9345] tmpfs: Unknown parameter 'usrquota' [ 397.187173][ T5823] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 397.218959][ T5823] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.301651][ T5823] usb 5-1: config 0 descriptor?? [ 397.811178][ T9333] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 397.915725][ T9354] netlink: 16 bytes leftover after parsing attributes in process `syz.3.910'. [ 397.971824][ T9354] bridge0: entered promiscuous mode [ 397.997260][ T9354] bridge0: port 3(macvlan0) entered blocking state [ 398.039820][ T9354] bridge0: port 3(macvlan0) entered disabled state [ 398.072652][ T9354] macvlan0: entered allmulticast mode [ 398.085840][ T9354] bridge0: entered allmulticast mode [ 398.113328][ T9354] macvlan0: left allmulticast mode [ 398.124684][ T9354] bridge0: left allmulticast mode [ 398.138867][ T9354] bridge0: left promiscuous mode [ 398.269134][ T5823] plantronics 0003:047F:FFFF.000C: reserved main item tag 0xd [ 398.357131][ T5823] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 399.562454][ T9329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.571262][ T9329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.581648][ T5842] usb 5-1: USB disconnect, device number 29 [ 402.165198][ T9401] Malformed UNC in devname [ 402.165198][ T9401] [ 402.172319][ T9401] CIFS: VFS: Malformed UNC in devname [ 402.540999][ T9405] xt_ecn: cannot match TCP bits for non-tcp packets [ 402.559138][ T9405] tmpfs: Unknown parameter 'usrquota' [ 404.593806][ T9432] tmpfs: Cannot change global quota limit on remount [ 405.320851][ T43] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 405.440972][ T10] usb 2-1: new full-speed USB device number 41 using dummy_hcd [ 405.452404][ T9441] overlayfs: failed to clone upperpath [ 405.573332][ T43] usb 5-1: not running at top speed; connect to a high speed hub [ 405.682318][ T10] usb 2-1: device descriptor read/64, error -71 [ 406.089537][ T43] usb 5-1: config 255 has an invalid interface number: 166 but max is 1 [ 406.212792][ T43] usb 5-1: config 255 contains an unexpected descriptor of type 0x1, skipping [ 406.222741][ T43] usb 5-1: config 255 has an invalid descriptor of length 76, skipping remainder of the config [ 406.251806][ T43] usb 5-1: config 255 has 1 interface, different from the descriptor's value: 2 [ 406.261569][ T43] usb 5-1: config 255 has no interface number 0 [ 406.268367][ T43] usb 5-1: config 255 interface 166 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 406.311450][ T43] usb 5-1: config 255 interface 166 has no altsetting 0 [ 406.320579][ T10] usb 2-1: new full-speed USB device number 42 using dummy_hcd [ 406.324575][ T43] usb 5-1: New USB device found, idVendor=1b5c, idProduct=0104, bcdDevice=c8.c2 [ 406.339937][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.351599][ T43] usb 5-1: Product: [ 406.355773][ T43] usb 5-1: Manufacturer: ӿ [ 406.405734][ T43] usb 5-1: SerialNumber: а [ 406.542544][ T10] usb 2-1: device descriptor read/64, error -71 [ 406.653667][ T10] usb usb2-port1: attempt power cycle [ 406.670876][ T9454] xt_ecn: cannot match TCP bits for non-tcp packets [ 406.731635][ T9454] tmpfs: Unknown parameter 'usrquota' [ 407.592218][ T9458] netlink: 24 bytes leftover after parsing attributes in process `syz.2.935'. [ 407.737752][ T9458] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 407.791092][ T10] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 407.851279][ T10] usb 2-1: device descriptor read/8, error -71 [ 408.973627][ T43] ftdi_sio 5-1:255.166: FTDI USB Serial Device converter detected [ 409.004592][ T43] ftdi_sio ttyUSB0: unknown device type: 0xc8c2 [ 409.049071][ T43] usb 5-1: USB disconnect, device number 30 [ 409.081072][ T43] ftdi_sio 5-1:255.166: device disconnected [ 412.011752][ T5842] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 412.087373][ T9513] loop6: detected capacity change from 0 to 7 [ 412.119424][ T9513] Dev loop6: unable to read RDB block 7 [ 412.141160][ T9513] loop6: unable to read partition table [ 412.150725][ T5842] usb 3-1: device descriptor read/64, error -71 [ 412.171153][ T9513] loop6: partition table beyond EOD, truncated [ 412.191256][ T9513] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 412.611686][ T5842] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 412.670743][ T43] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 412.831271][ T5842] usb 3-1: device descriptor read/64, error -71 [ 412.877004][ T9532] netlink: 128 bytes leftover after parsing attributes in process `syz.1.957'. [ 412.894340][ T43] usb 1-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 412.903668][ T43] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 412.927236][ T43] usb 1-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 412.953815][ T5842] usb usb3-port1: attempt power cycle [ 412.959516][ T43] usb 1-1: config 0 interface 0 has no altsetting 0 [ 412.987304][ T43] usb 1-1: New USB device found, idVendor=0458, idProduct=501b, bcdDevice= 0.00 [ 413.007067][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.021366][ T43] usb 1-1: config 0 descriptor?? [ 413.300902][ T5842] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 413.501735][ T5842] usb 3-1: device descriptor read/8, error -71 [ 414.013458][ T5842] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 414.041715][ T5842] usb 3-1: device descriptor read/8, error -71 [ 414.574075][ T5842] usb usb3-port1: unable to enumerate USB device [ 414.720081][ T5823] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 414.754501][ T9561] fuse: Unknown parameter '1844674407370955161518446744073709551615017777777777777777777770xffffffffffffffff01777777777777777777777' [ 414.784134][ T9563] loop6: detected capacity change from 0 to 7 [ 414.803092][ T9563] Dev loop6: unable to read RDB block 7 [ 414.808770][ T9563] loop6: unable to read partition table [ 414.832371][ T9563] loop6: partition table beyond EOD, truncated [ 414.850084][ T9563] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 414.893230][ T5823] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 414.915616][ T5823] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 414.980935][ T5823] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 415.010517][ T5823] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 415.034433][ T5823] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 415.069692][ T5823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.099882][ T5823] usb 2-1: config 0 descriptor?? [ 415.119530][ T9557] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 415.270961][ T43] usb 1-1: USB disconnect, device number 29 [ 415.443359][ T9582] IPVS: set_ctl: invalid protocol: 44 172.30.1.4:20003 [ 415.491324][ T9552] netlink: 8 bytes leftover after parsing attributes in process `syz.4.962'. [ 415.509296][ T9552] netlink: 8 bytes leftover after parsing attributes in process `syz.4.962'. [ 415.806899][ T5823] plantronics 0003:047F:FFFF.000D: reserved main item tag 0xd [ 416.008594][ T9587] ptrace attach of "./syz-executor exec"[9588] was attempted by "./syz-executor exec"[9587] [ 416.551400][ T5823] plantronics 0003:047F:FFFF.000D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 416.716271][ T9598] syz.2.972: attempt to access beyond end of device [ 416.716271][ T9598] nbd2: rw=0, sector=0, nr_sectors = 2 limit=0 [ 416.761914][ T5823] usb 2-1: USB disconnect, device number 45 [ 417.000929][ T10] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 417.711187][ T10] usb 1-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 417.721921][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 417.727167][ T9601] ceph: No mds server is up or the cluster is laggy [ 417.740960][ T10] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 417.755723][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 417.765636][ T10] usb 1-1: SerialNumber: syz [ 418.160582][ T10] usb 1-1: 0:2 : does not exist [ 418.167208][ T10] usb 1-1: unit 3 not found! [ 418.194641][ T10] usb 1-1: USB disconnect, device number 30 [ 418.371091][ T9629] loop6: detected capacity change from 0 to 7 [ 418.393018][ T9629] Dev loop6: unable to read RDB block 7 [ 418.398681][ T9629] loop6: unable to read partition table [ 418.425000][ T9629] loop6: partition table beyond EOD, truncated [ 418.439810][ T9629] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 418.646965][ T9638] netlink: 12 bytes leftover after parsing attributes in process `syz.2.982'. [ 418.661450][ T9636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 418.710680][ T9638] netlink: 'syz.2.982': attribute type 2 has an invalid length. [ 418.719628][ T9636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.771029][ T9638] netlink: 'syz.2.982': attribute type 1 has an invalid length. [ 418.778755][ T9638] netlink: 4 bytes leftover after parsing attributes in process `syz.2.982'. [ 418.793507][ T9639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 418.803809][ T9636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 418.880854][ T9643] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 419.030056][ T9636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.184420][ T9639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.581082][ T10] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 419.741681][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 419.772484][ T10] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 419.784674][ T10] usb 5-1: config 0 has no interface number 0 [ 419.800839][ T9649] netlink: 10 bytes leftover after parsing attributes in process `syz.2.986'. [ 419.805624][ T10] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 419.828375][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.838002][ T9649] siw: device registration error -23 [ 419.846427][ T9652] siw: device registration error -23 [ 419.849576][ T10] usb 5-1: Product: syz [ 419.867129][ T10] usb 5-1: Manufacturer: syz [ 419.873899][ T10] usb 5-1: SerialNumber: syz [ 419.884401][ T10] usb 5-1: config 0 descriptor?? [ 419.893910][ T10] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 420.128214][ T10] usb 5-1: qt2_attach - failed to power on unit: -71 [ 420.202403][ T10] quatech2 5-1:0.51: probe with driver quatech2 failed with error -71 [ 420.240881][ T10] usb 5-1: USB disconnect, device number 31 [ 420.564031][ T9662] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 421.621263][ T10] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 421.956124][ T9669] loop6: detected capacity change from 0 to 7 [ 421.980995][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 422.012983][ T9669] Dev loop6: unable to read RDB block 7 [ 422.021307][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 422.045257][ T10] usb 1-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 422.052469][ T9669] loop6: unable to read partition table [ 422.065030][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.081545][ T9669] loop6: partition table beyond EOD, truncated [ 422.087780][ T9669] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 422.090506][ T10] usb 1-1: Product: syz [ 422.129560][ T10] usb 1-1: Manufacturer: syz [ 422.157765][ T10] usb 1-1: SerialNumber: syz [ 422.184598][ T10] usb 1-1: config 0 descriptor?? [ 422.204715][ T10] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 422.224183][ T10] usb 1-1: selecting invalid altsetting 1 [ 422.523099][ T9681] tipc: Enabling of bearer rejected, failed to enable media [ 422.550805][ T43] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 422.631739][ T5840] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 422.710630][ T43] usb 5-1: Using ep0 maxpacket: 8 [ 422.757646][ T43] usb 5-1: New USB device found, idVendor=10fd, idProduct=de00, bcdDevice=fd.01 [ 422.782606][ T43] usb 5-1: New USB device strings: Mfr=80, Product=246, SerialNumber=116 [ 422.819339][ T43] usb 5-1: Product: syz [ 422.849579][ T43] usb 5-1: Manufacturer: syz [ 422.870999][ T43] usb 5-1: SerialNumber: syz [ 422.879587][ T43] usb 5-1: config 0 descriptor?? [ 423.031741][ T30] kauditd_printk_skb: 140 callbacks suppressed [ 423.031762][ T30] audit: type=1326 audit(1755133687.878:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9690 comm="syz.3.999" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f429998ebe9 code=0x0 [ 423.121937][ T9678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.131513][ T9678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.138043][ T10] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 423.153412][ T43] usb 5-1: USB disconnect, device number 32 [ 423.300707][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 423.308912][ T10] usb 3-1: config 4 has an invalid interface number: 244 but max is 0 [ 423.317789][ T10] usb 3-1: config 4 has no interface number 0 [ 423.324543][ T10] usb 3-1: config 4 interface 244 altsetting 1 endpoint 0x1 has an invalid bInterval 41, changing to 7 [ 423.336966][ T10] usb 3-1: config 4 interface 244 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0 [ 423.357946][ T10] usb 3-1: config 4 interface 244 has no altsetting 0 [ 423.375424][ T10] usb 3-1: New USB device found, idVendor=05ac, idProduct=fa33, bcdDevice=cb.aa [ 423.385845][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.422162][ T10] usb 3-1: Product: syz [ 423.426412][ T10] usb 3-1: Manufacturer: syz [ 423.431657][ T10] usb 3-1: SerialNumber: syz [ 423.699615][ T9689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.821514][ T9689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.960128][ T5842] usb 1-1: USB disconnect, device number 31 [ 424.067163][ T9702] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 424.526190][ T10] ipheth 3-1:4.244: Unable to find endpoints [ 424.559214][ T9722] misc userio: The device must be registered before sending interrupts [ 424.559910][ T10] usb 3-1: USB disconnect, device number 33 [ 424.640189][ T9725] netlink: 'syz.1.1009': attribute type 1 has an invalid length. [ 424.649444][ T9725] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1009'. [ 425.180323][ T9736] ieee802154 phy1 wpan1: