last executing test programs: 2m3.444897518s ago: executing program 3 (id=1302): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) r1 = socket$kcm(0x21, 0x2, 0x2) setsockopt$sock_attach_bpf(r1, 0x110, 0x7, 0x0, 0x4) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x0, 0x0, 0x9, 0xffffff7fffffffff, 0xfffffdfffffffffd, 0xffffffc0, 0xffffffff}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$sock(r2, &(0x7f0000000840)={&(0x7f0000000500)=@qipcrtr, 0x80, &(0x7f0000000780)=[{&(0x7f0000000580)}, {&(0x7f00000006c0)="fe2ff97f1b06dd569a05502020378f3a814f6616341156eef71523bd011b606714cbba7a0aa06f89c5a01e8530dbc114bb08c2b28831f155abeba7fcbae372122aeb3ed3c1799a8ec83ae6836a1b5ef139267e2b24f559bd46dc99d44aa1d0d749069e22812db3328a1f33e56b52fd4b614098bf163be6d7e709417e839b784a6aac9210c06c69f06fdba22c6d88fdbf364d20786a3f455b3d4d6007bbdf936ce45df15b7ac3a51ec755d30d09226fd4999a3695bb8638", 0xb7}], 0x2, &(0x7f0000000800)}, 0x40000) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x10000, &(0x7f0000002140)=ANY=[]) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000040)=0x800001c) madvise(&(0x7f0000793000/0x1000)=nil, 0x1000, 0x13) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000068a00800000000004000000cb2004000001000095"], &(0x7f0000000300)='syzkaller\x00', 0x4, 0xfe5, &(0x7f0000000880)=""/4069, 0x40f00, 0x2}, 0x94) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x82, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000380)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f00000003c0)=[@text32={0x20, &(0x7f0000000400)="2ef26f0f3566b842000f00d8b805000000b9a00000000f01c166baf80cb8b7351187ef66bafc0cb000ee0fde460b0f0130670f01c28fe868cfe20a", 0x3b}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f00000007c0)={0x28, 0x4, r4, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x9}) r8 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r8, 0x29, 0xc8, 0x0, 0xc000000) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000, 0x0) 2m2.453903809s ago: executing program 3 (id=1307): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="bc010000190001000000000000000000ac1414aa000000000000000000000002000000000000000000000000000000000000ffff000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000001d00000000000000000000000000000009000000000000000000000000000000dd02000000000000ff07000000000000010000000000000004010500ff020000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000000000003fb0000000000493f0d5100000000ffffffff000000000000000000000000000000002b00000002000000e00000010000000000000000000000000535000004020000000000000000000000000000fc010000000000000000000000000000000000003c0000000200000000000000000000000103000000000000d72c000000000000ff020000000000000000000000000001000000003c00000002000000ac1414bb000000000000000000000000000000000500fe00000000000300000096"], 0x1bc}, 0x1, 0x0, 0x0, 0x60004004}, 0x0) 2m2.360756288s ago: executing program 3 (id=1309): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket(0x1d, 0x2, 0x6) getpriority(0x2, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x6a, 0x5, 0x0, &(0x7f0000000200)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'gretap0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYRESDEC=r1, @ANYRES16=r2, @ANYBLOB="202f010088900300442012800b00010062726964676500003400028005002d00010000000500190003000000050026000000000008001b000700000005002b002a000000040014006ab5fe1b577b2db73ddcef9116c5bb09e74b1411c29be73095c1db5ded4e9f56670e56aaa8f114ae724575376b40f35d0ae2206b7f3584162ceaa243934255465c1fd5e0eb4a2f84e621af15760c57353346fea1dcf58eb561857407cb0ee87e163a27f966b38a17c4f4627d253ec8df62882aec29b9dfe681130f43be88e555108ca6e1608db0dc1feed8b7ddfd53b57c6fc4dcdf5c76d9e80cd80cfa5f3b229c00000000000000"], 0x68}, 0x1, 0x0, 0x0, 0x44801}, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000000)={@empty, @empty, 0x1, "7deddc71dd18d640fb73347b4e3ecdd58222118d3b1f42e39da9bf2f56a2dad4", 0xfffffff8, 0x1, 0x6, 0x80000000}, 0x3c) 2m2.235499532s ago: executing program 3 (id=1312): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000280)={0x84, @dev={0xac, 0x14, 0x14, 0x8b}, 0x15, 0x3, 'fo\x00', 0x1, 0x400000, 0x4}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000002c0)={{0x84, @remote, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x36}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000340)={{0x84, @empty, 0x4e24, 0x3, 'lc\x00', 0xe, 0x323b, 0x55}, {@loopback, 0x4e23, 0x2, 0x244, 0x12d5c, 0x12d5c}}, 0x44) sendmsg$sock(r2, &(0x7f00000003c0)={&(0x7f0000000400)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000900)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r4 = socket(0x11, 0x3, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x1c, 0x18, 0x107, 0x70bd27, 0x25dfdbfc, {0x1, 0x7c}, [@typed={0x8, 0xb8, 0x0, 0x0, @u32=0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24044011}, 0x20004000) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000000)={&(0x7f0000000040)=""/74, 0xa000, 0x800, 0x0, 0x1}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r5, 0x11b, 0x6, &(0x7f00000000c0)=0x1, 0x4) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000000180)=0x100, 0x4) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) syz_mount_image$fuse(&(0x7f00000005c0), &(0x7f0000000600)='./file0\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000006c0)='./file0\x00', 0x0, 0x100000, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000700)='./file0\x00', 0x89901) move_mount(r8, &(0x7f0000000740)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000780)='.\x00', 0x89901) move_mount(r9, &(0x7f00000007c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./file0\x00', 0x0) r10 = open_tree(0xffffffffffffff9c, &(0x7f0000000840)='\x00', 0x89901) move_mount(r10, &(0x7f0000000880)='.\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x0) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, &(0x7f00000001c0)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$xdp(r5, &(0x7f0000000240)={0x2c, 0xa, r11}, 0x10) r12 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r13, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x1db, 0x0, 0x8706}]}) 2m1.16805562s ago: executing program 3 (id=1319): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000180012800b00010067656e65766500000800028004000e0014000300"], 0x4c}, 0x1, 0x100000000000000}, 0x0) 2m0.959056235s ago: executing program 3 (id=1320): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="b8000000190001000000000000000000e000000200d08569266cb243660000000000000000000000000000000000000000000000000002000a"], 0xb8}}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x200000000000000, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2, 0x0, 0x0, 0x0, 0x4}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 2m0.344469791s ago: executing program 32 (id=1320): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="b8000000190001000000000000000000e000000200d08569266cb243660000000000000000000000000000000000000000000000000002000a"], 0xb8}}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x200000000000000, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2, 0x0, 0x0, 0x0, 0x4}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 1m45.675977549s ago: executing program 5 (id=1399): openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x42, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f00000002c0)={&(0x7f0000000380)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000400)="dc", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000440)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000480)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0xad}}, 0x7, 0x1, 0x457, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000540)=0x3, 