encryption failed: -22 [ 425.263567][ T9720] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1009'. [ 425.560727][ T10] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 425.650664][ T5932] usb 1-1: new low-speed USB device number 32 using dummy_hcd [ 425.690918][ T10] usb 5-1: device descriptor read/64, error -71 [ 425.790668][ T5932] usb 1-1: device descriptor read/64, error -71 [ 425.940719][ T10] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 426.030744][ T5932] usb 1-1: new low-speed USB device number 33 using dummy_hcd [ 426.070864][ T10] usb 5-1: device descriptor read/64, error -71 [ 426.172609][ T5932] usb 1-1: device descriptor read/64, error -71 [ 426.181076][ T10] usb usb5-port1: attempt power cycle [ 426.301127][ T5932] usb usb1-port1: attempt power cycle [ 426.531143][ T10] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 426.561633][ T10] usb 5-1: device descriptor read/8, error -71 [ 426.660599][ T5932] usb 1-1: new low-speed USB device number 34 using dummy_hcd [ 426.693897][ T5932] usb 1-1: device descriptor read/8, error -71 [ 426.800987][ T10] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 426.831609][ T10] usb 5-1: device descriptor read/8, error -71 [ 426.850716][ T5823] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 426.930579][ T5932] usb 1-1: new low-speed USB device number 35 using dummy_hcd [ 426.940994][ T10] usb usb5-port1: unable to enumerate USB device [ 426.971186][ T5932] usb 1-1: device descriptor read/8, error -71 [ 427.010931][ T5823] usb 3-1: Using ep0 maxpacket: 8 [ 427.032497][ T5823] usb 3-1: unable to get BOS descriptor or descriptor too short [ 427.046917][ T5823] usb 3-1: config 7 has an invalid descriptor of length 255, skipping remainder of the config [ 427.084112][ T5932] usb usb1-port1: unable to enumerate USB device [ 427.218775][ T5823] usb 3-1: config 7 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 427.251396][ T5823] usb 3-1: config 7 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 427.263075][ T5823] usb 3-1: config 7 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 427.341245][ T9779] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 427.966257][ T5823] usb 3-1: New USB device found, idVendor=0489, idProduct=e0b5, bcdDevice=ae.2a [ 428.110571][ T5823] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.149703][ T5823] usb 3-1: Product: syz [ 428.154325][ T5823] usb 3-1: Manufacturer: syz [ 428.159121][ T5823] usb 3-1: SerialNumber: syz [ 428.173642][ T9770] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 428.618433][ T9784] fuse: Unknown parameter 'grou' [ 428.630875][ T5841] Bluetooth: hci4: command 0x0405 tx timeout [ 429.354762][ T9793] random: crng reseeded on system resumption [ 429.406796][ T30] audit: type=1326 audit(1755133694.248:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9792 comm="syz.0.1032" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fad9698ebe9 code=0x0 [ 429.434748][ T9797] loop6: detected capacity change from 0 to 7 [ 429.460078][ T9797] Dev loop6: unable to read RDB block 7 [ 429.480715][ T9797] loop6: unable to read partition table [ 429.489717][ T9797] loop6: partition table beyond EOD, truncated [ 429.498698][ T9797] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 429.706396][ T5823] usb 3-1: USB disconnect, device number 34 [ 429.780939][ T9808] netlink: 'syz.3.1038': attribute type 1 has an invalid length. [ 429.809590][ T30] audit: type=1804 audit(1755133694.648:257): pid=9811 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.1039" name="file0" dev="ramfs" ino=23141 res=1 errno=0 [ 429.809611][ T9808] netlink: 'syz.3.1038': attribute type 2 has an invalid length. [ 430.149714][ T9826] bond0 (unregistering): Released all slaves [ 430.301323][ T5823] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 430.380395][ T9838] Invalid/unusable pipe [ 430.450628][ T5823] usb 3-1: device descriptor read/64, error -71 [ 430.744035][ T10] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 430.876744][ T9846] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 431.470862][ T5932] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 431.479621][ T5823] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 431.586553][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 431.618208][ T10] usb 2-1: not running at top speed; connect to a high speed hub [ 431.632531][ T5823] usb 3-1: device descriptor read/64, error -71 [ 431.652186][ T10] usb 2-1: config 219 has 1 interface, different from the descriptor's value: 2 [ 431.662897][ T5932] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 431.686945][ T10] usb 2-1: config 219 interface 0 has no altsetting 0 [ 431.717149][ T5932] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 431.729176][ T5932] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 431.743775][ T10] usb 2-1: config 219 interface 0 has no altsetting 1 [ 431.751930][ T5823] usb usb3-port1: attempt power cycle [ 431.768666][ T5932] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.779047][ T10] usb 2-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 431.791271][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.800214][ T5932] usb 1-1: config 0 descriptor?? [ 431.809051][ T10] usb 2-1: Product: syz [ 431.819187][ T10] usb 2-1: Manufacturer: syz [ 431.827863][ T10] usb 2-1: SerialNumber: syz [ 432.100653][ T5823] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 432.233270][ T5932] kone 0003:1E7D:2CED.000E: unknown main item tag 0x4 [ 432.260293][ T5932] kone 0003:1E7D:2CED.000E: hidraw0: USB HID v0.00 Device [HID 1e7d:2ced] on usb-dummy_hcd.0-1/input0 [ 432.278044][ T5823] usb 3-1: device descriptor read/8, error -71 [ 432.880670][ T5823] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 433.142893][ T9869] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1055'. [ 433.280565][ T5823] usb 3-1: device not accepting address 38, error -71 [ 433.321617][ T5823] usb usb3-port1: unable to enumerate USB device [ 433.488059][ T10] usb 2-1: selecting invalid altsetting 0 [ 433.526591][ T10] usb 2-1: selecting invalid altsetting 0 [ 433.697704][ T5823] usb 1-1: USB disconnect, device number 36 [ 433.829048][ T10] usb 2-1: USB disconnect, device number 46 [ 433.940664][ T43] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 434.095899][ T9883] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 434.130571][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 434.143774][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 201, changing to 11 [ 434.159791][ T43] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 434.190594][ T43] usb 3-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 434.205962][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.236490][ T43] usb 3-1: config 0 descriptor?? [ 434.610354][ T9874] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 434.618493][ T9874] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 434.625209][ T9874] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 434.658856][ T43] logitech 0003:046D:CA04.000F: unknown main item tag 0x6 [ 434.676219][ T43] logitech 0003:046D:CA04.000F: hidraw0: USB HID vff.fa Device [HID 046d:ca04] on usb-dummy_hcd.2-1/input0 [ 434.731608][ T43] logitech 0003:046D:CA04.000F: no inputs found [ 434.869964][ T10] usb 3-1: USB disconnect, device number 39 [ 434.882240][ T5823] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 435.137178][ T5823] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 435.142451][ T43] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 435.192214][ T5823] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 435.203443][ T5823] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.211944][ T5823] usb 5-1: Product: syz [ 435.216277][ T5823] usb 5-1: Manufacturer: syz [ 435.225864][ T5823] usb 5-1: SerialNumber: syz [ 435.457500][ T9917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.551209][ T9917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.613704][ T5823] cdc_ncm 5-1:1.0: bind() failure [ 435.650151][ T5823] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 435.679693][ T5823] cdc_ncm 5-1:1.1: bind() failure [ 435.707719][ T5823] usb 5-1: USB disconnect, device number 37 [ 435.910898][ T5840] Bluetooth: hci1: command 0x0406 tx timeout [ 436.616472][ T5823] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 436.630674][ T5840] Bluetooth: hci4: command 0x0405 tx timeout [ 436.636776][ T5840] Bluetooth: hci3: command 0x0406 tx timeout [ 436.800996][ T5823] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 436.813300][ T5823] usb 3-1: config 0 has no interface number 0 [ 436.819681][ T5823] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 436.832420][ T5823] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 436.855253][ T5823] usb 3-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 437.012426][ T5823] usb 3-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 437.021755][ T5823] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.036167][ T5823] usb 3-1: config 0 descriptor?? [ 437.767616][ T9936] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1074'. [ 439.475119][ T9958] overlay: Unknown parameter 'uid>00000000000000016384' [ 439.648471][ T5823] uclogic 0003:28BD:0042.0010: failed retrieving string descriptor #100: -71 [ 439.680406][ T5823] uclogic 0003:28BD:0042.0010: failed retrieving pen parameters: -71 [ 439.733187][ T5823] uclogic 0003:28BD:0042.0010: pen probing failed: -71 [ 439.740137][ T5823] uclogic 0003:28BD:0042.0010: failed probing parameters: -71 [ 439.780402][ T5823] uclogic 0003:28BD:0042.0010: probe with driver uclogic failed with error -71 [ 439.814807][ T5823] usb 3-1: USB disconnect, device number 40 [ 439.961099][ T9969] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1086'. [ 440.014230][ T9964] binder: 9962:9964 ioctl c0046209 0 returned -22 [ 440.447682][ T5823] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 441.511444][ T5823] usb 3-1: Using ep0 maxpacket: 8 [ 441.778876][ T5823] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 441.799945][ T5823] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.011987][ T5823] pvrusb2: Hardware description: Terratec Grabster AV400 [ 442.742783][ T5823] pvrusb2: ********** [ 442.747591][ T9987] Can't find ip_set type hash:p,port,ip [ 442.921075][ T5823] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 442.985221][ T5823] pvrusb2: Important functionality might not be entirely working. [ 443.020121][ T5823] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 443.063658][ T5823] pvrusb2: ********** [ 443.073408][ T2344] pvrusb2: Invalid write control endpoint [ 443.139528][ T9996] pvrusb2: Invalid write control endpoint [ 443.313892][ T5823] usb 3-1: USB disconnect, device number 41 [ 443.336488][ T2344] pvrusb2: Invalid write control endpoint [ 443.350201][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 443.384116][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 443.391831][T10009] netlink: 'syz.3.1096': attribute type 10 has an invalid length. [ 443.402089][T10009] hsr0: entered promiscuous mode [ 443.403628][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 443.423712][ T2344] pvrusb2: Device being rendered inoperable [ 443.430002][ T2344] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 443.451335][T10009] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 443.464253][ T2344] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 443.496964][ T2344] pvrusb2: Attached sub-driver cx25840 [ 443.502547][ T10] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 443.511050][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 443.528657][T10009] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 443.540541][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 443.548008][T10009] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 443.655902][ T10] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 443.681978][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.759597][ T10] usb 1-1: config 0 descriptor?? [ 443.767989][ T10] cp210x 1-1:0.0: cp210x converter detected [ 444.394952][ T5919] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 444.790863][ T5919] usb 5-1: Using ep0 maxpacket: 16 [ 444.808563][ T5919] usb 5-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 444.823819][T10036] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1102'. [ 444.864920][ T5919] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 444.893448][T10039] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1103'. [ 444.913521][ T10] cp210x 1-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 444.913557][ T10] cp210x 1-1:0.0: querying part number failed [ 444.916438][ T10] usb 1-1: cp210x converter now attached to ttyUSB0 [ 444.919425][ T10] usb 1-1: USB disconnect, device number 37 [ 444.922932][ T10] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 444.923683][ T10] cp210x 1-1:0.0: device disconnected [ 444.931151][ T5919] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 444.982859][T10039] netlink: 'syz.0.1103': attribute type 181 has an invalid length. [ 445.069104][T10043] overlayfs: failed to clone upperpath [ 445.079169][ T5919] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.138145][ T5919] usb 5-1: Product: syz [ 445.155385][ T5919] usb 5-1: Manufacturer: syz [ 445.169438][ T5919] usb 5-1: SerialNumber: syz [ 445.402737][ T5919] usb 5-1: 0:2 : does not exist [ 445.414804][ T5919] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 445.470861][ T5932] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 445.470926][ T5919] usb 5-1: USB disconnect, device number 38 [ 445.611482][ T5932] usb 1-1: device descriptor read/64, error -71 [ 445.835222][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 445.870587][ T5932] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 446.020717][ T5932] usb 1-1: device descriptor read/64, error -71 [ 446.182280][ T5932] usb usb1-port1: attempt power cycle [ 446.348483][T10065] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 447.132256][T10060] team0: Device gtp0 is of different type [ 447.272697][ T5932] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 447.696031][T10070] lo speed is unknown, defaulting to 1000 [ 447.712997][T10070] lo speed is unknown, defaulting to 1000 [ 447.726080][T10070] lo speed is unknown, defaulting to 1000 [ 448.142749][T10071] bond0: left promiscuous mode [ 448.147602][T10071] bond_slave_0: left promiscuous mode [ 448.153491][T10071] bond_slave_1: left promiscuous mode [ 448.159105][T10071] team0: left promiscuous mode [ 448.164092][T10071] team_slave_0: left promiscuous mode [ 448.169753][T10071] team_slave_1: left promiscuous mode [ 448.178337][T10071] 8021q: adding VLAN 0 to HW filter on device bond0 [ 448.207335][ T5932] usb 1-1: device descriptor read/8, error -71 [ 448.270971][T10070] infiniband syz0: set active [ 448.276370][T10070] infiniband syz0: added lo [ 448.314508][T10070] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 448.320893][T10070] infiniband syz0: Couldn't open port 1 [ 448.329066][T10071] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 448.362600][T10070] RDS/IB: syz0: added [ 448.367123][T10070] smc: adding ib device syz0 with port count 1 [ 448.373671][T10070] smc: ib device syz0 port 1 has pnetid SYZ1 (user defined) [ 448.386095][ T5965] lo speed is unknown, defaulting to 1000 [ 448.413473][T10070] lo speed is unknown, defaulting to 1000 [ 448.575585][T10070] lo speed is unknown, defaulting to 1000 [ 448.729899][T10070] lo speed is unknown, defaulting to 1000 [ 448.768897][ T5932] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 448.891047][T10070] lo speed is unknown, defaulting to 1000 [ 449.043592][T10070] lo speed is unknown, defaulting to 1000 [ 449.282047][ T5965] lo speed is unknown, defaulting to 1000 [ 449.360981][ T5932] usb 1-1: device descriptor read/8, error -71 [ 449.521724][ T5932] usb usb1-port1: unable to enumerate USB device [ 454.327392][T10115] loop6: detected capacity change from 0 to 7 [ 454.350814][T10115] Dev loop6: unable to read RDB block 7 [ 454.369059][T10115] loop6: unable to read partition table [ 454.413819][T10115] loop6: partition table beyond EOD, truncated [ 454.455447][T10119] overlayfs: failed to resolve './file1': -2 [ 454.961518][T10115] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 455.849970][T10133] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1130'. [ 455.858944][T10133] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1130'. [ 455.880495][ T5965] IPVS: starting estimator thread 0... [ 456.760714][T10139] IPVS: using max 23 ests per chain, 55200 per kthread [ 457.452150][T10159] overlayfs: missing 'lowerdir' [ 457.487967][T10161] netlink: 'syz.2.1136': attribute type 83 has an invalid length. [ 458.660605][ T5842] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 458.913391][ T5842] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 458.931462][ T5842] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 459.040109][ T5842] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 459.064435][ T5842] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 459.167659][ T5842] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 459.196228][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 459.228824][ T5842] usb 3-1: Product: syz [ 459.236901][ T5842] usb 3-1: Manufacturer: syz [ 459.255040][ T5842] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 459.380581][ T5823] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 461.181548][ T5823] usb 5-1: config 0 has an invalid interface number: 90 but max is 0 [ 461.189720][ T5823] usb 5-1: config 0 has no interface number 0 [ 461.257125][ T5823] usb 5-1: New USB device found, idVendor=0547, idProduct=2720, bcdDevice=de.7f [ 461.274149][ T5823] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.284300][ T5823] usb 5-1: Product: syz [ 461.288673][ T5823] usb 5-1: Manufacturer: syz [ 461.297760][ T5823] usb 5-1: SerialNumber: syz [ 461.306366][ T5823] usb 5-1: config 0 descriptor?? [ 461.525382][ T5823] cdc_subset 5-1:0.90: probe with driver cdc_subset failed with error -22 [ 461.941758][ T5932] usb 5-1: USB disconnect, device number 39 [ 462.170813][ T5823] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 462.250847][T10202] xt_TCPMSS: Only works on TCP SYN packets [ 462.257374][T10202] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1147'. [ 462.354927][ T10] usb 3-1: USB disconnect, device number 42 [ 462.412641][T10207] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1151'. [ 462.440727][ T5823] usb 1-1: Using ep0 maxpacket: 32 [ 462.446114][T10207] vlan2: entered allmulticast mode [ 462.451723][T10207] bridge1: entered allmulticast mode [ 462.457914][T10207] bridge1: port 1(vlan2) entered blocking state [ 462.466456][T10207] bridge1: port 1(vlan2) entered disabled state [ 462.476069][ T5823] usb 1-1: unable to get BOS descriptor or descriptor too short [ 462.485656][ T5823] usb 1-1: config 224 has an invalid interface number: 244 but max is 0 [ 462.494965][ T5823] usb 1-1: config 224 has no interface number 0 [ 462.513427][ T5823] usb 1-1: config 224 interface 244 altsetting 4 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 462.549881][ T5823] usb 1-1: config 224 interface 244 has no altsetting 0 [ 462.567076][ T5823] usb 1-1: New USB device found, idVendor=0b95, idProduct=1780, bcdDevice=f6.7a [ 462.578071][ T5823] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.587010][ T5823] usb 1-1: Product: syz [ 462.592297][ T5823] usb 1-1: Manufacturer: syz [ 462.604661][ T5823] usb 1-1: SerialNumber: syz [ 463.819797][ T5823] asix 1-1:224.244 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 463.846329][ T5823] asix 1-1:224.244: probe with driver asix failed with error -71 [ 464.684874][ T5823] usb 1-1: USB disconnect, device number 42 [ 464.770797][T10228] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1155'. [ 464.955298][T10230] binder: 10229:10230 ioctl c0046209 0 returned -22 [ 466.539036][T10249] ptrace attach of "./syz-executor exec"[10250] was attempted by "./syz-executor exec"[10249] [ 467.836653][T10262] ptrace attach of "./syz-executor exec"[10263] was attempted by "./syz-executor exec"[10262] [ 468.510597][ T43] usb 1-1: new low-speed USB device number 43 using dummy_hcd [ 468.706092][ T43] usb 1-1: config 9 has an invalid interface number: 1 but max is 0 [ 468.740691][ T43] usb 1-1: config 9 has no interface number 0 [ 468.767144][ T43] usb 1-1: config 9 interface 1 has no altsetting 0 [ 468.985003][ T43] usb 1-1: string descriptor 0 read error: -22 [ 469.002266][ T43] usb 1-1: New USB device found, idVendor=2040, idProduct=b140, bcdDevice=75.36 [ 469.473369][T10278] loop6: detected capacity change from 0 to 7 [ 469.553723][T10278] Dev loop6: unable to read RDB block 7 [ 469.584299][T10278] loop6: unable to read partition table [ 469.738359][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.753489][T10278] loop6: partition table beyond EOD, truncated [ 469.760995][T10278] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 469.837029][ T43] cx231xx 1-1:9.1: New device @ 1.5 Mbps (2040:b140) with 1 interfaces [ 469.879215][ T43] cx231xx 1-1:9.1: Not found matching IAD interface [ 469.913634][T10285] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1170'. [ 470.045263][ T43] usb 1-1: USB disconnect, device number 43 [ 470.690967][ T5823] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 470.925886][ T5823] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 471.132963][T10297] ptrace attach of "./syz-executor exec"[10298] was attempted by "./syz-executor exec"[10297] [ 471.701306][ T5823] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 471.713270][ T5823] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 471.725223][ T5823] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 471.738382][ T5823] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 471.747951][ T5823] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.761481][ T5823] usb 3-1: config 0 descriptor?? [ 471.770137][T10289] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 472.345087][T10301] 9pnet_fd: Insufficient options for proto=fd [ 473.160974][ T5823] usbhid 3-1:0.0: can't add hid device: -71 [ 473.186800][ T5823] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 473.217856][ T5823] usb 3-1: USB disconnect, device number 43 [ 473.343195][T10311] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 473.359329][T10312] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 474.422369][T10319] loop6: detected capacity change from 0 to 7 [ 474.553584][T10319] Dev loop6: unable to read RDB block 7 [ 474.870697][T10319] loop6: unable to read partition table [ 474.911603][T10319] loop6: partition table beyond EOD, truncated [ 474.935497][T10325] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1182'. [ 474.950859][T10319] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 474.996608][T10311] lo speed is unknown, defaulting to 1000 [ 476.421102][T10336] ptrace attach of "./syz-executor exec"[10338] was attempted by "./syz-executor exec"[10336] [ 477.491351][T10348] nfs4: Unknown parameter 'dev/cpu/#/msr' [ 477.939637][T10351] loop6: detected capacity change from 0 to 63 [ 478.115325][T10354] overlayfs: overlapping lowerdir path [ 478.226740][T10348] buffer_io_error: 9 callbacks suppressed [ 478.226757][T10348] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.241141][T10348] Buffer I/O error on dev loop6, logical block 1, async page read [ 478.249062][T10348] Buffer I/O error on dev loop6, logical block 2, async page read [ 478.257058][T10348] Buffer I/O error on dev loop6, logical block 3, async page read [ 478.265056][T10348] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.273015][T10348] Buffer I/O error on dev loop6, logical block 1, async page read [ 478.281083][T10348] Buffer I/O error on dev loop6, logical block 2, async page read [ 478.289072][T10348] Buffer I/O error on dev loop6, logical block 3, async page read [ 478.297205][T10348] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.305206][T10348] Buffer I/O error on dev loop6, logical block 1, async page read [ 478.417981][T10354] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 478.568246][T10359] sg_write: data in/out 10372/14 bytes for SCSI command 0x0-- guessing data in; [ 478.568246][T10359] program syz.2.1191 not setting count and/or reply_len properly [ 479.606886][T10366] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 479.822656][T10378] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1194'. [ 479.903380][T10381] loop6: detected capacity change from 0 to 7 [ 479.930731][T10381] Dev loop6: unable to read RDB block 7 [ 479.937176][T10381] loop6: unable to read partition table [ 479.965459][T10381] loop6: partition table beyond EOD, truncated [ 479.975357][T10381] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 480.210144][T10397] netlink: 'syz.1.1199': attribute type 4 has an invalid length. [ 480.221040][ T9] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 480.267484][T10400] netlink: 'syz.1.1199': attribute type 4 has an invalid length. [ 480.287935][T10397] 9pnet_fd: Insufficient options for proto=fd [ 480.403736][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 480.414064][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 480.425400][ T9] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 480.436262][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.448892][ T9] usb 5-1: config 0 descriptor?? [ 480.500620][ T5965] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 480.663744][ T5965] usb 1-1: Using ep0 maxpacket: 32 [ 480.685867][ T5965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 480.716040][ T5965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 480.742980][ T5965] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 480.767564][ T5965] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.892431][ T9] ath6kl: Failed to submit usb control message: -71 [ 480.899235][ T9] ath6kl: unable to send the bmi data to the device: -71 [ 480.907170][ T9] ath6kl: Unable to send get target info: -71 [ 480.917803][ T9] ath6kl: Failed to init ath6kl core: -71 [ 480.927030][ T9] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 481.360268][ T9] usb 5-1: USB disconnect, device number 40 [ 481.745409][T10422] lo speed is unknown, defaulting to 1000 [ 481.990582][ T5965] usb 1-1: config 0 descriptor?? [ 482.186202][T10424] lo speed is unknown, defaulting to 1000 [ 482.240736][T10432] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1208'. [ 482.503305][T10399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 482.532337][T10399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 482.564596][ T5965] greenasia 0003:0E8F:0012.0011: item fetching failed at offset 0/3 [ 482.584548][ T5965] greenasia 0003:0E8F:0012.0011: parse failed [ 482.620767][ T5965] greenasia 0003:0E8F:0012.0011: probe with driver greenasia failed with error -22 [ 482.621882][T10441] loop6: detected capacity change from 0 to 7 [ 482.703480][T10441] Dev loop6: unable to read RDB block 7 [ 482.725219][T10441] loop6: unable to read partition table [ 482.756650][T10441] loop6: partition table beyond EOD, truncated [ 482.774426][ T9] usb 1-1: USB disconnect, device number 44 [ 482.800631][T10441] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 484.140541][ T5965] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 484.500611][ T5965] usb 5-1: device descriptor read/64, error -71 [ 484.850327][ T5965] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 484.873847][T10480] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1221'. [ 484.976680][T10482] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 485.297784][ T5965] usb 5-1: device descriptor read/64, error -71 [ 485.735485][T10479] befs: (nbd0): No write support. Marking filesystem read-only [ 485.743933][T10479] syz.0.1221: attempt to access beyond end of device [ 485.743933][T10479] nbd0: rw=0, sector=0, nr_sectors = 2 limit=0 [ 485.756795][T10479] befs: (nbd0): unable to read