0x4) pipe2$9p(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$9p(r4, &(0x7f00000005c0)="2d76b41cfadba8c9e82b39a58fade4a1e1c7ef34f18f9ee7ea705a387831c57c3f007c87ff6a6d56a0412772be538a3a9da7d06107b64274af1202839475620c45529c8e1e684c2118de638371951ba4ff979185630a5fad24e8eac0e002159a4516f523cc596c18dea7d58a7fc7d7c536f144c2a3cd4b3c32712d9df8e06635edabc3756f4574734399c629e21514de00ca9cb5db71b1fd95c571fc14e0935bce3b828d3e9544db3e5d6dd7711292bade41db1468879a5ae363c0e350a18c2c1846c9dab94e0c296ad7ba7ddabb3090d84b7e1de1075d427e6da02193277000e89a90b611024684514dfe42ba05afb12275bd2157f049f1e59c6e3e04bdf2af1558978fd730ff32ebc982e3cb15f90d5cc35615b22eb49384b70a36e914a8639cefcf00da4188df83be0f5f20b765610a77efdb569852c0196fca2237eeed0bfac86e58d0ec211962bf22ee18dbbb0f33c591cba0e72e68de6eca4c96f29868bd2080c96f28b8e68c9a62efae50d8bdc9df9cfbf3350f4274da573ed3653f989ffddbb59f3f8c72a6b3bc7f705872d0309445e14781e888d8d1a5fb5de79c5ea573c3b0bdf4de2e4263635aab6732e3339450fceb7698309cc629ec4bff6fde7a01f182dca433a256e101d01ba88a6ff1e14d9dcaf7d8a6bce08534142561578702ded5cc1bae4bbc0d17d783729c78c1851e701cf55ae55cbe40cec2a6e60fc8db862dbebef6b8d224762518e8b2ad8c1f97bd13057d9103c55a806d5c747b4e4c68d39469a9cdc8b6d92ebd0ebc51a32371af555bfa64463122ed3055b244ca4c8ad98b9c8903fc70a3827c622bb1222e8ec47331797d592c7f0837e695e885e8e18ba748b1169318135af97b937a2fad5472590d10a356e7d2da2073cd17bd45669c65618baf849b4d15925da0dc40705ee26ce2b33b85a93651f4d264b723cc23644a94a200673b551690788c9cf637f926ba1da102172c23445cc10278fa28b81c55578e77d87151a8b423c5a5d0bfc3945028e16514837ffab181dd771ab456bde23e6b1c40830967492904622123b7ba477e1843102e0a2bb816cd6ab344135c0660d09842ca96b2e15561c551a4efefb55818da1b9208c6c7a414caf455f9510b1f2ee869bd43353b9dec4dc6cc6a49dbf1ab273a69d76c552d0ea4eb33d983b19ce04cb14473dcf2e006d5b9886de2cad58e6fa06aafa7406f12400ab9bd65f472636446dc104a1e31f4f2abdcfe94ba5cdb35ce9d4efd6ea2de3069ffae2fb4e1ed93616546f39285d4d78ead20bd35b721a51f4ebe84037f699ba4afc82ece8dfb15faa8974e2cb0e2987db498c34b78fc806e3287ec0928e14abc7701684f73032d9c791cd195357ecb579724ac51659a02512faf240ef3bc65a2ac7462d4dc9b8718d103ef5223520e0c60969e3ecac743eee57e664fe687aad5e5d474ae25ac5aa77489b592eafa00ff", 0x411) splice(r3, 0x0, r0, 0x0, 0x100000000, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000180)={0x0, 0x72f, 0x100, 0x8, 0x3b5}, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000ac0)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000b40)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000b80)=0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000bc0)={0x34, 0x0, 0x0, &(0x7f0000000c00)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) r11 = openat(0xffffffffffffff9c, &(0x7f0000000c40)='./file0\x00', 0x20842, 0x63) syz_ublk_setup_queues(r11, r10, &(0x7f0000000c80)={0x0, 0x0, 0x10, 0x1, 0x2e3}, &(0x7f0000000d00)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x880000, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdd52, 0x8, 0x2, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x4020, 0x8, 0x9d7c}}], 0x1, &(0x7f00000013c0)={0x2e, 0x3, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r9, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001600)=ANY=[@ANYBLOB="1201000200000010b404a1bc0000000000010902240001000000020904000506030003000921000040012218000905810300040015877dcc1db83b2e4f18451400a4b193ce5966285aa9405b6f03765992a479f97b3976433fd89fd41f5adf91d1c4ab29220614"], 0x0) syz_ublk_setup_io_uring(0xa, &(0x7f0000001480)={0x0, 0x8030b5, 0x0, 0x2, 0x2157}, &(0x7f0000001500), &(0x7f0000001540), &(0x7f0000001580)) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000015c0), 0x120002) epoll_create1(0x80000) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) writev(r1, &(0x7f0000000a00)=[{&(0x7f0000000a80)="cd89b0b00d", 0x5}], 0x1) write$binfmt_script(r2, &(0x7f0000000f80)={'#! ', './file0', [], 0xa, "5775ebb77549afc496bc5cc558c52be63e203db628daa190b16cc7216b9bfb1b0bd22d03f5e1cd7a3da150be3434e1d6c83af706cea87fffe560d236a8c26a760289f80eaa398ae77b0d26197822dd25b01733bd602efae482eced2ed31ee6ce67c841c25dfefcd739990462ff3626423e0e3ba7a4d4a86469f8cf3ac3d81d4f63be7d17a6caf4a8b071298bc35fdea671ea0025460ccfed3040fe1945a0d089bba38204ca6631e158a7717cf420623fad22082e3ae1b8e38748772095513a3f5028fb76790ef01caab610421c1ae48ffd68b5aefd4f399b8d28edddd9dde0d8afa1fd2df0d8c6ebbcf9493daea96589ee90969516953c83d70124dc91b26e3287986fdc096eda61a819b88e28facf71a064600e69747ab08f0379afde05c2b558f6058e2ef5c3a36ab3171bd99960ebb980380b7f76f8fce6987cf5eafb1384cefd64e1d214b14cff8f9ae739db32fb1e54d01856a3b277c3f02aeebe7f58f0708f4487afe3674a0a412461a9de083979f9c380a9336893f77c19f740aed24764a0165a52fa2d8152bb55f49fe1c1a52977f9244fdf648ef55acdbaab7827a33e5c66592b97b2b4ccf4d642d75a23a0bf43cb9dd6d4156cc58636f4d68d0370d827d0c6a0b0a3fb818e36d6716a49ec3bac8da32f9a8bd74c499768a4c62822d018ef9f7982ddf15e655670f9cec0162460e4b9a83a5f1cfd99dcb5dfe680039d9b9ee28132545ce12ff1f32c6ecf9181688260da9d4d610567eacf0c399e85c974fc752333c7d0ac1ba8e0213f07884fc77b0ba82aa058e596f04b7d44b409cd4a1fab3b3c0d4217493196f62e2cf9e4d9834e7f966ca42b76100ef5f6fa89700a0b4661056849331fb583b3e9659711ae466c61507319b7d1638ffca5f9130ca7fdb86276ada534473b4d2c21859a825ba6e502d2f912e224f1fdb70a57c42e2185a45edac6e09c1c7446dc889dd8ba711ac687257b35a1b923a960be298b680106299cd3ac4e06cae9352bfdd0427e13ce759b48140df351c8f9ae8fb9acabb9c3346e23433c4875d45ac7836d990cd13d35ac48700e315d7e9b11ca587cb9a764af1fda1bb8c36f15d1d642252e26a5c9d9c33a16dca4584f864467ad20b97ddffc6fcbbaf71716aa07e9f0c99bee7e22fac55dcf54f99af981bd0217b72a4cf46ce46f165d512fd49ff4e3cea29a63e0354177bfe5433b25c3496461b39153b68cbc5af714bde4043909c4679aedd01875badbb6f74cadcf9488769ebe8e173c746225f3decccfed3d295d90b29444b27c2e5a72943eb03d254940a65398e63d78f9b41ef8a17c0c2bd8e9057619ff39dc47105189d0c70a32c535790e68fff9c9a9ef708576c51bcc8868f8a2842b82af5c0466a3cb1fc229e3fd4434e2956d206fc8ca66c8494567db7034e223a4dd1313d3b2399616307fd3ef27acf6732a69cc5f"}, 0x411) r12 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r12, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r12, &(0x7f0000000100)={0x13, 0x10, 0x7, {0x0, r13, 0x1}}, 0x18) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, r13, 0x0, 0x1, 0x4}}, 0x20) 1m42.213272233s ago: executing program 5 (id=1418): r0 = syz_io_uring_setup(0x44, &(0x7f0000000a00)={0x0, 0x5961, 0x0, 0x1, 0x4e}, &(0x7f0000000a80)=0x0, &(0x7f0000000ac0)=0x0, &(0x7f0000000c00)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000b40)=@IORING_OP_SETXATTR={0x2a, 0x40, 0x0, 0x0, 0x0, &(0x7f0000000bc0)='./file0\x00', 0xff86, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffa, 0x9, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8947, &(0x7f0000000380)={'ip6gre0\x00', @random="0000230c1100"}) sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a010200000000000000000100ffff0900030073797a320000000028000480080002400000000008000140000000051400030076657468315f6d0863767461700000000900010073797a31000000004c000000050a1b000000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076658168315f6d6163767461700000000800014000000005"], 0xe8}}, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$sock(r6, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000940)="83a9f6f162", 0x5}], 0x1}}], 0x1, 0x80) sendmmsg$inet(r6, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x41) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@ipv6_newnexthop={0x28, 0x68, 0x200, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x2, 0x0, 0x8}, [@NHA_BLACKHOLE={0x4}, @NHA_ENCAP_TYPE={0x6, 0x7, 0x8}, @NHA_BLACKHOLE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x4001}, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(0xffffffffffffffff, 0x13, &(0x7f0000000040)=[0x80000001], 0x2) r8 = accept(r7, &(0x7f0000000440)=@xdp, &(0x7f00000004c0)=0x80) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x9, 0xb, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}, [@btf_id={0x18, 0x5, 0x3, 0x0, 0x3}, @ringbuf_query, @exit, @alu={0x4, 0x0, 0xd, 0x4, 0x7, 0xffffffffffffffe0, 0x1}]}, &(0x7f0000000580)='GPL\x00', 0x0, 0x20, &(0x7f00000005c0)=""/32, 0x41000, 0x1a, '\x00', 0x0, @cgroup_sock=0x2, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0xf, 0xfffffff9, 0x6}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000680)=[0x1, 0x1, 0x1], &(0x7f00000006c0)=[{0x0, 0x1, 0xc, 0x3}], 0x10, 0x83db}, 0x94) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f00000007c0)=r9, 0x4) 1m41.821383231s ago: executing program 5 (id=1421): sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$kcm(0x21, 0x2, 0x2) setsockopt$sock_attach_bpf(r0, 0x110, 0x7, 0x0, 0x4) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x0, 0x0, 0x9, 0xffffff7fffffffff, 0xfffffdfffffffffd, 0xffffffc0, 0xffffffff}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$sock(r1, &(0x7f0000000840)={&(0x7f0000000500)=@qipcrtr, 0x80, &(0x7f0000000780)=[{&(0x7f0000000580)}, {&(0x7f00000006c0)="fe2ff97f1b06dd569a05502020378f3a814f6616341156eef71523bd011b606714cbba7a0aa06f89c5a01e8530dbc114bb08c2b28831f155abeba7fcbae372122aeb3ed3c1799a8ec83ae6836a1b5ef139267e2b24f559bd46dc99d44aa1d0d749069e22812db3328a1f33e56b52fd4b614098bf163be6d7e709417e839b784a6aac9210c06c69f06fdba22c6d88fdbf364d20786a3f455b3d4d6007bbdf936ce45df15b7ac3a51ec755d30d09226fd4999a3695bb8638", 0xb7}], 0x2, &(0x7f0000000800)}, 0x40000) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x10000, &(0x7f0000002140)=ANY=[]) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000040)=0x800001c) madvise(&(0x7f0000793000/0x1000)=nil, 0x1000, 0x13) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000068a00800000000004000000cb2004000001000095"], &(0x7f0000000300)='syzkaller\x00', 0x4, 0xfe5, &(0x7f0000000880)=""/4069, 0x40f00, 0x2}, 0x94) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x82, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000380)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f00000003c0)=[@text32={0x20, &(0x7f0000000400)="2ef26f0f3566b842000f00d8b805000000b9a00000000f01c166baf80cb8b7351187ef66bafc0cb000ee0fde460b0f0130670f01c28fe868cfe20a", 0x3b}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000007c0)={0x28, 0x4, r3, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x9}) r7 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r7, 0x29, 0xc8, 0x0, 0xc000000) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000, 0x0) 1m40.052463765s ago: executing program 5 (id=1428): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$kvm(0x0, &(0x7f0000000000), 0x4018c1, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_GET_CPUID2(r6, 0xc008ae91, &(0x7f0000000680)={0x1, 0x0, [{}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) r7 = socket$kcm(0x2, 0x2, 0x73) sendmsg$inet(r7, &(0x7f0000000700)={&(0x7f0000000740)={0x2, 0x0, @empty}, 0x10, &(0x7f0000000780)=[{&(0x7f00000007c0)='+', 0x34000}], 0x1}, 0x900000000000000) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0xffff1000, 0xeeee8000, 0x4, 0xf6, 0x2, 0xf3, 0xd7, 0x8, 0x7, 0x1, 0x9, 0x5}, {0x50000, 0xc0a0c0f0f5000ded, 0xd, 0x8, 0x3, 0x8, 0x5, 0x0, 0x80, 0xfc, 0xfc, 0x4}, {0x200000, 0x4000, 0xb, 0x6, 0xff, 0x3, 0x0, 0x5, 0xef, 0x27, 0xd5, 0x2}, {0xa000, 0x6000, 0x9, 0x9, 0x8f, 0x4, 0x83, 0xfc, 0xb, 0x1, 0x9, 0x3}, {0xffffffff, 0x0, 0x3, 0x2, 0x6, 0x1, 0x9, 0x2, 0x3, 0x3, 0x0, 0xe4}, {0x200000, 0xffff1000, 0xf, 0x0, 0x3, 0x0, 0xde, 0x9, 0x3, 0x0, 0x4, 0x30}, {0xdddd0000, 0x9000, 0xc, 0x1, 0x8, 0x3, 0x2, 0x6, 0x91, 0x8, 0x9, 0x88}, {0x8000000, 0xeeee0000, 0x10, 0x6, 0xc2, 0x8, 0x6, 0x10, 0x7, 0x3, 0x80, 0x87}, {0x6000, 0x8000}, {0xe9eb89d253be8b8b, 0x9}, 0x50000, 0x0, 0x0, 0x400408, 0x6, 0x8000, 0xeeef0000, [0x6, 0x5, 0x5, 0xe]}) syz_emit_ethernet(0x36, &(0x7f00000006c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x25}, @void, {@ipv6={0x86dd, @generic={0x8, 0x6, "bc777a", 0x0, 0x6c, 0x1, @remote, @local}}}}, 0x0) syz_clone(0x80000000, &(0x7f0000000240)="801815115269744227f550b86c9c949b581aa2b2aa2650903219971c23ee750720b6665a076a383be50cb572ff87acc4f7cdb239c9d48451f02828d83a9bbdf3188020a0a80d4a1aa70a02340c9bc9ab1ee0e3df818c31d720c9cda057d6a084e5213fb69ab4bd58b6c56dd085617d7a76fe66e927382766508a8b9813949e53987ca1da84494af3ff211ed5ade70a858d093e57d56e165fa8d5a074504bcd922ad28c0e000bcea284c30aa9c3635610b3", 0xb1, 0x0, 0x0, &(0x7f0000000300)="76f56ab54e514376980a3421734478d71e11b6c9cb462caff8b8f68e8c2eadf644b55c93f5f7575d93d75a10de4fde34645ec4196f867f4e50b8b70e891f52dffcf3cdb0f484dd524d2d2a1fa3416cdcb7626f5c") add_key$fscrypt_v1(0x0, &(0x7f0000000380)={'fscrypt:', @desc3}, 0x0, 0x0, 0x0) ioctl$KVM_CAP_X2APIC_API(r3, 0x4068aea3, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, &(0x7f00000003c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000400)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x2, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xa}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0x4d}, {0x9, 0x89, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x3, 0x4, 0x1, '\x00', 0x8}, {0x7f, 0x5, 0xb}, {0xd7, 0xd, 0x8, '\x00', 0xa}, {0x0, 0x28, 0x7, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x2}, {0xfe, 0x3, 0x26}, {0xcf, 0xfa, 0xb, '\x00', 0x5}, {0xf, 0x6, 0x5, '\x00', 0x10}, {0x39, 0x2, 0x6, '\x00', 0x8}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x7, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x0, 0x80, 0x1, '\x00', 0x81}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x8982, &(0x7f0000000040)={0x8, 'vlan1\x00', {'bond_slave_0\x00'}, 0xfffb}) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r8, 0x4010ae68, 0x0) 1m39.108698017s ago: executing program 5 (id=1432): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$dri(0x0, 0x1f, 0x0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)) timer_create(0x0, &(0x7f0000000040)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r5, {0x3, 0x1}, {0xffff, 0x9}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x480, 0x2c, 0xf3f, 0x70fd2c, 0x25dddbbd, {0x0, 0x0, 0x0, r5, {0xc, 0x3da48c8682330ab8}, {0x0, 0xf}, {0xffff, 0xfffa}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x450, 0x2, [@TCA_CGROUP_POLICE={0x44c, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x7, 0x9, 0x1000, 0x7, 0x10, 0xffffffff, 0x4, 0x10001, 0x1, 0xd200, 0x2d, 0x4, 0x3, 0x4, 0xda, 0x0, 0x5, 0xa, 0x9, 0x7f, 0x4, 0x4, 0x1, 0x5, 0xa040, 0x7, 0x44ac32c8, 0xb0ab, 0xff, 0x81, 0xa, 0x3, 0x3fff, 0x1, 0x2, 0x6, 0xa2c, 0x6, 0x5, 0x5, 0x5, 0x4, 0x5, 0x9, 0x7, 0x1, 0xc, 0x5, 0xfffffff8, 0x4, 0x6, 0xf36, 0x5, 0x7, 0x6, 0x2, 0xe09, 0x2, 0x9, 0x2, 0x7474, 0xcf2, 0x6, 0xffffff00, 0x576, 0x6, 0x3, 0x7, 0x5, 0x9, 0x6, 0x0, 0x2, 0x6d, 0xe, 0x80009, 0x80, 0xc8b, 0x4, 0x4, 0x81, 0x6, 0x3, 0xfff, 0x8, 0x81, 0x80000000, 0x3, 0x81, 0x5, 0x5, 0xffff, 0x10, 0x1, 0x8, 0x8, 0x2, 0x81, 0x6, 0x10001, 0x2a9, 0x0, 0x1000db, 0xffffff7c, 0x6, 0x74, 0xa9d5, 0xffffffff, 0x2000001, 0x0, 0x7fffffff, 0x0, 0x7, 0x7, 0xfffffffa, 0x1d, 0x1, 0x7, 0x9, 0x8001, 0x0, 0x10, 0x560, 0x8, 0x81, 0x5, 0x29, 0x4, 0x2, 0x2, 0x9, 0x8, 0x0, 0x3, 0x9, 0xffffffb2, 0x40, 0x3, 0xfa7d, 0xffffffff, 0x6, 0x45, 0x6000, 0x3, 0x59f, 0x4f, 0x100, 0x0, 0x8, 0x3, 0xfff, 0x8001, 0x0, 0x5, 0x8, 0x7f, 0x0, 0x9, 0x9, 0x3, 0x0, 0x7bb1, 0x9, 0x9, 0x9, 0x1, 0x7d4, 0x0, 0x80000000, 0x4d, 0x545, 0xdd, 0x4, 0x6, 0x3000000, 0x0, 0x401, 0x2, 0x80000001, 0x39f, 0x7, 0x9, 0x2000000, 0x6, 0x9, 0x7, 0x6, 0x5, 0x3, 0x201ed7e3, 0x10000, 0x6, 0xfa, 0x1, 0x6, 0x6, 0x0, 0x8, 0x2b1f, 0x400, 0x8001, 0x4, 0x7fdd825, 0x0, 0x7fff, 0x10000, 0x9, 0x5, 0xffff, 0x39f, 0x9, 0x3, 0x7, 0x2, 0x10, 0x2, 0x1, 0x7fff, 0x2, 0x400006, 0x7, 0xcf24, 0x0, 0x6, 0x0, 0x1, 0x5, 0x1, 0x7, 0x5, 0x800, 0x2, 0x40009, 0x1, 0x2, 0x6, 0x0, 0x9, 0xfffffffb, 0x1, 0xf2, 0xffff, 0xfffffffa, 0x6, 0x6, 0x8, 0x3, 0x3ff, 0x9, 0x3, 0xff, 0x1, 0x1000006, 0x15, 0x81]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x81, 0x2000000d, 0xfffffffc, 0x3, 0x0, {0x5, 0x0, 0xfff, 0x6, 0x8, 0x4}, {0xe, 0x0, 0x2, 0x52, 0x9}, 0x5, 0x5}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x8001}]}]}}]}, 0x480}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f00000000c0)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000100)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00004b2000/0x400000)=nil) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x800) statx(r6, &(0x7f0000002100)='./file0\x00', 0x1000, 0x10, &(0x7f0000002140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = gettid() r9 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000002240)={0x0, 0x0}, &(0x7f0000002280)=0xc) setresuid(0x0, r10, r10) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000022c0)={0x0, 0x0, 0x0}, &(0x7f0000002300)=0xc) r12 