superblock [ 485.763142][ T5932] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 485.835471][ T5965] usb usb5-port1: attempt power cycle [ 486.301853][ T5932] usb 3-1: Using ep0 maxpacket: 8 [ 486.312348][ T5932] usb 3-1: config 1 interface 0 has no altsetting 0 [ 486.322372][ T5932] usb 3-1: New USB device found, idVendor=05ac, idProduct=024c, bcdDevice= 0.40 [ 486.331964][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.359279][ T5932] usb 3-1: Product: syz [ 486.379250][ T5932] usb 3-1: Manufacturer: syz [ 486.388438][ T5932] usb 3-1: SerialNumber: syz [ 486.453150][T10487] loop6: detected capacity change from 0 to 7 [ 486.461066][T10487] Dev loop6: unable to read RDB block 7 [ 486.466790][T10487] loop6: unable to read partition table [ 486.474585][T10487] loop6: partition table beyond EOD, truncated [ 486.481594][T10487] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 486.628250][ T5932] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/input/input15 [ 486.866955][ T5190] bcm5974 3-1:1.0: could not read from device [ 487.066659][ T5190] bcm5974 3-1:1.0: could not read from device [ 487.071019][ T5932] usb 3-1: USB disconnect, device number 44 [ 487.097197][T10498] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1226'. [ 487.377319][T10502] xt_l2tp: invalid flags combination: 8 [ 488.517643][T10518] loop6: detected capacity change from 0 to 7 [ 488.528228][T10518] Dev loop6: unable to read RDB block 7 [ 488.536162][T10518] loop6: unable to read partition table [ 488.546359][T10518] loop6: partition table beyond EOD, truncated [ 488.554104][T10518] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 488.681189][T10521] netlink: 'syz.2.1233': attribute type 1 has an invalid length. [ 488.689028][T10521] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1233'. [ 490.112402][ T10] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 490.195222][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 490.219995][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 490.245706][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 490.745351][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 490.767740][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 490.810369][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 490.825292][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 490.864225][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 490.867633][ T10] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 490.890398][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 490.902265][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.915911][ T10] usb 1-1: config 0 descriptor?? [ 490.922580][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 490.936751][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 490.958209][T10546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1246'. [ 491.205354][T10561] dummy0: entered promiscuous mode [ 491.233988][T10561] dummy0: entered allmulticast mode [ 491.348707][ T10] plantronics 0003:047F:FFFF.0012: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 492.974944][T10581] binder: 10580:10581 ioctl c0046209 0 returned -22 [ 493.324041][ T5932] usb 1-1: USB disconnect, device number 45 [ 493.515154][ T9622] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.696192][ T9622] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.799560][T10601] __nla_validate_parse: 4 callbacks suppressed [ 493.799582][T10601] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1265'. [ 493.902729][ T9622] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.275177][T10597] lo: Caught tx_queue_len zero misconfig [ 494.692654][ T9622] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 495.228698][T10623] netlink: 'syz.0.1271': attribute type 3 has an invalid length. [ 495.256734][ T5841] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 495.274450][ T5841] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 495.282332][ T9622] bridge_slave_1: left allmulticast mode [ 495.289844][ T9622] bridge_slave_1: left promiscuous mode [ 495.297684][ T9622] bridge0: port 2(bridge_slave_1) entered disabled state [ 495.307474][ T5841] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 495.318711][ T5841] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 495.330623][ T5841] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 495.356169][ T9622] bridge_slave_0: left allmulticast mode [ 495.362320][ T9622] bridge_slave_0: left promiscuous mode [ 495.374092][ T9622] bridge0: port 1(bridge_slave_0) entered disabled state [ 495.398908][ T9622] batman_adv: batadv0: Interface deactivated: gretap1 [ 495.884466][ T9622] batman_adv: batadv0: Removing interface: gretap1 [ 496.074010][T10649] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1276'. [ 496.188092][T10653] loop6: detected capacity change from 0 to 7 [ 496.198671][T10653] Dev loop6: unable to read RDB block 7 [ 496.207374][T10653] loop6: unable to read partition table [ 496.214084][T10653] loop6: partition table beyond EOD, truncated [ 496.223416][T10653] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 496.411254][ T9622] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 496.429128][ T9622] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 496.448673][ T9622] bond0 (unregistering): (slave team0): Releasing backup interface [ 497.006676][ T9622] bond0 (unregistering): Released all slaves [ 497.164997][T10624] lo speed is unknown, defaulting to 1000 [ 497.345981][T10668] binfmt_misc: register: failed to install interpreter file ./cgroup.cpu/cpuset.cpus [ 497.759374][ T5840] Bluetooth: hci1: command tx timeout [ 498.150212][T10677] tipc: Enabled bearer , priority 0 [ 498.186425][T10677] syzkaller0: entered promiscuous mode [ 498.211906][T10677] syzkaller0: entered allmulticast mode [ 498.414858][T10677] tipc: Resetting bearer [ 498.469721][T10676] tipc: Resetting bearer [ 498.642639][T10676] tipc: Disabling bearer [ 499.140233][ T9622] hsr_slave_0: left promiscuous mode [ 499.174743][ T9622] hsr_slave_1: left promiscuous mode [ 499.186064][ T9622] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 499.196502][ T9622] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 499.212110][ T9622] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 499.226310][ T9622] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 499.456463][ T9622] veth1_macvtap: left promiscuous mode [ 499.469475][ T9622] veth0_macvtap: left promiscuous mode [ 499.475840][ T9622] veth1_vlan: left promiscuous mode [ 499.532373][ T9622] veth0_vlan: left promiscuous mode [ 499.922323][ T5840] Bluetooth: hci1: command tx timeout [ 500.004726][T10705] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1294'. [ 501.990790][ T5840] Bluetooth: hci1: command tx timeout [ 502.126006][T10708] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1294'. [ 502.361755][T10711] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1294'. [ 503.550675][ T9] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 503.972797][ T5932] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 503.990617][ T5842] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 504.073732][ T5840] Bluetooth: hci1: command tx timeout [ 504.110250][ T9622] team0 (unregistering): Port device team_slave_1 removed [ 504.139477][ T5932] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 504.152939][ T5932] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 504.167293][ T5842] usb 3-1: config 1 interface 0 has no altsetting 0 [ 504.174165][ T5932] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 504.187600][ T5932] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 504.197151][ T5932] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.207626][ T9622] team0 (unregistering): Port device team_slave_0 removed [ 504.208036][ T5842] usb 3-1: New USB device found, idVendor=18d1, idProduct=5022, bcdDevice= 0.40 [ 504.228282][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.236927][ T5842] usb 3-1: Product: 㹤溮ㅆ넳蟦熳雈㢽衣츣蠍횸︤幇龦씿힑䂊Ⱂ螌䈦씾䄌덶㓄꫖້悺蚨ዮ㽎狼䝂Քက쓊ῖ䔆酊뎦퍛쐸ᠱ [ 504.254151][ T5932] usb 1-1: config 0 descriptor?? [ 504.259509][ T5842] usb 3-1: Manufacturer: ࠁ [ 504.269047][ T5842] usb 3-1: SerialNumber: syz [ 504.487227][T10726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.498486][ T5932] plantronics 0003:047F:FFFF.0013: reserved main item tag 0xe [ 504.501068][T10726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.510712][ T5932] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 504.528248][ T5932] plantronics 0003:047F:FFFF.0013: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 504.581600][ T5842] usbhid 3-1:1.0: can't add hid device: -71 [ 504.588864][ T5842] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 504.601701][ T5842] usb 3-1: USB disconnect, device number 45 [ 504.888670][ T9620] smc: removing ib device syz0 [ 504.954453][ T10] lo speed is unknown, defaulting to 1000 [ 504.960324][ T10] syz0: Port: 1 Link DOWN [ 504.993689][ T43] usb 1-1: USB disconnect, device number 46 [ 505.018360][ T5842] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 505.211155][ T5842] usb 3-1: Using ep0 maxpacket: 16 [ 505.231378][ T5842] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 505.255467][ T5842] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 505.465500][ T5842] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 505.475091][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.495521][ T5842] usb 3-1: Product: syz [ 505.499766][ T5842] usb 3-1: Manufacturer: syz [ 505.504884][ T5842] usb 3-1: SerialNumber: syz [ 506.231550][ T5842] usb 3-1: cannot find UAC_HEADER [ 506.759260][T10751] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 506.930844][ T9] usb 2-1: device descriptor read/64, error -71 [ 506.942799][ T5842] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 507.085792][T10758] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1304'. [ 507.572745][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 507.745542][ T5842] usb 3-1: USB disconnect, device number 46 [ 507.790601][ T9] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 507.925355][T10624] chnl_net:caif_netlink_parms(): no params data found [ 508.048057][ T9] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 508.079409][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 508.098633][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 508.133785][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 508.160575][ T9] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 508.169811][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.180562][ T5965] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 508.202056][ T9] usb 2-1: config 0 descriptor?? [ 508.212231][T10747] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 508.372803][ T5965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 508.387377][ T5965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 508.397990][ T5965] usb 1-1: New USB device found, idVendor=1532, idProduct=010e, bcdDevice= 0.00 [ 508.411013][ T5965] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.455225][ T5965] usb 1-1: config 0 descriptor?? [ 508.472859][T10624] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.480204][T10624] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.491870][T10624] bridge_slave_0: entered allmulticast mode [ 508.517052][T10624] bridge_slave_0: entered promiscuous mode [ 508.526860][T10624] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.545187][T10624] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.563402][T10624] bridge_slave_1: entered allmulticast mode [ 508.576912][ T5842] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 508.614828][T10624] bridge_slave_1: entered promiscuous mode [ 508.661849][ T9] plantronics 0003:047F:FFFF.0014: reserved main item tag 0xd [ 508.723805][ T9] plantronics 0003:047F:FFFF.0014: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 508.769565][T10624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 508.788384][ T5842] usb 3-1: Using ep0 maxpacket: 16 [ 508.805046][ T5842] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 508.827022][ T5842] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 508.859684][T10624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 508.862766][ T5842] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 508.901231][ T5965] razer 0003:1532:010E.0015: unknown main item tag 0x7 [ 508.902272][ T5842] usb 3-1: config 0 interface 0 has no altsetting 0 [ 508.924400][ T5842] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 508.926950][ T5965] razer 0003:1532:010E.0015: item fetching failed at offset 3/5 [ 508.936650][ T5842] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.963235][ T9] usb 2-1: USB disconnect, device number 49 [ 508.964589][ T5965] razer 0003:1532:010E.0015: probe with driver razer failed with error -22 [ 509.016445][ T5842] usb 3-1: config 0 descriptor?? [ 509.068477][T10624] team0: Port device team_slave_0 added [ 509.096969][T10624] team0: Port device team_slave_1 added [ 509.204261][T10780] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1312'. [ 509.205696][T10624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 509.220462][T10624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 509.246962][T10624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 509.261175][T10624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 509.268971][T10624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 509.295284][T10624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 509.307481][T10780] hsr_slave_0: left promiscuous mode [ 509.314646][T10780] hsr_slave_1: left promiscuous mode [ 509.409412][T10624] hsr_slave_0: entered promiscuous mode [ 509.416108][T10624] hsr_slave_1: entered promiscuous mode [ 509.484772][ T9622] IPVS: stop unused estimator thread 0... [ 509.710831][ T5842] usb 3-1: USB disconnect, device number 47 [ 510.103016][T10624] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 510.118575][T10624] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 510.129295][T10624] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 510.143400][T10624] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 510.177869][ T5965] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 510.348665][ T5965] usb 2-1: Using ep0 maxpacket: 16 [ 510.363269][ T5965] usb 2-1: unable to get BOS descriptor or descriptor too short [ 510.378070][T10802] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 510.384146][ T5965] usb 2-1: config 108 has an invalid interface number: 14 but max is 0 [ 510.395035][T10802] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 510.402108][ T5965] usb 2-1: config 108 has no interface number 0 [ 510.409835][ T5965] usb 2-1: config 108 interface 14 altsetting 6 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 510.421779][ T5965] usb 2-1: config 108 interface 14 has no altsetting 0 [ 510.433392][ T5965] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=d8.65 [ 510.443256][ T5965] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.456756][ T5965] usb 2-1: Product: syz [ 510.461116][ T5965] usb 2-1: Manufacturer: syz [ 510.465882][ T5965] usb 2-1: SerialNumber: syz [ 510.490503][T10624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 510.517157][T10624] 8021q: adding VLAN 0 to HW filter on device team0 [ 510.532771][ T9620] bridge0: port 1(bridge_slave_0) entered blocking state [ 510.541428][ T9620] bridge0: port 1(bridge_slave_0) entered forwarding state [ 510.559106][ T9621] bridge0: port 2(bridge_slave_1) entered blocking state [ 510.566297][ T9621] bridge0: port 2(bridge_slave_1) entered forwarding state [ 510.669085][ C1] hrtimer: interrupt took 42812 ns [ 510.725782][ T5932] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 510.735377][T10807] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.752449][T10807] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.840575][ T5919] usb 1-1: USB disconnect, device number 47 [ 510.929151][ T5932] usb 3-1: config 0 has an invalid interface number: 217 but max is 0 [ 510.942011][ T5932] usb 3-1: config 0 has no interface number 0 [ 510.970336][ T5932] usb 3-1: New USB device found, idVendor=a168, idProduct=0618, bcdDevice=e3.a4 [ 510.990312][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.998710][ T5932] usb 3-1: Product: syz [ 511.012487][ T5932] usb 3-1: Manufacturer: syz [ 511.028056][ T5932] usb 3-1: SerialNumber: syz [ 511.048771][ T5965] usb 2-1: USB disconnect, device number 50 [ 511.068420][ T5932] usb 3-1: config 0 descriptor?? [ 511.103124][ T5932] gspca_main: gspca_sn9c20x-2.14.0 probing a168:0618 [ 511.117960][T10624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 511.238278][T10822] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1321'. [ 511.670880][ T5932] gspca_sn9c20x: Write register 1001 failed -71 [ 511.711608][ T5932] gspca_sn9c20x: Device initialization failed [ 511.746643][ T5932] gspca_sn9c20x 3-1:0.217: probe with driver gspca_sn9c20x failed with error -71 [ 511.781160][ T5932] usb 3-1: USB disconnect, device number 48 [ 512.149968][T10624] veth0_vlan: entered promiscuous mode [ 512.174293][T10624] veth1_vlan: entered promiscuous mode [ 513.037800][T10624] veth0_macvtap: entered promiscuous mode [ 513.058918][T10624] veth1_macvtap: entered promiscuous mode [ 513.080629][T10624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 513.142109][T10624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 513.190393][T10624] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.372153][T10624] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.382174][T10624] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.394313][T10624] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 513.631999][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 513.716587][ T5932] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 513.738652][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.239837][ T9620] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 514.284864][ T5932] usb 3-1: Using ep0 maxpacket: 8 [ 514.296914][ T9620] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 514.312261][ T5932] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 514.364730][ T5932] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 514.404950][ T5932] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 514.437395][T10861] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1330'. [ 514.438792][ T5932] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 514.517738][ T5932] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 514.574663][ T5932] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 514.591013][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 514.613147][ T5932] usb 3-1: Product: syz [ 514.626297][ T5932] usb 3-1: Manufacturer: syz [ 514.631157][ T5932] usb 3-1: SerialNumber: syz [ 514.655052][ T5932] usb 3-1: config 0 descriptor?? [ 514.735318][T10866] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 514.766466][T10863] netlink: 'syz.3.1330': attribute type 13 has an invalid length. [ 514.784974][T10863] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1330'. [ 514.803185][T10866] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 514.812089][T10866] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 514.827642][T10866] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 514.833762][T10858] bridge0: port 2(bridge_slave_1) entered disabled state [ 514.843085][T10858] bridge0: port 1(bridge_slave_0) entered disabled state [ 514.852407][T10866] kvm: requested 85485 ns i8254 timer period limited to 200000 ns [ 514.872457][T10866] kvm: requested 93028 ns i8254 timer period limited to 200000 ns [ 514.901009][T10846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.923590][T10866] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 514.927550][T10875] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.944580][T10846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.960259][T10875] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.972089][ T5932] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 514.977539][T10866] kvm: requested 10057 ns i8254 timer period limited to 200000 ns [ 514.982433][ T5932] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 515.003439][T10866] kvm: requested 155047 ns i8254 timer period limited to 200000 ns [ 515.035792][T10866] kvm: requested 160914 ns i8254 timer period limited to 200000 ns [ 515.186457][ T5932] radio-si470x 3-1:0.0: software version 0, hardware version 0 [ 515.201228][ T5932] radio-si470x 3-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 515.264476][ T5932] radio-si470x 3-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 515.340365][ T5842] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 515.411548][ T5932] radio-si470x 3-1:0.0: submitting int urb failed (-90) [ 515.532818][ T5842] usb 2-1: Using ep0 maxpacket: 32 [ 515.543872][ T5842] usb 2-1: config 26 has too many interfaces: 141, using maximum allowed: 32 [ 515.556890][ T5842] usb 2-1: config 26 has an invalid descriptor of length 0, skipping remainder of the config [ 515.568161][ T5842] usb 2-1: config 26 has 0 interfaces, different from the descriptor's value: 141 [ 515.587053][ T5842] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 515.596564][ T5842] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.609260][ T5842] usb 2-1: Product: syz [ 515.626160][ T5842] usb 2-1: Manufacturer: syz [ 515.626184][ T5842] usb 2-1: SerialNumber: syz [ 515.978710][T10891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.991490][T10891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.085048][ T5932] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 516.201987][ T5932] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -22 [ 516.234081][ T5842] usb 2-1: USB disconnect, device number 51 [ 516.470245][ T5932] usb 3-1: USB disconnect, device number 49 [ 517.487574][ T10] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 517.596622][T10906] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1341'. [ 517.820543][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 517.844907][ T10] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 517.854829][ T10] usb 2-1: config 0 has no interface number 0 [ 517.861272][ T10] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 518.823635][ T5842] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 518.842201][ T10] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 518.867793][ T10] usb 2-1: config 0 interface 41 has no altsetting 0 [ 519.894128][ T5932] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 519.935561][ T10] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 521.005428][ T5842] usb 3-1: Using ep0 maxpacket: 32 [ 521.344103][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.382288][ T10] usb 2-1: Product: syz [ 521.397482][ T10] usb 2-1: Manufacturer: syz [ 521.419373][ T10] usb 2-1: SerialNumber: syz [ 521.437197][ T5842] usb 3-1: device descriptor read/all, error -71 [ 521.723631][ T10] usb 2-1: config 0 descriptor?? [ 521.728872][ T5932] usb 6-1: device descriptor read/all, error -71 [ 521.757341][T10901] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 521.791508][T10901] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 522.035720][ T10] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -71 [ 522.055938][T10937] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1351'. [ 522.077634][ T10] usb 2-1: USB disconnect, device number 52 [ 523.606949][T10948] fuse: Bad value for 'user_id' [ 523.629792][T10948] fuse: Bad value for 'user_id' [ 524.435361][T10960] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 524.631918][T10960] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 525.470002][T10965] loop6: detected capacity change from 0 to 7 [ 525.512170][T10967] pimreg: tun_chr_ioctl cmd 1074812118 [ 525.518090][T10967] pimreg: tun_chr_ioctl cmd 1074292231 [ 525.533778][T10965] Dev loop6: unable to read RDB block 7 [ 525.540226][T10965] loop6: unable to read partition table [ 525.546213][T10965] loop6: partition table beyond EOD, truncated [ 525.552994][T10965] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 525.764671][T10971] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 525.773939][ T5912] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 525.968161][ T5912] usb 2-1: config 0 has an invalid descriptor of length 102, skipping remainder of the config [ 526.001706][ T5912] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 526.016929][ T5912] usb 2-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00 [ 526.028467][ T5912] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.054770][ T5912] usb 2-1: config 0 descriptor?? [ 526.067877][T10976] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1364'. [ 530.795743][ T5823] usb 2-1: USB disconnect, device number 53 [ 531.028451][T10997] overlayfs: conflicting lowerdir path [ 531.407021][T10990] "syz.3.1367" (10990) uses obsolete ecb(arc4) skcipher [ 531.491982][ T5823] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 531.527176][T11012] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 531.675705][ T5823] usb 1-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid wMaxPacketSize 0 [ 531.693326][ T5823] usb 1-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 532.489779][ T5823] usb 1-1: config 0 interface 0 has no altsetting 0 [ 532.598694][ T5823] usb 1-1: New USB device found, idVendor=05ac, idProduct=025b, bcdDevice= 0.00 [ 532.639243][T11016] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 532.658490][ T5823] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 532.717904][ T5823] usb 1-1: config 0 descriptor?? [ 533.052515][ T5823] usb 1-1: string descriptor 0 read error: -71 [ 533.109409][ T5823] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input19 [ 533.134194][ T5190] bcm5974 1-1:0.0: could not read from device [ 533.168725][ T5190] bcm5974 1-1:0.0: could not read from device [ 533.183959][ T5190] bcm5974 1-1:0.0: could not read from device [ 533.192145][ T5823] usb 1-1: USB disconnect, device number 48 [ 533.199571][ T5190] bcm5974 1-1:0.0: could not read from device [ 533.241212][T11029] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1376'. [ 533.373181][ T10] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 533.576159][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 533.683317][ T10] usb 2-1: config 64 has an invalid interface number: 241 but max is 1 [ 533.693051][ T10] usb 2-1: config 64 has an invalid interface number: 186 but max is 1 [ 533.724948][ T10] usb 2-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 533.761646][ T10] usb 2-1: config 64 has no interface number 0 [ 533.767903][ T10] usb 2-1: config 64 has no interface number 1 [ 533.930775][ T10] usb 2-1: config 64 interface 186 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 533.944961][ T10] usb 2-1: config 64 interface 241 has no altsetting 0 [ 534.273820][ T10] usb 2-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.04 [ 534.313010][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.362190][ T10] usb 2-1: Product: syz [ 534.386651][ T10] usb 2-1: Manufacturer: syz [ 534.397522][ T10] usb 2-1: SerialNumber: syz [ 534.444410][ T10] go7007 2-1:64.241: probe with driver go7007 failed with error -12 [ 534.469932][ T10] go7007 2-1:64.186: probe with driver go7007 failed with error -12 [ 534.515156][T11052] tipc: Enabling of bearer rejected, failed to enable media [ 534.634863][ T5965] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 534.661096][ T5912] usb 2-1: USB disconnect, device number 54 [ 534.794935][ T5965] usb 3-1: Using ep0 maxpacket: 16 [ 534.808294][ T5965] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 534.836273][ T5965] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 534.875577][ T5965] usb 3-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 534.921252][ T5965] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 535.036674][ T5965] usb 3-1: config 0 descriptor?? [ 535.630310][T11066] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not 