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000002340), 0x2, 0x0) sendmsg$unix(r4, &(0x7f0000002480)={&(0x7f0000000840)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000a00)=[{&(0x7f00000008c0)="6b5142ecccdcc646f927e2451e3f2441399de1aff730920c7651bcba4f4aba8fa4abe7b880949908d9c5bebd4c89a5ea16aeedbf6a5d23de6ae50e0729f7acf6e630034fa7122807747a0a2aade1311f7c2399a05a30ad61acb9548126ccea0bae1c2d4477711ce15739900f62d42b33945eba247b2c09dc7a42e839db35f92046e45cbe7b4740e9f8fbbae7de7d3432851aba1f3e5d9a6e8b31013af61982a77c0ddaa2a27d40a026f3dfa45d", 0xad}, {&(0x7f0000000980)="33891bb071bc5a07435830d975009d66be5d719cf4dd48d6aa59a77798f27f0abd2e98f5774e2abd9d43315e8902e40b5f87470e00328546c0941e75efccf5f3294e03278c04404fe75b3f64b0e14ef030d5b3e2d88469b76a20c8d3b3e3bbb57f17f0767e62f449d463b8448a25347948", 0x71}], 0x2, &(0x7f0000000a40)=ANY=[@ANYBLOB="1400000000f800000100000001000000e7f8367a4bc3dd3df05a5d2fed56197aea875dddf6442e61506516c5b843b81eb297b5e26b22d6282cd51ac38031244ae6de57602980", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r12, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r8, @ANYRES32=r10, @ANYRES32=r11, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r12, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="20000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r3, @ANYRES32=r0], 0xf8, 0x51}, 0x4008010) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000cc0)={0x1, 0xb, &(0x7f0000000d80)=ANY=[@ANYBLOB="18000000068a000000000000040000001801000020696c2500000000002020207b1ad8ff000000007ba1000000000000070100000400ffffb702000008000000b703000002000000850000002e00000095"], &(0x7f0000000e00)='GPL\x00', 0x6, 0xffa, &(0x7f0000000e40)=""/4090, 0x0, 0xa8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) 1m37.379560126s ago: executing program 5 (id=1436): r0 = syz_open_dev$usbfs(&(0x7f0000000340), 0xf, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000440)={0x0, 0x2, "6875620000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000"}) 1m22.283561127s ago: executing program 33 (id=1436): r0 = syz_open_dev$usbfs(&(0x7f0000000340), 0xf, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000440)={0x0, 0x2, "6875620000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000"}) 6.518698309s ago: executing program 2 (id=1917): syz_usb_connect(0x3, 0xc7, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011002000000408680d20a0000010200010902b5e88c01008030080b00020e03000009040000010e0100000d0b01000134000000000001011224190101020000000000000000030000000924030201010003"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x8ab43, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, &(0x7f0000000480)={0x79, 0x0, 0x982}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_X86_SETUP_MCE(r6, 0x4008ae9c, &(0x7f0000000680)={0x16, 0x4, 0xff}) ioctl$KVM_X86_SETUP_MCE(r6, 0x4008ae9c, &(0x7f00000006c0)={0x12, 0x1, 0xde}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000500)={0x1, 0x0, [{0x1a0}]}) sendmsg$NFT_BATCH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000001300020000000900010073797a300000000058000000120a01040000000000000000020000000900010073797a30000000000900020073797a30000000000800030000000004240004800c0001000000001c000000010c00020000000000000000010800040000000001"], 0xbc}, 0x1, 0x0, 0x0, 0x40000851}, 0x0) syz_usb_connect$uac3(0x6, 0x11a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0xff, 0x582, 0x65, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x108, 0x3, 0x1, 0x1, 0xe0, 0x8, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xa, 0x48, 0x7}, [@feature_unit={0x11, 0x24, 0x7, 0x2, 0x4, [0x0, 0x0, 0xff]}, @selector_unit={0x5, 0x24, 0xc, 0x10}, @extension_unit={0x11, 0x24, 0xa, 0x1, 0x1, [0x3, 0x0, 0x3]}, @mixer_unit={0xa, 0x24, 0x5, 0x5, 0x0, "2749d4c874"}, @extension_unit={0xd, 0x24, 0xa, 0x4, 0x4, [0x2, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xffff, 0xe2b, 0x3b, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x2, 0x36, 0xfa, {0xa, 0x25, 0x25, 0x7ff, 0x4, 0xff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x8b6, 0x8, 0x4, "014fe619a03a"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x0, 0x6, 0x7, 0x9}, @as_header={0x17, 0x24, 0x1, 0x8, 0x7, 0x0, 0x1, 0x7, 0x4, 0xe00, 0x3}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4c, 0xff, 0x5, 0xe, 0x6}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x2, 0x3e, 0x6, 0xa1, 0x7}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x2, 0x7, 0xe4, "15c5f8425ae4c6"}]}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x80, 0x7, 0x60, {0xa, 0x25, 0x25, 0x4, 0x5, 0x6}}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x310, 0x9, 0xc, 0x5, 0x10, 0xb}, 0xa8, &(0x7f00000002c0)={0x5, 0xf, 0xa8, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x1, "bf134378402e461bece3f51e0729b138"}, @generic={0x4c, 0x10, 0x2, "b10f41b8a30f58526ce811e2fe1c51dd1f103197e8163e15711493944a79aec5c9ecf86c8a491fadffbf45768be7b56a03584e36b217e97b2579bd9dc3279f411ecfc9cc9ba4cd45e6"}, @ssp_cap={0x14, 0x10, 0xa, 0x5, 0x2, 0x7, 0xf00, 0x6, [0xff0f, 0xff3fcf]}, @ssp_cap={0x24, 0x10, 0xa, 0x4, 0x6, 0x2, 0xf00, 0x2, [0x180, 0xff00, 0xc0cf, 0x0, 0x30, 0xff00f0]}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x5, 0x3, 0x8000, 0x40}]}, 0x3, [{0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x42b}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x42d}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x440a}}]}) 6.281262823s ago: executing program 4 (id=1918): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/disk', 0x121a02, 0x0) sendfile(r1, r0, &(0x7f0000000180)=0x1, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r2, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0xff4f, 0xffffffffffffff4f, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xeb) 6.211596005s ago: executing program 0 (id=1919): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) sendmmsg$inet6(r0, &(0x7f0000000040)=[{{&(0x7f0000000080)={0xa, 0x4e21, 0x8, @dev={0xfe, 0x80, '\x00', 0xa}}, 0x1c, 0x0}}], 0x1, 0xc040) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000002c0)={0xa, 0x4e21, 0x5, @local, 0xc}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=[@dstopts_2292={{0x18, 0x29, 0x4, {0x3c}}}], 0x18}, 0x6000}], 0x2, 0x20000080) 5.911315602s ago: executing program 4 (id=1920): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f00006fc000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) close(r1) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000c73d8a0870272091776c0102ef010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000640)={0x1c, &(0x7f0000000680)=ANY=[], 0x0, 0x0}) (async) ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, &(0x7f00000001c0)) (async) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000680)={{0x12, 0x1, 0x300, 0x4b, 0x4a, 0x4d, 0x8, 0x13d8, 0x11, 0xa573, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x9, 0x0, 0x0, "", [{{0x9, 0x4, 0xe5, 0x7f, 0x0, 0x4, 0x64, 0x98, 0xc}}]}}]}}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f0000000200)={[{0x5, 0x2000, 0x0, 0x0, 0x6, 0x0, 0x8, 0x0, 0x0, 0xfd, 0x4}, {0x0, 0x0, 0x4, 0x2, 0x0, 0xff, 0x0, 0xfe, 0x0, 0x9, 0x1, 0x0, 0x2}, {0xd6a, 0x4, 0x1, 0x0, 0x0, 0x3, 0x8, 0x0, 0x9, 0x20}]}) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000380)={'syzkaller0\x00', @multicast}) r6 = socket$unix(0x1, 0x2, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000400)={0x0, 0x42, &(0x7f0000000440)={&(0x7f0000000480)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xfff1, 0xffe0}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0xfe, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) (async) sendmsg$nl_route_sched(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70ad2c, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {0x3, 0xb}, {0x7, 0xfff1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x54814}, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f00000005c0)={'syzkaller0\x00', @random="2b0100004ec6"}) r9 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xd6c, 0x1f280, 0x0, 0x399}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') io_uring_enter(r9, 