'ethtool' [ 536.097885][ T30] audit: type=1326 audit(1755133799.170:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc15a38ebe9 code=0x7ffc0000 [ 536.164170][ T30] audit: type=1326 audit(1755133799.170:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc15a38ebe9 code=0x7ffc0000 [ 536.174480][ T5965] letsketch 0003:6161:4D15.0017: Device info: ఁ [ 536.205515][ T30] audit: type=1326 audit(1755133799.170:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=113 compat=0 ip=0x7fc15a38ebe9 code=0x7ffc0000 [ 536.288143][ T30] audit: type=1326 audit(1755133799.170:261): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc15a38ebe9 code=0x7ffc0000 [ 536.336585][ T30] audit: type=1326 audit(1755133799.170:262): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc15a38ebe9 code=0x7ffc0000 [ 536.362953][ T30] audit: type=1326 audit(1755133799.170:263): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=252 compat=0 ip=0x7fc15a38ebe9 code=0x7ffc0000 [ 536.388859][ T5965] letsketch 0003:6161:4D15.0017: Device info: 擃 [ 536.394526][ T30] audit: type=1326 audit(1755133799.170:264): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc15a38ebe9 code=0x7ffc0000 [ 536.558186][ T30] audit: type=1326 audit(1755133799.170:265): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc15a38ebe9 code=0x7ffc0000 [ 536.581691][ T30] audit: type=1326 audit(1755133799.170:266): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc15a38d550 code=0x7ffc0000 [ 536.616656][ T30] audit: type=1326 audit(1755133799.170:267): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=11079 comm="syz.5.1392" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7fc15a390417 code=0x7ffc0000 [ 537.376099][ T5965] usb 3-1: Max retries (5) exceeded reading string descriptor 202 [ 537.417278][ T5965] letsketch 0003:6161:4D15.0017: probe with driver letsketch failed with error -71 [ 537.526898][ T5965] usb 3-1: USB disconnect, device number 52 [ 537.602740][T11093] tipc: Enabling of bearer rejected, failed to enable media [ 537.991152][ T5965] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 538.183611][ T5965] usb 3-1: Using ep0 maxpacket: 8 [ 538.367120][ T5965] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 538.384261][ T5965] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 538.432435][ T5965] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 538.452940][ T10] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 538.460744][ T5965] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 538.493707][ T5965] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 538.809867][ T5965] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.963580][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 538.980571][ T10] usb 6-1: config 1 has an invalid interface number: 27 but max is 0 [ 538.999760][ T10] usb 6-1: config 1 has no interface number 0 [ 539.016799][ T10] usb 6-1: New USB device found, idVendor=06e1, idProduct=a190, bcdDevice= 3.d5 [ 539.034045][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=246 [ 539.058781][ T10] usb 6-1: Product: syz [ 539.074457][ T10] usb 6-1: Manufacturer: syz [ 539.085186][ T10] usb 6-1: SerialNumber: syz [ 539.111156][ T5965] usb 3-1: GET_CAPABILITIES returned 0 [ 539.125075][ T5965] usbtmc 3-1:16.0: can't read capabilities [ 539.346831][ T10] gspca_main: spca506-2.14.0 probing 06e1:a190 [ 539.539530][ T10] usb 6-1: USB disconnect, device number 4 [ 539.763741][ T43] usb 3-1: USB disconnect, device number 53 [ 540.522421][T11132] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1404'. [ 541.222851][T11144] trusted_key: encrypted_key: keylen parameter is missing [ 541.492371][T11150] netlink: 'syz.1.1408': attribute type 1 has an invalid length. [ 541.787838][T11158] tipc: Enabling of bearer rejected, failed to enable media [ 541.813803][ T5965] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 541.893987][ T43] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 541.993665][ T5965] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 542.027211][ T5965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 542.060857][ T5965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 542.089343][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 542.143553][ T43] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 542.164705][ T5965] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 542.184579][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.200908][ T5965] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 542.218627][ T43] usb 2-1: config 0 descriptor?? [ 542.237414][ T5965] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.267557][ T5965] usb 1-1: config 0 descriptor?? [ 542.277785][T11151] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 542.479447][ T43] usbhid 2-1:0.0: can't add hid device: -71 [ 542.491460][ T43] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 542.522378][ T43] usb 2-1: USB disconnect, device number 55 [ 542.701370][T11184] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1416'. [ 542.713285][T11184] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1416'. [ 542.725791][ T5965] plantronics 0003:047F:FFFF.0018: reserved main item tag 0xd [ 542.761710][ T5965] plantronics 0003:047F:FFFF.0018: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 542.981795][T11199] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1421'. [ 543.049174][ T5823] usb 1-1: USB disconnect, device number 49 [ 543.130250][T11202] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1422'. [ 543.239387][ T43] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 543.340202][T11206] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1419'. [ 543.420981][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 543.435416][ T43] usb 2-1: config index 0 descriptor too short (expected 36, got 27) [ 543.457570][ T43] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 543.492994][ T43] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 543.515545][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.543188][ T43] usb 2-1: config 0 descriptor?? [ 543.563590][ T43] ldusb 2-1:0.0: Interrupt in endpoint not found [ 543.569085][T11210] netlink: 'syz.2.1425': attribute type 10 has an invalid length. [ 543.578235][T11210] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1425'. [ 543.585261][ T43] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 543.612905][T11210] team0: Port device geneve0 added [ 543.773102][T11148] netlink: 'syz.1.1408': attribute type 21 has an invalid length. [ 544.450735][T11224] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1429'. [ 544.464734][T11224] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1429'. [ 545.377992][ T5912] usb 2-1: USB disconnect, device number 56 [ 546.900179][T11235] overlayfs: conflicting lowerdir path [ 546.912688][T11235] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 546.979477][T11235] netlink: 9472 bytes leftover after parsing attributes in process `syz.1.1434'. [ 547.098150][T11252] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1437'. [ 547.550573][T11252] 8021q: adding VLAN 0 to HW filter on device bond3 [ 547.685431][T11269] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 548.724334][T11254] macvlan0: entered promiscuous mode [ 548.730147][T11254] macvlan0: entered allmulticast mode [ 548.766808][T11254] bond3: entered promiscuous mode [ 548.797256][T11254] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 548.861160][T11279] netlink: 1284 bytes leftover after parsing attributes in process `syz.5.1444'. [ 548.906877][T11254] bond3: left promiscuous mode [ 549.365901][T11295] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 551.424111][T11298] binder: 11297:11298 ioctl c0046209 0 returned -22 [ 551.672428][T11295] orangefs_mount: mount request failed with -4 [ 552.224117][T11311] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1451'. [ 553.090898][T11320] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1455'. [ 553.109087][T11321] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1455'. [ 553.391045][T11327] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 553.571414][ T5965] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 554.170692][ T5965] usb 2-1: Using ep0 maxpacket: 32 [ 554.182373][ T5965] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 554.203932][ T5965] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 554.241578][ T5965] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 554.265493][ T5965] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.294479][ T5965] usb 2-1: Product: и [ 554.318843][ T5965] usb 2-1: Manufacturer: ọ苺࿷謆त֧⹣壤忿惉驗攘頳㜆傆ఢ嗒䎵⪿씕鸇㿹棍讕ᾷ莆ײ杌覝뒽Ṯ댦岥뙕쭐柷ꀇ꬐䧞渥ⴥ䠔䫃霦䨘䕕혩녀ꯍ誇慙氜 [ 554.376162][ T5965] usb 2-1: SerialNumber: syz [ 554.410663][T11331] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: mode dependency failed, not supported in mode active-backup(1) [ 554.457772][T11333] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1457'. [ 554.975992][ T5919] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 555.043298][T11351] CIFS: VFS: Malformed UNC in devname [ 555.147022][ T5919] usb 6-1: Using ep0 maxpacket: 32 [ 555.160475][ T5919] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 555.447302][ T5919] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 555.457683][ T5919] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 555.466868][ T5919] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.481322][ T5919] usb 6-1: config 0 descriptor?? [ 555.495086][ T5919] hub 6-1:0.0: USB hub found [ 555.523646][ T5965] usb 2-1: 0:2 : does not exist [ 556.138216][ T5919] hub 6-1:0.0: config failed, can't read hub descriptor (err -90) [ 556.157339][ T5965] usb 2-1: USB disconnect, device number 57 [ 556.414721][T11363] macsec1: entered allmulticast mode [ 556.420408][T11363] macvlan1: entered allmulticast mode [ 556.425929][T11363] veth1_vlan: entered allmulticast mode [ 556.462320][ T5919] usbhid 6-1:0.0: can't add hid device: -71 [ 556.469286][ T5919] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 556.491434][T11363] macvlan1: left allmulticast mode [ 556.497010][T11363] veth1_vlan: left allmulticast mode [ 556.868984][ T5919] usb 6-1: USB disconnect, device number 5 [ 556.987727][T11365] syzkaller0: entered promiscuous mode [ 556.993378][T11365] syzkaller0: entered allmulticast mode [ 557.005151][T11367] tap0: tun_chr_ioctl cmd 2147767520 [ 557.366241][T11375] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1472'. [ 558.424997][ T5823] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 558.815448][ T5823] usb 2-1: Using ep0 maxpacket: 32 [ 559.053935][ T5823] usb 2-1: config 0 interface 0 altsetting 128 endpoint 0x2 has invalid wMaxPacketSize 0 [ 559.069949][ T5823] usb 2-1: config 0 interface 0 has no altsetting 0 [ 559.083957][ T5823] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 559.207004][ T5823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.218258][ T5823] usb 2-1: config 0 descriptor?? [ 559.608733][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 559.608753][ T30] audit: type=1326 audit(1755133821.164:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11400 comm="syz.3.1477" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f429998ebe9 code=0x0 [ 559.683547][ T5823] usbhid 2-1:0.0: can't add hid device: -71 [ 559.713644][ T5823] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 559.874727][ T5823] usb 2-1: USB disconnect, device number 58 [ 561.547914][T11419] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1481'. [ 561.594037][T11423] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.602935][T11419] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 561.611750][T11419] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 561.620662][T11419] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 561.629448][T11419] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 561.710786][T11423] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.086168][T11434] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1483'. [ 562.391353][ T5912] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 562.416418][ T5919] hid-generic 0000:0000:0000.0019: unknown main item tag 0x0 [ 562.444283][ T5919] hid-generic 0000:0000:0000.0019: hidraw0: HID v0.00 Device [syz1] on syz0 [ 562.682932][ T5912] usb 6-1: Using ep0 maxpacket: 32 [ 562.690101][ T5912] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 562.724417][ T5912] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 562.740135][ T5912] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 562.752160][ T5912] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 562.753946][T11439] netlink: 'syz.1.1487': attribute type 21 has an invalid length. [ 562.766187][ T5912] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.797401][ T5912] usb 6-1: config 0 descriptor?? [ 562.805527][T11422] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 562.816821][ T5912] hub 6-1:0.0: USB hub found [ 563.032349][ T5912] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 563.073614][ T5912] usbhid 6-1:0.0: can't add hid device: -71 [ 563.092145][ T5912] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 563.156454][ T5912] usb 6-1: USB disconnect, device number 6 [ 563.199582][T11450] vivid-000: ================= START STATUS ================= [ 563.216800][T11450] vivid-000: Generate PTS: true [ 563.224264][T11450] vivid-000: Generate SCR: true [ 563.234732][T11450] tpg source WxH: 320x180 (Y'CbCr) [ 563.241569][T11450] tpg field: 1 [ 563.245703][T11450] tpg crop: (0,0)/320x180 [ 563.254958][T11450] tpg compose: (0,0)/320x180 [ 563.261790][T11450] tpg colorspace: 8 [ 563.265804][T11450] tpg transfer function: 0/0 [ 563.302103][T11450] tpg Y'CbCr encoding: 0/0 [ 563.336858][T11450] tpg quantization: 0/0 [ 563.358242][T11450] tpg RGB range: 0/2 [ 563.377193][T11450] vivid-000: ================== END STATUS ================== [ 564.646438][T11464] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1495'. [ 565.081540][T11472] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1496'. [ 566.737140][T11482] tipc: Enabled bearer , priority 12 [ 566.774694][T11484] tipc: Enabling of bearer rejected, already enabled [ 568.584848][T11512] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1507'. [ 569.149895][ T5965] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 569.160952][ T5842] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 569.277715][T11524] Context (ID=0x0) not attached to queue pair (handle=0x4d5:0x0) [ 569.320917][ T5965] usb 1-1: Using ep0 maxpacket: 16 [ 569.328800][ T5842] usb 3-1: New USB device found, idVendor=093a, idProduct=2476, bcdDevice= d.5b [ 569.335673][ T5965] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 569.353019][ T5842] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 569.364903][ T5965] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 569.391407][ T5842] usb 3-1: Product: syz [ 569.394434][ T5965] usb 1-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 569.412401][ T5842] usb 3-1: Manufacturer: syz [ 569.423214][ T5842] usb 3-1: SerialNumber: syz [ 569.433910][ T5965] usb 1-1: config 0 interface 0 has no altsetting 0 [ 569.441244][ T5919] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 569.453280][ T5965] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 569.483437][ T5965] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.514736][ T5965] usb 1-1: config 0 descriptor?? [ 569.632575][ T5919] usb 6-1: config index 0 descriptor too short (expected 61256, got 72) [ 569.641725][ T5919] usb 6-1: config 1 has an invalid interface number: 0 but max is -1 [ 569.649988][ T5919] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 569.671094][ T5919] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 0 [ 569.681088][T11517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 569.684332][ T5919] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 22 [ 569.691921][T11517] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.715971][ T5919] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 569.726782][ T5919] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 569.750542][ T5919] usb 6-1: SerialNumber: syz [ 569.772435][ T5919] cdc_acm 6-1:1.0: skipping garbage [ 569.777856][ T5919] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 569.786048][ T5919] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 569.792783][ T5919] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 569.793045][ T5842] gspca_main: pac207-2.14.0 probing 093a:2476 [ 569.837896][ T5842] gspca_pac207: Failed to read a register (index 0x0000, error -71) [ 569.857866][ T5842] usb 3-1: Found UVC 0.00 device syz (093a:2476) [ 569.864402][ T5842] usb 3-1: No valid video chain found. [ 569.880401][ T5842] usb 3-1: USB disconnect, device number 54 [ 569.998276][ T5965] hid (null): bogus close delimiter [ 570.020473][ T5965] hid (null): report_id 0 is invalid [ 570.031487][T11519] program syz.5.1510 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 570.053714][ T10] usb 6-1: USB disconnect, device number 7 [ 570.374006][ T43] usb 1-1: USB disconnect, device number 50 [ 572.389420][ T5965] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 572.726772][T11546] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1518'. [ 572.816459][ T5965] usb 3-1: Using ep0 maxpacket: 8 [ 572.833241][ T5965] usb 3-1: config 0 has an invalid interface number: 151 but max is 1 [ 572.843290][ T5965] usb 3-1: config 0 has no interface number 1 [ 572.850872][ T5965] usb 3-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 572.878258][ T5965] usb 3-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 572.891925][ T5965] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 572.905686][ T5965] usb 3-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 573.878232][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 573.904014][ T5965] usb 3-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 573.930904][ T5965] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 574.328931][ T5965] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 574.360504][ T5965] usb 3-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 574.366561][ T5842] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 574.380736][ T5965] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.423624][ T5965] usb 3-1: Product: syz [ 574.452614][ T5965] usb 3-1: Manufacturer: syz [ 574.468233][ T5965] usb 3-1: SerialNumber: syz [ 574.487181][ T5965] usb 3-1: config 0 descriptor?? [ 574.495053][T11537] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 574.509257][ T5965] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 574.548193][ T5842] usb 6-1: Using ep0 maxpacket: 8 [ 574.551164][ T5965] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 574.563823][ T5842] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 574.575685][ T5965] usb 3-1: invalid MIDI in EP 0 [ 574.580004][ T5842] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 574.590213][ T5842] usb 6-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 574.607191][ T5842] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 574.644438][ T5842] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 574.662851][ T5842] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 574.673504][ T5842] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.688144][T11547] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 574.696535][ T5965] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 574.717505][ T5842] hub 6-1:1.0: bad descriptor, ignoring hub [ 574.734073][ T5842] hub 6-1:1.0: probe with driver hub failed with error -5 [ 574.743451][ T5842] cdc_wdm 6-1:1.0: skipping garbage [ 574.748688][ T5842] cdc_wdm 6-1:1.0: skipping garbage [ 574.755071][T11537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 574.844023][T11561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 574.926508][T11537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 574.940543][ T30] audit: type=1326 audit(1755133835.506:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 574.974130][T11561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 575.588752][ T5842] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 575.594795][ T5842] cdc_wdm 6-1:1.0: Unknown control protocol [ 575.604009][ T30] audit: type=1326 audit(1755133835.534:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 575.627775][ T5842] usb 6-1: USB disconnect, device number 8 [ 575.635595][ T30] audit: type=1326 audit(1755133835.534:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=261 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 575.661438][ T30] audit: type=1326 audit(1755133835.534:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 575.685317][ T30] audit: type=1326 audit(1755133835.534:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 575.704891][ T5961] usb 3-1: USB disconnect, device number 55 [ 575.712642][ T30] audit: type=1326 audit(1755133835.534:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 575.735383][ T30] audit: type=1326 audit(1755133835.534:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=325 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 575.905015][ T30] audit: type=1326 audit(1755133835.553:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 575.936679][T11576] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1526'. [ 575.991080][ T30] audit: type=1326 audit(1755133835.553:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 576.191088][ T30] audit: type=1326 audit(1755133835.562:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11558 comm="syz.0.1522" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad9698ebe9 code=0x7ffc0000 [ 576.429391][ T5961] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 576.546898][ T5842] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 577.512191][ T5961] usb 1-1: config index 0 descriptor too short (expected 8192, got 77) [ 577.536296][ T5961] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 577.536336][ T5842] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 577.564981][ T5961] usb 1-1: config 0 has no interfaces? [ 577.578297][ T5961] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 577.590715][ T5961] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.600248][ T5961] usb 1-1: Product: syz [ 577.606146][ T5961] usb 1-1: Manufacturer: syz [ 577.610796][ T5961] usb 1-1: SerialNumber: syz [ 577.619634][ T5961] usb 1-1: config 0 descriptor?? [ 577.665033][ T5842] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 577.841072][T11599] binder: 11593:11599 ioctl 4018620d 0 returned -22 [ 577.908504][T11580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 577.918030][ T5842] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 577.922752][T11580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 577.946158][ T5842] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 577.990250][ T5961] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 578.608262][T11580] fuse: Unknown parameter 'r׻ԔW+ootmode' [ 578.654516][ T5842] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 578.714863][ T5842] usb 6-1: config 0 descriptor?? [ 578.726703][T11604] sit0: entered promiscuous mode [ 578.749747][T11604] netlink: 'syz.3.1533': attribute type 1 has an invalid length. [ 578.778189][T11604] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1533'. [ 578.965673][T11609] program syz.1.1534 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 578.978879][T11609] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 578.982327][T11583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 579.027103][T11609] overlayfs: failed to get inode (-116) [ 579.035383][T11609] overlayfs: failed to look up (bus) for ino (-116) [ 579.057602][T11583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 580.041499][ T5842] usbhid 6-1:0.0: can't add hid device: -71 [ 580.101142][ T5842] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 580.182289][ T5842] usb 6-1: USB disconnect, device number 9 [ 581.504163][T11618] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 581.636582][T11618] netlink: 'syz.1.1536': attribute type 8 has an invalid length. [ 581.860406][T11623] vxcan1: entered allmulticast mode [ 582.218925][ T5919] usb 1-1: USB disconnect, device number 51 [ 582.386350][T11641] netlink: 'syz.5.1542': attribute type 1 has an invalid length. [ 582.398841][T11641] netlink: 224 bytes leftover after parsing attributes in process `syz.5.1542'. [ 586.384767][T11680] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 586.403606][T11680] bridge0: port 3(team0) entered disabled state [ 586.412964][T11680] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.422756][T11680] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.694243][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 586.694266][ T30] audit: type=1326 audit(1755133846.479:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11685 comm="syz.0.1554" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fad9698ebe9 code=0x0 [ 586.789246][T11687] 8021q: VLANs not supported on vcan0 [ 591.005971][T11748] comedi comedi3: comedi_config --init_data is deprecated [ 591.752631][T11744] netlink: 'syz.1.1570': attribute type 21 has an invalid length. [ 591.800576][T11744] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 591.811815][T11744] team0: Port device batadv1 added [ 593.200426][T11755] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1574'. [ 593.648928][T11777] tipc: Enabling of bearer rejected, failed to enable media [ 593.816108][T11779] loop6: detected capacity change from 0 to 7 [ 593.869304][T11779] Dev loop6: unable to read RDB block 7 [ 593.885085][T11779] loop6: unable to read partition table [ 594.390258][T11779] loop6: partition table beyond EOD, truncated [ 594.422897][T11779] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 595.795082][T11795] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1583'. [ 595.904231][T11795] macsec1: entered promiscuous mode [ 595.969553][T11795] ip6gretap0: entered promiscuous mode [ 595.998902][T11795] macsec1: entered allmulticast mode [ 596.033445][T11795] ip6gretap0: entered allmulticast mode [ 598.299461][ T5823] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 599.466111][T11824] tipc: Enabling of bearer rejected, failed to enable media [ 599.496643][ T5823] usb 2-1: Using ep0 maxpacket: 8 [ 599.522071][ T5823] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 599.541597][ T5823] usb 2-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 599.567521][ T5823] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.601405][ T5823] usb 2-1: config 0 descriptor?? [ 599.614834][ T5932] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 599.820012][ T5932] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 599.854689][ T5932] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 599.897010][ T5932] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 599.917852][ T5932] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.953736][T11820] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 599.972034][ T5932] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 600.083250][ T5823] hid-multitouch 0003:0EEF:72C4.001B: unknown main item tag 0x0 [ 600.094660][ T5823] hid-multitouch 0003:0EEF:72C4.001B: unknown main item tag 0x0 [ 600.126605][ T5823] hid-multitouch 0003:0EEF:72C4.001B: unknown main item tag 0x0 [ 600.140812][ T5823] hid-multitouch 0003:0EEF:72C4.001B: unknown main item tag 0x0 [ 600.157020][ T5823] hid-multitouch 0003:0EEF:72C4.001B: unknown main item tag 0x0 [ 600.174096][ T5823] hid-multitouch 0003:0EEF:72C4.001B: hidraw0: USB HID v0.03 Device [HID 0eef:72c4] on usb-dummy_hcd.1-1/input0 [ 600.317085][ T5912] usb 6-1: USB disconnect, device number 10 [ 600.332381][ T5823] usb 2-1: USB disconnect, device number 60 [ 605.258614][T11912] binder_alloc: 11907: binder_alloc_buf, no vma [ 671.361244][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.617680][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 