0x100, 0x11, 0xfd, 0x0, 0x0) 5.640894959s ago: executing program 0 (id=1921): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d80)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newpolicy={0xb8, 0x13, 0x101, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@multicast2, 0x4e20, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x9fea, 0x0, 0x0, 0x0, 0x6, 0x3, 0x5, 0x8}, {0x0, 0x1, 0x0, 0x100}, 0x6}}, 0xb8}, 0x1, 0x0, 0x0, 0x20048840}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xfe880000, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x3, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 5.26966517s ago: executing program 0 (id=1923): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) pselect6(0x40, &(0x7f00000007c0)={0x0, 0xf, 0x1000, 0x0, 0x801, 0x100}, 0x0, &(0x7f0000000800)={0x1f, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0) write$P9_RSTATu(r0, &(0x7f0000000340)={0x23b, 0x7d, 0x0, {{0x500, 0xfa, 0x0, 0x0, {0x2}, 0x3e8, 0x0, 0x0, 0x0, 0x1f, '\x04nodev{cvfox%\xff\xff\xff\x81\x02\x00\x00\x00\x00\x001\xff\xce\xbc\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x12, '\xcf\xc2\x13\xf6\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00', 0x5e, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x9d,;\x9e\x1dR\xc3\xd6\xda\x9b\xf6\x99\xfa\x88\xda\xcel\xde{\xa4\xa4\x00\xb4\xb0\xb4\xdb\xf6\xc6\x9ai\xd0\x17\xce\xc4Y\x06\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1a'}, 0x12c, 'odev-n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0x0, 0xffffffffffffffff}}, 0x23b) 4.883950599s ago: executing program 6 (id=1925): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) fsopen(&(0x7f0000000280)='bpf\x00', 0x0) syz_open_dev$radio(&(0x7f0000000200), 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, &(0x7f0000000300)=0x0) io_submit(r2, 0x1, &(0x7f0000000500)=[&(0x7f0000000540)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r1, 0x0, 0x0, 0x1}]) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x30b5, 0x80, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000006c0)={0x2e, 0x5e, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000180)={0x0, 0x1, 0x300, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x4, 0x2100, 0x10000001, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x40000, 0x2, 0x2100ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5008, 0x0, 0x0, 0x1f0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x3e3}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 4.817293201s ago: executing program 1 (id=1926): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r0, 0xfff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r1, 0x5) r2 = socket$inet(0xa, 0x801, 0x84) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0x8) listen(r2, 0xfffffffd) r4 = socket$inet(0xa, 0x801, 0x84) r5 = socket$inet(0xa, 0x801, 0x84) listen(r5, 0x8) listen(r4, 0x1) r6 = socket$netlink(0x10, 0x3, 0x4) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000400)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r6) syz_usb_connect(0x0, 0xb6, &(0x7f0000000280)=ANY=[@ANYBLOB="12010003cf7e8f4040201f7200f2010203010902a400018104004f0904870605a97a37020a24010a0b06020102092403050703020496062404029cfe09050b004000800000072501af82a7ce1932dc70000464040507250103"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1555555555555709}) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000000)={0x28, 0x0, 0x2711, @local}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x80, 0x24, 0x605, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x50, 0x2, {{0x2, 0x9, 0x1, 0x3c9, 0x5, 0x7}, [@TCA_NETEM_ECN={0x8, 0x7, 0x1}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x3, 0xf29a, 0x8, 0x5, 0x10001, 0x1}}]}}}]}, 0x80}, 0x1, 0x0, 0x0, 0x2000c810}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r9, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r10, 0x200, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8005}, 0x20000080) setsockopt$sock_int(r7, 0x1, 0x12, &(0x7f00000000c0)=0x7, 0x4) syz_open_dev$midi(&(0x7f0000000040), 0x3, 0x29c1) 4.360689077s ago: executing program 2 (id=1927): r0 = syz_io_uring_setup(0x44, &(0x7f0000000a00)={0x0, 0x5961, 0x0, 0x1, 0x4e}, &(0x7f0000000a80)=0x0, &(0x7f0000000ac0)=0x0, &(0x7f0000000c00)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000b40)=@IORING_OP_SETXATTR={0x2a, 0x40, 0x0, 0x0, 0x0, &(0x7f0000000bc0)='./file0\x00', 0xff86, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffa, 0x9, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8947, &(0x7f0000000380)={'ip6gre0\x00', @random="0000230c1100"}) sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a010200000000000000000100ffff0900030073797a320000000028000480080002400000000008000140000000051400030076657468315f6d0863767461700000000900010073797a31000000004c000000050a1b000000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076658168315f6d6163767461700000000800014000000005"], 0xe8}}, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$sock(r6, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000940)="83a9f6f162", 0x5}], 0x1}}], 0x1, 0x80) sendmmsg$inet(r6, &(0x7f0000000980)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x41) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@ipv6_newnexthop={0x28, 0x68, 0x200, 0x70bd29, 0x25dfdbfc, {0xa, 0x0, 0x2, 0x0, 0x8}, [@NHA_BLACKHOLE={0x4}, @NHA_ENCAP_TYPE={0x6, 0x7, 0x8}, @NHA_BLACKHOLE={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x4001}, 0x0) syz_emit_ethernet(0x0, 0x0, &(0x7f0000000880)={0x1, 0x1, [0x98d, 0xc9e, 0x99f, 0x9f4]}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(0xffffffffffffffff, 0x13, &(0x7f0000000040)=[0x80000001], 0x2) r8 = accept(r7, &(0x7f0000000440)=@xdp, &(0x7f00000004c0)=0x80) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x9, 0xb, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}, [@btf_id={0x18, 0x5, 0x3, 0x0, 0x3}, @ringbuf_query, @exit, @alu={0x4, 0x0, 0xd, 0x4, 0x7, 0xffffffffffffffe0, 0x1}]}, &(0x7f0000000580)='GPL\x00', 0x0, 0x20, &(0x7f00000005c0)=""/32, 0x41000, 0x1a, '\x00', 0x0, @cgroup_sock=0x2, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000640)={0x5, 0xf, 0xfffffff9, 0x6}, 0x10, 0x0, 0xffffffffffffffff, 0x1, 0x0, &(0x7f00000006c0)=[{0x0, 0x1, 0xc, 0x3}], 0x10, 0x83db}, 0x94) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f00000007c0)=r9, 0x4) 3.723184683s ago: executing program 0 (id=1928): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[], &(0x7f00000001c0)='GPL\x00'}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000300)={r0, 0xffffffffffffffff, 0x1f, 0x0, @val=@netfilter={0x1, 0x0, 0x3}}, 0x6) 3.721786801s ago: executing program 2 (id=1929): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl(r3, 0x4048aecb, &(0x7f0000000300)="070000000000000001000000ffffffff0010a5d4") keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)=@chain={'key_or_keyring:', r0}) r4 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000006, 0x2000001, 0x810, 0xffffffffffffffff, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x1}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r7 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000400)={0x0, &(0x7f0000000340)=[@out_dx={0x6a, 0x28, {0x388c, 0x3, 0xffffffffffffffff}}, @wrmsr={0x65, 0x20, {0x326, 0xff}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @control32=0x401a, 0x7, 0x1, 0x8}}, @nested_intel_msr_list_add={0x155, 0x30, {0x1, 0x1, 0x8ea, 0x14000000}}], 0xb0}) syz_kvm_setup_cpu$x86(r2, r7, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000004c0)=[@text64={0x40, &(0x7f0000000440)="66460f38816f9ec461cd6b2e640f01cbb9f90200000f3266baf80cb8139a6287ef66bafc0cb000ee26460f9afcc4e1e812c2c7442400da000000c7442402d5be45afff2c24f3440f1ed40f01cb", 0x4d}], 0x1, 0x60, &(0x7f0000000500), 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', 0x1}) close(r6) ioctl$TUNSETCARRIER(r5, 0x400454e2, &(0x7f0000000200)) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000000240)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000000280)={'syzkaller0\x00', @random='\x00\a\x00'}) r9 = syz_io_uring_complete(0x0, r4) ioctl$RTC_PIE_ON(r9, 0x7005) syz_clone(0x2180100, 0x0, 0x0, 0x0, 0x0, 0x0) 3.493085724s ago: executing program 6 (id=1930): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000cc0)={0x1, 0xb, &(0x7f0000000d80)=ANY=[@ANYBLOB="18000020068a000000000000040000001801000020696c2500000000002020207b1ad8ff000000007ba1000000000000070100000400ffffb702000008000000b703000002000000850000002e00000095"], &(0x7f0000000e00)='GPL\x00', 0x6, 0xffa, &(0x7f0000000e40)=""/4090, 0x0, 0xa8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) 3.309080283s ago: executing program 6 (id=1931): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000007c0)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x1d86a000) mbind(&(0x7f0000283000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x7, 0x0) mbind(&(0x7f000058a000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x6, 0x3) mremap(&(0x7f0000052000/0x4000)=nil, 0x4000, 0x1000, 0x0, &(0x7f0000486000/0x1000)=nil) r1 = gettid() r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80800) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000040)={{0x2, 0x1, 0xfffffffa, 0x0, 0xd}}) read(r2, &(0x7f0000000080)=""/95, 0x5f) timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x468, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x4, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x43c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x8, 0x5, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x25cf, 0x800000, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x7, 0x5, 0x0, 0x0, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0x10000, 0x401, 0xfffffffe, 0x0, 0x0, 0xffffffff, 0x3, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0xfffffffe, 0x0, 0xffffffff, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0xfffffff7, 0x1ff, 0x0, 0x0, 0x0, 0x80000000, 0xfffffffa, 0x7, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x101, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x10002, 0x0, 0xd5a9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x9, 0xfffffeff, 0x0, 0x2, 0x4, 0x8, 0x0, 0x0, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0x100000, 0x1000, 0x0, 0x0, 0x40000, 0x7fff25c8, 0x0, 0x0, 0x7, 0xd4, 0x8000c, 0x5, 0x0, 0xffffffff, 0xffffffff, 0x302e, 0x0, 0x1, 0x0, 0x6, 0x8, 0x0, 0x1, 0x0, 0xfffffffc, 0x0, 0x0, 0x8, 0x0, 0x1, 0x20000000, 0x4, 0x0, 0x0, 0x3, 0x3, 0x9, 0x2, 0x0, 0x1, 0x8000008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, 0x2, 0x3ff, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0xc, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x80000001, 0x0, 0xfffffffc, 0x0, 0x0, 0x9, 0x0, 0x0, 0x40000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x10000, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x9]}, @TCA_TBF_RATE64={0xc}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x2}, {0x2, 0x0, 0x5, 0x0, 0x0, 0x40}}}]}}]}, 0x468}}, 0x0) clock_gettime(0x0, &(0x7f00000006c0)) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000700), 0x800, 0x0) pipe2$watch_queue(&(0x7f0000000740)={0xffffffffffffffff}, 0x80) tee(r6, r7, 0xead, 0xa) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000800)={0x0, 0x7, 0x0, [0x9, 0x9d48, 0x4, 0x8001, 0xe3], [0xff73, 0xcdb, 0x4, 0x80000001, 0x8000000, 0x3, 0x8, 0x5, 0x0, 0x101, 0x3, 0x4, 0x4, 0x7, 0xc, 0xffffffff, 0x3, 0xfffffffffffffff8, 0x5, 0x1, 0x7fffffff, 0x7, 0x3, 0x1, 0x7, 0xfffffffffffffffb, 0x783520a8, 0x8, 0x8, 0x40, 0x4, 0x8, 0x3, 0x0, 0xaf, 0xaf, 0x0, 0x101, 0x1ff, 0x8, 0x1, 0x4, 0x6, 0x8, 0xfff, 0x1, 0x1000, 0x4, 0x51ea, 0x40, 0x81, 0x9, 0x7, 0xbf9, 0xb35e, 0xfffffffffffffff8, 0x3, 0x3, 0xff, 0x9, 0x80000000, 0x6, 0x6, 0xfffffffffffffffc, 0x0, 0x5, 0x2, 0x7, 0x40, 0xb, 0x5, 0x9, 0x7, 0xa, 0x5, 0x2, 0x8000, 0x25, 0x5, 0x0, 0x9, 0x9, 0x1, 0x5, 0x0, 0x2, 0xff, 0x0, 0x0, 0x4, 0x8, 0x7, 0x8, 0x4, 0x5, 0x10001, 0x81, 0x1, 0x40, 0x10000, 0xd6dc, 0x3, 0x5, 0x8, 0x1, 0x4, 0x7, 0x4, 0x4, 0x5, 0xff, 0x4, 0x1000, 0x9, 0x92d5, 0x8000000000000000, 0x3, 0x8, 0x2, 0xffffffffffff0004, 0x3]}) add_key$user(&(0x7f0000000c40), &(0x7f0000000c80)={'syz', 0x0}, &(0x7f0000000cc0)="f5a33db62dd4147d6c3aa6d3629518a34e4616959e2a6c55bf09f11af3a4a02015dc75fcf14abbd1b094f408ef014873bc538077c5c359a7344d9e444ba1385a638daec457777beea3ab2aeab64b0f6839467f47a75d82cc11a4a46d61aee06fd881ebb12e95c1d9e246dd9c8e6418db1e842284e9528387", 0x78, 0xfffffffffffffffe) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000d40)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000d80)={0x3, &(0x7f0000000dc0)=[{0x20, 0x7f, 0x6, 0xfffff010}, {0x28, 0x0, 0x1, 0x5ae9}, {0x6, 0xb, 0xa1, 0x1000}]}, 0x10) r10 = syz_io_uring_setup(0x2618, &(0x7f0000000e00)={0x0, 0x8550, 0xc00, 0x1, 0xf}, &(0x7f0000000e80)=0x0, &(0x7f0000000780)=0x0, &(0x7f0000000f00)=0x0) syz_io_uring_submit(r11, r12, r13, &(0x7f0000000f40)=@IORING_OP_WAITID={0x32, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x4}}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_enter(r10, 0x1, 0x1, 0x61, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r10, 0x18, &(0x7f0000000fc0)={0x9, 0xffffffffffffffff, 0x5, {0x2, 0x4}, 0x5}, 0x1) sendmmsg$inet(r8, &(0x7f0000001000)=[{{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000001080)}], 0x1}}], 0x1, 0x0) 3.28273746s ago: executing program 0 (id=1932): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000340)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'erspan0\x00', &(0x7f0000000080)={'gretap0\x00', r1, 0x8, 0x40, 0x1, 0x4, {{0x22, 0x4, 0x3, 0x10, 0x88, 0x65, 0x0, 0xc, 0x2, 0x0, @broadcast, @loopback, {[@rr={0x7, 0x17, 0x33, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x27}, @dev={0xac, 0x14, 0x14, 0x21}, @empty]}, @ssrr={0x89, 0xb, 0x2e, [@multicast1, @private=0xa010101]}, @end, @ssrr={0x89, 0x13, 0x60, [@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @dev={0xac, 0x14, 0x14, 0x17}, @empty]}, @noop, @timestamp_prespec={0x44, 0x3c, 0xff, 0x3, 0x4, [{@loopback, 0x3}, {@multicast2, 0x1}, {@multicast1}, {@broadcast, 0x4}, {@loopback, 0xfff}, {@loopback, 0x1}, {@empty, 0x7}]}]}}}}}) r2 = syz_open_dev$video4linux(&(0x7f0000000280), 0x5d7, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r2, 0xc038563c, &(0x7f0000000400)={0x0, 0x0, "119f04499489f733dcaa932034d61433a5ba43d2103eb3221503dc2984dea6e2"}) socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f00000002c0), 0x1c3902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000500)=0x7) ioctl$VIDIOC_S_HW_FREQ_SEEK(0xffffffffffffffff, 0x40305652, &(0x7f0000000540)={0x0, 0x1, 0x0, 0x0, 0x0, 0x28fc0, 0x9f8c}) sendfile(r4, r4, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000580)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000005c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) syz_open_dev$cec(&(0x7f0000000600), 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) r6 = epoll_create1(0x80000) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f0000000680)={"058ba7b0", 0x88c6, 0x7, 0x68, 0xfffffffb, 0x9, "1e38dc8233445d64b3ab57f2ce72b8", "0605d4a4", "88905c33", "c7786f68", ["2933bc9644e832ab49859fc5", "c0c04d7600f48c25bc63d81c", "fa991c20c4d6e1cbdc9bbac9", "385d87eb546edc875b94933c"]}) r7 = socket(0x1, 0x80802, 0x0) fsopen(&(0x7f0000000700)='befs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000740)='source\x00', &(0x7f0000000780)='127.0.0.1:/export\x00', 0x0) r8 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r8, &(0x7f00000007c0)={0xa000000d}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000800)={0x80000000}) 3.197312773s ago: executing program 4 (id=1933): pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x2}) ioctl$TUNSETOFFLOAD(r2, 0x400454c9, 0xba98575a95aeb70d) ioctl$TUNSETLINK(r2, 0x400454cd, 0x337) (async) ioctl$TUNSETLINK(r2, 0x400454cd, 0x337) ioctl$TUNSETOFFLOAD(r2, 0x400454d0, 0x1) read$FUSE(r0, &(0x7f0000000700)={0x2020}, 0x2020) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x3, 0x0, 0x0, {0xa, 0x1000, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x80, 0x0}, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x3, 0x0, 0x0, {0xa, 0x1000, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x80, 