718.624789][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P11926/1:b..l [ 718.633473][ C1] rcu: (detected by 1, t=10503 jiffies, g=50029, q=363 ncpus=2) [ 718.641343][ C1] task:syz.1.1624 state:R running task stack:24520 pid:11926 tgid:11925 ppid:5833 task_flags:0x400040 flags:0x00004006 [ 718.656465][ C1] Call Trace: [ 718.659854][ C1] [ 718.662832][ C1] __schedule+0x16aa/0x4c90 [ 718.667407][ C1] ? preempt_schedule_irq+0xb5/0x150 [ 718.672741][ C1] ? __pfx___schedule+0x10/0x10 [ 718.677642][ C1] ? arch_irq_work_raise+0x6d/0x80 [ 718.682803][ C1] ? __irq_work_queue_local+0x1d7/0x550 [ 718.688415][ C1] ? preempt_schedule_irq+0xaa/0x150 [ 718.693745][ C1] preempt_schedule_irq+0xb5/0x150 [ 718.698910][ C1] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 718.704682][ C1] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 718.710552][ C1] irqentry_exit+0x6f/0x90 [ 718.715023][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 718.721054][ C1] RIP: 0010:lock_acquire+0x175/0x360 [ 718.726387][ C1] Code: 00 00 00 00 9c 8f 44 24 30 f7 44 24 30 00 02 00 00 0f 85 cd 00 00 00 f7 44 24 08 00 02 00 00 74 01 fb 65 48 8b 05 6b 55 fe 10 <48> 3b 44 24 58 0f 85 f2 00 00 00 48 83 c4 60 5b 41 5c 41 5d 41 5e [ 718.746226][ C1] RSP: 0018:ffffc900149deab8 EFLAGS: 00000206 [ 718.752347][ C1] RAX: a3060476318fb500 RBX: 0000000000000000 RCX: a3060476318fb500 [ 718.760359][ C1] RDX: 0000000000000000 RSI: ffffffff8db6fcc6 RDI: ffffffff8be1ba40 [ 718.768384][ C1] RBP: ffffffff8172aae5 R08: 0000000000000000 R09: ffffffff8172aae5 [ 718.776400][ C1] R10: ffffc900149dec78 R11: ffffffff81acfd40 R12: 0000000000000002 [ 718.784411][ C1] R13: ffffffff8e13f0e0 R14: 0000000000000000 R15: 0000000000000246 [ 718.792433][ C1] ? unwind_next_frame+0xa5/0x2390 [ 718.797608][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 718.803836][ C1] ? unwind_next_frame+0xa5/0x2390 [ 718.809030][ C1] ? unwind_next_frame+0xa5/0x2390 [ 718.814195][ C1] ? do_vfs_ioctl+0xe80/0x1990 [ 718.819017][ C1] ? unwind_next_frame+0xa5/0x2390 [ 718.824176][ C1] unwind_next_frame+0xc2/0x2390 [ 718.829170][ C1] ? unwind_next_frame+0xa5/0x2390 [ 718.834337][ C1] ? unwind_next_frame+0xa5/0x2390 [ 718.839525][ C1] ? file_ioctl+0x611/0x780 [ 718.844108][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 718.850325][ C1] arch_stack_walk+0x11c/0x150 [ 718.855151][ C1] ? do_vfs_ioctl+0xe80/0x1990 [ 718.859986][ C1] stack_trace_save+0x9c/0xe0 [ 718.864727][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 718.870184][ C1] save_stack+0xf7/0x1f0 [ 718.874483][ C1] ? __pfx_save_stack+0x10/0x10 [ 718.879379][ C1] ? post_alloc_hook+0x240/0x2a0 [ 718.884359][ C1] ? get_page_from_freelist+0x21d5/0x22b0 [ 718.890133][ C1] ? __alloc_frozen_pages_noprof+0x181/0x370 [ 718.896170][ C1] ? alloc_pages_mpol+0x232/0x4a0 [ 718.901244][ C1] ? folio_alloc_mpol_noprof+0x39/0x70 [ 718.906754][ C1] ? shmem_alloc_and_add_folio+0x447/0xf60 [ 718.912610][ C1] ? shmem_get_folio_gfp+0x59d/0x1660 [ 718.918072][ C1] ? shmem_fallocate+0x80f/0xde0 [ 718.923104][ C1] ? vfs_fallocate+0x6a0/0x830 [ 718.927925][ C1] ? file_ioctl+0x611/0x780 [ 718.932497][ C1] ? do_vfs_ioctl+0xe80/0x1990 [ 718.937320][ C1] ? seqcount_lockdep_reader_access+0x102/0x180 [ 718.943634][ C1] __set_page_owner+0x8d/0x4a0 [ 718.948456][ C1] ? __pfx___set_page_owner+0x10/0x10 [ 718.953896][ C1] post_alloc_hook+0x240/0x2a0 [ 718.958734][ C1] get_page_from_freelist+0x21d5/0x22b0 [ 718.964354][ C1] ? __lock_acquire+0xab9/0xd20 [ 718.969306][ C1] ? __pfx_get_page_from_freelist+0x10/0x10 [ 718.975266][ C1] ? prepare_alloc_pages+0x213/0x610 [ 718.980612][ C1] __alloc_frozen_pages_noprof+0x181/0x370 [ 718.986516][ C1] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 718.992920][ C1] ? policy_nodemask+0x27c/0x720 [ 718.997922][ C1] alloc_pages_mpol+0x232/0x4a0 [ 719.002842][ C1] folio_alloc_mpol_noprof+0x39/0x70 [ 719.008184][ C1] shmem_alloc_and_add_folio+0x447/0xf60 [ 719.013871][ C1] ? filemap_get_entry+0xad/0x2f0 [ 719.018956][ C1] ? filemap_get_entry+0xad/0x2f0 [ 719.024044][ C1] ? filemap_get_entry+0xad/0x2f0 [ 719.029127][ C1] ? filemap_get_entry+0x28f/0x2f0 [ 719.034298][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 719.040512][ C1] ? shmem_allowable_huge_orders+0x1f8/0x420 [ 719.046565][ C1] shmem_get_folio_gfp+0x59d/0x1660 [ 719.051856][ C1] shmem_fallocate+0x80f/0xde0 [ 719.056709][ C1] ? __pfx_shmem_fallocate+0x10/0x10 [ 719.062053][ C1] ? rcu_read_lock_any_held+0xb3/0x120 [ 719.067577][ C1] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 719.073540][ C1] vfs_fallocate+0x6a0/0x830 [ 719.078182][ C1] ? __pfx_vfs_fallocate+0x10/0x10 [ 719.083358][ C1] file_ioctl+0x611/0x780 [ 719.087744][ C1] ? __pfx_file_ioctl+0x10/0x10 [ 719.092656][ C1] ? kasan_save_track+0x4f/0x80 [ 719.097558][ C1] ? kasan_save_track+0x3e/0x80 [ 719.102466][ C1] ? kasan_save_free_info+0x46/0x50 [ 719.107719][ C1] ? __kasan_slab_free+0x62/0x70 [ 719.112697][ C1] ? kfree+0x18e/0x440 [ 719.116819][ C1] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 719.122503][ C1] ? security_file_ioctl+0xcb/0x2d0 [ 719.127745][ C1] ? __se_sys_ioctl+0x47/0x170 [ 719.132569][ C1] ? do_syscall_64+0xfa/0x3b0 [ 719.137288][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.143432][ C1] do_vfs_ioctl+0xe80/0x1990 [ 719.148140][ C1] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 719.153227][ C1] ? kasan_quarantine_put+0xdd/0x220 [ 719.158584][ C1] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 719.164274][ C1] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 719.169955][ C1] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 719.175633][ C1] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 719.181325][ C1] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 719.187374][ C1] ? smack_log+0xef/0x3f0 [ 719.191772][ C1] ? __pfx_smack_log+0x10/0x10 [ 719.196599][ C1] ? smk_access+0x14c/0x4e0 [ 719.201165][ C1] ? smk_tskacc+0x2fc/0x370 [ 719.205730][ C1] ? smack_file_ioctl+0x24a/0x340 [ 719.210808][ C1] ? __pfx_smack_file_ioctl+0x10/0x10 [ 719.216245][ C1] ? __fget_files+0x2a/0x420 [ 719.220893][ C1] ? __fget_files+0x3a0/0x420 [ 719.225618][ C1] ? __fget_files+0x2a/0x420 [ 719.230257][ C1] ? bpf_lsm_file_ioctl+0x9/0x20 [ 719.235248][ C1] __se_sys_ioctl+0x82/0x170 [ 719.239898][ C1] do_syscall_64+0xfa/0x3b0 [ 719.244458][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 719.249703][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.255823][ C1] ? clear_bhb_loop+0x60/0xb0 [ 719.260557][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.266499][ C1] RIP: 0033:0x7f0d2518ebe9 [ 719.270972][ C1] RSP: 002b:00007f0d233f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 719.279448][ C1] RAX: ffffffffffffffda RBX: 00007f0d253b5fa0 RCX: 00007f0d2518ebe9 [ 719.287478][ C1] RDX: 0000200000000040 RSI: 0000000040305828 RDI: 0000000000000003 [ 719.295491][ C1] RBP: 00007f0d25211e19 R08: 0000000000000000 R09: 0000000000000000 [ 719.303507][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 719.311537][ C1] R13: 00007f0d253b6038 R14: 00007f0d253b5fa0 R15: 00007ffed700b358 [ 719.319586][ C1] [ 719.322682][ C1] rcu: rcu_preempt kthread starved for 9918 jiffies! g50029 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 719.333834][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 719.343843][ C1] rcu: RCU grace-period kthread stack dump: [ 719.349766][ C1] task:rcu_preempt state:R running task stack:27232 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 719.363426][ C1] Call Trace: [ 719.366751][ C1] [ 719.369733][ C1] __schedule+0x16aa/0x4c90 [ 719.374299][ C1] ? schedule+0x165/0x360 [ 719.378682][ C1] ? __pfx___schedule+0x10/0x10 [ 719.383599][ C1] ? schedule+0x91/0x360 [ 719.387891][ C1] schedule+0x165/0x360 [ 719.392094][ C1] schedule_timeout+0x12b/0x270 [ 719.397001][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 719.402430][ C1] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 719.408383][ C1] ? __pfx_process_timeout+0x10/0x10 [ 719.413732][ C1] ? prepare_to_swait_event+0x341/0x380 [ 719.419337][ C1] rcu_gp_fqs_loop+0x301/0x1540 [ 719.424263][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 719.429501][ C1] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 719.435700][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 719.441044][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 719.446294][ C1] ? finish_swait+0xcd/0x1f0 [ 719.450945][ C1] rcu_gp_kthread+0x99/0x390 [ 719.455584][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 719.460825][ C1] ? __kthread_parkme+0x7b/0x200 [ 719.465816][ C1] ? __kthread_parkme+0x1a1/0x200 [ 719.470901][ C1] kthread+0x70e/0x8a0 [ 719.475032][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 719.480284][ C1] ? __pfx_kthread+0x10/0x10 [ 719.484933][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 719.490174][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 719.495418][ C1] ? __pfx_kthread+0x10/0x10 [ 719.500063][ C1] ret_from_fork+0x3fc/0x770 [ 719.504725][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 719.509893][ C1] ? __switch_to_asm+0x39/0x70 [ 719.514762][ C1] ? __switch_to_asm+0x33/0x70 [ 719.519582][ C1] ? __pfx_kthread+0x10/0x10 [ 719.524231][ C1] ret_from_fork_asm+0x1a/0x30 [ 719.529064][ C1] [ 719.532121][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 719.538511][ C1] CPU: 1 UID: 0 PID: 11911 Comm: syz.3.1617 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 719.548541][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 719.558635][ C1] RIP: 0010:rcu_is_watching+0x3a/0xb0 [ 719.564063][ C1] Code: e8 4b 77 bf 09 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 70 8c ba 8d 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 2c e2 78 00 48 c7 c3 58 bf 9d 92 49 03 1e 48 89 [ 719.583806][ C1] RSP: 0018:ffffc9000eb07b18 EFLAGS: 00000246 [ 719.589923][ C1] RAX: 1ffffffff1b7518f RBX: 0000000000000001 RCX: 6410d00c3f30c000 [ 719.597944][ C1] RDX: 0000000000000000 RSI: ffffffff8be1ba20 RDI: ffffffff8be1b9e0 [ 719.605958][ C1] RBP: ffffc9000eb07cb0 R08: 0000000000000000 R09: ffffffff8208a560 [ 719.614064][ C1] R10: ffffc9000eb07c20 R11: fffff52001d60f87 R12: 1ffff92001d60f80 [ 719.622080][ C1] R13: ffffffff8208a560 R14: ffffffff8dba8c78 R15: dffffc0000000000 [ 719.630099][ C1] FS: 00007f429a7196c0(0000) GS:ffff888125d57000(0000) knlGS:0000000000000000 [ 719.639080][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 719.645881][ C1] CR2: 000000110c3b76e8 CR3: 00000000799de000 CR4: 00000000003526f0 [ 719.653898][ C1] Call Trace: [ 719.657220][ C1] [ 719.660193][ C1] lock_release+0x4b/0x3e0 [ 719.664655][ C1] ? __might_fault+0xb0/0x130 [ 719.669377][ C1] ? __might_fault+0xcc/0x130 [ 719.674100][ C1] _copy_from_user+0x28/0xb0 [ 719.678750][ C1] restore_altstack+0x9d/0x4b0 [ 719.683564][ C1] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 719.689177][ C1] ? __pfx_restore_altstack+0x10/0x10 [ 719.694611][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 719.699855][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 719.705104][ C1] __ia32_sys_rt_sigreturn+0x1ac/0x7b0 [ 719.710633][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 719.715887][ C1] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 719.721997][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 719.727235][ C1] ? signal_setup_done+0x230/0x310 [ 719.732396][ C1] ? __lock_acquire+0xab9/0xd20 [ 719.737310][ C1] ? __task_pid_nr_ns+0x28/0x470 [ 719.742302][ C1] ? do_syscall_64+0xbe/0x3b0 [ 719.747031][ C1] do_syscall_64+0xfa/0x3b0 [ 719.751585][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.757705][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 719.763955][ C1] ? clear_bhb_loop+0x60/0xb0 [ 719.768684][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.774654][ C1] RIP: 0033:0x7f429992add9 [ 719.779118][ C1] Code: 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 04 25 [ 719.798774][ C1] RSP: 002b:00007f429a718b40 EFLAGS: 00000206 ORIG_RAX: 000000000000000f [ 719.807326][ C1] RAX: ffffffffffffffda RBX: 00007f4299bb6098 RCX: 00007f429992add9 [ 719.815442][ C1] RDX: 00007f429a718b40 RSI: 00007f429a718c70 RDI: 0000000000000021 [ 719.823463][ C1] RBP: 00007f4299bb6090 R08: 0000000000000000 R09: 0000000000000000 [ 719.831475][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 719.839500][ C1] R13: 00007f4299bb6128 R14: 00007ffd84d28210 R15: 00007ffd84d282f8 [ 719.847546][ C1] [ 719.890844][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 719.903647][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 client_loop: send disconnect: Broken pipe [ 724.433862][ T8897] syz_tun (unregistering): left allmulticast mode [ 724.989100][ T5840] Bluetooth: hci1: command 0x0406 tx timeout [ 725.044178][ T63] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.326223][ T63] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.424722][ T63] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.547888][ T63] : (slave netdevsim0): Releasing backup interface [ 725.569423][ T63] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.743854][ T63] bridge_slave_1: left allmulticast mode [ 725.749846][ T63] bridge_slave_1: left promiscuous mode [ 725.755654][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.767599][ T63] bridge_slave_0: left allmulticast mode [ 725.773633][ T63] bridge_slave_0: left promiscuous mode [ 725.780853][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.798383][ T63] tipc: Resetting bearer [ 726.066283][ T63] tipc: Disabling bearer [ 726.095142][ T63] team0: Port device geneve0 removed [ 726.366096][ T63]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 726.377273][ T63]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 726.387034][ T63]  (unregistering): Released all slaves [ 728.134317][ T63] : left promiscuous mode [ 728.199147][ T63] tipc: Left network mode [ 728.374460][ T63] hsr_slave_0: left promiscuous mode [ 728.381083][ T63] hsr_slave_1: left promiscuous mode [ 728.403849][ T63] veth1_macvtap: left promiscuous mode [ 728.409603][ T63] veth0_macvtap: left promiscuous mode [ 728.415312][ T63] veth1_vlan: left promiscuous mode