0x0}, 0x0) socket$kcm(0x2, 0x1, 0x84) (async) r3 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r3, 0x84, 0x9, &(0x7f0000000180), 0x98) (async) setsockopt$sock_attach_bpf(r3, 0x84, 0x9, &(0x7f0000000180), 0x98) write$FUSE_INIT(r1, &(0x7f0000002740)={0x6f, 0x0, 0x0, {0x7, 0x28, 0x80000001, 0x0, 0x0, 0x0, 0x2, 0x1}}, 0xfffffede) fcntl$setpipe(r0, 0x407, 0xc000) r4 = socket$netlink(0x10, 0x3, 0x4) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x4}) (async) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x4}) writev(r4, &(0x7f0000000640)=[{&(0x7f0000000680)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000a0c100000000000224e0000", 0x58}], 0x1) 2.895162778s ago: executing program 1 (id=1934): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000004c0)={0x1, &(0x7f0000000500)=[{0x6, 0x0, 0x87, 0x7ffc0201}]}) rseq(&(0x7f0000000540)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) quotactl$Q_GETINFO(0xffffffff80000501, &(0x7f0000000880)=@nbd={'/dev/nbd', 0x0}, 0x0, 0x0) quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000201, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000100001000000000000001600050005033c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffffff03140000001100010000000000000000000200000a"], 0x64}, 0x1, 0x0, 0x0, 0x95}, 0x24000000) sendmsg$NFT_BATCH(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a88000000090a051200000000000000000a0000040900020073797a310000000008000a40fffffffc0900010073797a3100000000080005400000000b4400"], 0xb0}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000680), 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r3, 0xc0305302, &(0x7f00000006c0)={0x36, 0x7, 0x4, 0x9, 0x1, 0x80}) rseq(&(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={0x0, 0x4, 0x2000000000006, 0x9, 0xffbffffffffffff7}, 0x1}, 0x20, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = signalfd4(r3, 0x0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r4, 0x5501) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780)={0x0, 0x100, 0x7}, &(0x7f0000000a40)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000800)={r5, 0x4, 0x1000}, &(0x7f0000000840)=0x8) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000007c0), 0x10002, 0x0) r6 = socket$can_raw(0x1d, 0x3, 0x1) fcntl$setflags(r6, 0x2, 0x1) sendmsg$NFNL_MSG_CTHELPER_GET(r2, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000009c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="8400000001090600000000000000000001000006380002000c00020100880000000c000280050001002f000000060003400002000014000180080001000a01010008000200ac1e00010c00048008000140ffffffff0c000480080001400000010008000340000000030900010073797a31000000000900010073797a3000000000000000"], 0x84}, 0x1, 0x0, 0x0, 0x2000805}, 0x0) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000580)={{0x2, 0x4e20, @multicast2}, {0x60c, @link_local}, 0x74, {0x2, 0x4e24, @rand_addr=0x64010100}, 'bridge0\x00'}) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f0000000600)=[@ioring_restriction_sqe_flags_allowed={0x2, 0xf}], 0x1) 2.843436707s ago: executing program 6 (id=1935): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x88, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x41000000}, @NFTA_RULE_EXPRESSIONS={0x60, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xd}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x3b}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x2c}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xfc}}, 0x80) 2.780990083s ago: executing program 2 (id=1936): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000300000100010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x20004004) 2.191784366s ago: executing program 6 (id=1937): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c2bd0b20f8061b3039bb0102030109021b0001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001e00010032bd7000fcdbdf250a000c7d"], 0x30}, 0x1, 0x0, 0x0, 0x45}, 0x20000000) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x38, 0x0, 0x1, 0x505, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4041}, 0x50) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 2.001869479s ago: executing program 4 (id=1938): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x3, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x3, 0x0, 0x9, 0xe, 0x0, 0x0, 0xffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x4}, 0xc5da}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x9, 0x2, 0x40000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @empty, 0x1}}]}, 0x70}, 0x18, 0x7}, 0x0) 1.991708428s ago: executing program 1 (id=1939): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x8, 0x3, 0x9c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x930, 0xffffffff, 0xffffffff, 0x930, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @private, 0x0, 0x0, 'batadv0\x00', 'batadv_slave_0\x00', {}, {}, 0x21}, 0x6, 0xa0, 0xc0, 0x0, {}, [@common=@inet=@dccp={{0x30}, {[], [], 0x0, 0x8, 0x0, 0x2}}]}, @unspec=@TRACE={0x20}}, {{@ip={@loopback, @rand_addr=0x64010100, 0x0, 0xff000000, 'wlan1\x00', 'bond_slave_0\x00', {}, {}, 0xc000, 0x2}, 0x0, 0x850, 0x870, 0x0, {}, [@common=@unspec=@u32={{0x7e0}, {[{[], [{}, {}, {0x0, 0x40}, {0x0, 0xfffff561}]}, {[{0x0, 0x2}, {}, {0x0, 0x2}], [{}, {0x1}]}, {[{}, {}, {0x4}, {}, {}, {0x1ff}, {0x0, 0x1}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x7fff}, {0xffffffff}]}, {[], [{}, {}, {}, {}, {}, {}, {0x0, 0xffffffff}]}, {[{}, {}, {}, {}, {}, {0x0, 0x2}], [{}, {0x0, 0xfffffffd}]}, {[{}, {}, {}, {}, {}, {}, {0x0, 0x1}], [{}, {}, {}, {0xfffffffc}, {}, {}, {}, {0xfffffff8}]}, {[{}, {}, {}, {}, {}, {}, {}, {0x0, 0x3}], [{}, {0x0, 0x2}, {}, {}, {}, {}, {0x8}]}, {}, {[{}, {}, {}, {0x0, 0x3}, {}, {}, {0xbe}], [{}, {0x0, 0x9}]}, {[{}, {}, {}, {}, {}, {}, {0x0, 0x6}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}]}, {[{}, {0x9}, {}, {0x3}]}], 0x80}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xa6f) 1.925409972s ago: executing program 2 (id=1940): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f00000046c0)={&(0x7f0000004700)=@rxrpc=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @empty}}, 0x80, &(0x7f0000004780)=[{&(0x7f00000047c0)="ee", 0xfffffe5e}], 0x1, &(0x7f0000004800)=ANY=[@ANYBLOB="180000000000000010010000010003007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8}, 0x2300) 1.604714841s ago: executing program 0 (id=1941): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x4e20, @private=0xa010103}]}, &(0x7f00000001c0)=0x10) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000240)=0x8) (rerun: 32) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000280)={0x11}, 0x8) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000002c0)={r1, 0x1}, &(0x7f0000000300)=0x8) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000440)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) (async) inotify_init1(0x0) (async) chdir(&(0x7f00000000c0)='./cgroup\x00') r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x75, 0xa8341) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f00000004c0)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b2547e500f61681905db88235f8a5447dd2a2ed6e91626f060c2b21a100efb76cba37ff3111d6847e0900719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969e65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd5bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14ebbf599394baea3a9ca1864ffff5d6cc38fca32ad6b39905a9727d2001457df7be70800fe3635b2ee97c143f28def4b73905ca14d90d1f60000000000000000000000000000001000"}) (async) ioctl$USBDEVFS_SETINTERFACE(r4, 0x80085504, &(0x7f0000000600)) r5 = socket(0x80000000000000a, 0x2, 0x0) sendmsg$NFT_MSG_GETCHAIN(r5, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x40, 0x4, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x20004005}, 0x8080) flistxattr(r5, &(0x7f0000000100)=""/3, 0x3) (async) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]}) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.602650255s ago: executing program 4 (id=1942): r0 = socket(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00042dbd7000ffdbdf254a0000000f00a8007365636f6e646e616d65000008000300"], 0x48}, 0x1, 0x0, 0x0, 0x4500}, 0x240001d0) write(r0, &(0x7f0000000240)="aefc00001a0025f00385bc04fef7681d020b49ff708800008003280008021000ac0a1410bc71176a36ede498534108e58342fa94a235a2a441f9", 0xfcae) 1.594621609s ago: executing program 1 (id=1943): r0 = openat(0xffffffffffffffff, &(0x7f00000003c0)='./file1\x00', 0x5a3a41, 0xd7) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, 0x0) sigaltstack(&(0x7f0000000200)={0x0, 0x80000001}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="a00000004100010026bd700000ccd900030100000f00000012000100002802e08a17503ca13e6d3e3627000004000280700003806c000b806800", @ANYRESHEX=r2], 0xa0}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) sigaltstack(0x0, &(0x7f0000000180)={0x0}) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x193902, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendfile(r3, r3, 0x0, 0x20000005) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, 0x0, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d132, r0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'bridge_slave_1\x00', 0xc201}) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x801, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r6, &(0x7f00000001c0)="a81db6ad102d1a4512fd95e30d9cceb75ebebdcb709ec812af6456e4158cb13e698543cefa99036f79fe366050afccf3", &(0x7f0000000240)=@udp6=r0, 0x1}, 0x20) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r8 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000380)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@gettaction={0x124, 0x32, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xb}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_gd=@TCA_ACT_TAB={0x50, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x750a5e4c}}, {0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xffffff52}, @action_gd=@TCA_ACT_TAB={0x88, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x10, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0x14, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0x10, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb0}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4bb8}}]}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}]}, 0x124}}, 0x0) write$tun(r5, &(0x7f0000000280)=ANY=[], 0xfd6c) 1.338592293s ago: executing program 2 (id=1944): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x21, 0xfffffffffffffffe, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7001bedbdf25340000000800b8"], 0x3c}, 0x1, 0x0, 0x0, 0x200080d4}, 0x20000000) msgget$private(0x0, 0x41) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000000)={{0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xdd, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x200}) msgsnd(0x0, &(0x7f0000000080)={0x3}, 0x8, 0x0) msgctl$IPC_RMID(0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x259fdbfd, {0x0, 0x0, 0x0, 0x0, 0x21120, 0x68591}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4000804) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=ANY=[@ANYBLOB="70000000020605a3cfc8647108024e0000000007120003006269746d61703a69702c6d616300000005000400010000000900020073797a3000000000240007800c00028008000140000000020c0001800800014000000004080008400000005c05000500020000000500010006"], 0x70}}, 0x8000) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000c40)=ANY=[@ANYBLOB="28000000030605000000000000000000020000080500010007b700000900020073797a30"], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) 1.152999032s ago: executing program 1 (id=1945): set_mempolicy(0x8006, &(0x7f0000000000)=0xfff, 0x5) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x66000000) 1.107581526s ago: executing program 4 (id=1946): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0xc201}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x524, &(0x7f0000000180)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x1c, &(0x7f0000000540)=ANY=[@ANYBLOB="18080000ff00000000000000fbffffff18", @ANYRES32, @ANYRES64], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000580)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'syzkaller1\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xb, 0xfff7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xb, 0xfff7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) write$tun(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="000086dd000012000000000000000000000000000c00452700240068000006f78f02000000ffe000000122019078e0000002a00c813429117082"], 0x3a) (async) write$tun(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="000086dd000012000000000000000000000000000c00452700240068000006f78f02000000ffe000000122019078e0000002a00c813429117082"], 0x3a) 308.731157ms ago: executing program 1 (id=1947): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x1c3902, 0x0) sendfile(r0, r0, 0x0, 0x200000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x80782, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) write(r1, &(0x7f0000000380)="e9", 0x1) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f00000003c0)) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x6) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000400)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0xc, &(0x7f00000004c0)={0x0, 0x51f2, 0xdb00, 0x10000008, 0x29}) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="10ce0000048bb5dae4130ebd2799386f62c64726df23df49fa6e70edd9137b50f1490096baae3cf4aa230098cb33f285e0d61a1fb83488082c781caee2b671f70c5b38db35d1d3e88be205c4c29fc5d32cec4e7b7ef02248338ca49e553076554eebd640c195f354eb589fd658ce4a9b7ef8caa7f32fc7a0531bcf4479e57b91bdd29adeb5d312f539a32c986fe1dda285909cca8d670f49551ed59cb7010800000020091d57fec0bc692f5ee9eef00000000094f76438a986bf81f82fccb58669bedd772b165f0c5be2e2823007d64886a8201df6d6eb4a73594b7b0cf36a381c64b7209486ce19096cc549ea7bb8dbd6875a5064f0088c07646890716ddad2a1cf0613939cc1e910d8e16df178fc6ca0f98a3076db50bbabc366362c20a4c56e944b1e940586a684426ea213a9692f7df35355ce40e30c28b40e850c941d610eaf3672559ac0b3d143699e1de0e83a4209876db534b11ef0f58c20559f897d53420f3a02cd0cde89c2ad59c1253eb88aca331d13681391"], 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000580)={0x6, 0x20, 0x6, 0x7fff, 0x1a, "ee1dd756f560f25a63b2f119c3439425ea59d8"}) cachestat(r0, &(0x7f00000001c0)={0x9}, &(0x7f0000000200), 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000640)={0x1, &(0x7f0000000680)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) rseq(&(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) brk(0x200000ffc000) msgget(0x2, 0x202) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd28, 0x25dfdbfe, {0x60, 0x0, 0x0, r7, {0x0, 0xe}, {0xffff, 0xffff}, {0x7, 0x1}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_TUPDATE={0x8, 0x8, 0xffffffff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000040) msgsnd(0xffffffffffffffff, 0x0, 0xfffffffffffffe54, 0x0) brk(0x4) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) 0s ago: executing program 6 (id=1948): r0 = syz_ublk_setup_io_uring(0x1c14, &(0x7f0000000080)={0x0, 0xba2b, 0x40, 0x4000003, 0x244}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) io_uring_register$IORING_REGISTER_RESTRICTIONS(r0, 0xb, &(0x7f00000001c0)=[@ioring_restriction_sqe_flags_required={0x3, 0x18}], 0x1) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0x2710, @host}, 0x10) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000240)={0x28, 0x0, 0x88bbcfd08703268b, @host}, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x1, 0xb}, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000000ec0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000040)={0xa, 0x4e22, 0x1, @rand_addr=' \x01\x00', 0xfffff801}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=[@rthdrdstopts={{0x20, 0x29, 0x37, {0x33, 0x0, '\x00', [@enc_lim={0x4, 0x1, 0x2}]}}}], 0x20}}], 0x2, 0x40) kernel console output (not intermixed with test programs): ftover after parsing attributes in process `syz.4.1356'. [ 367.132995][ T9768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 367.242699][ T9768] 8021q: adding VLAN 0 to HW filter on device team0 [ 367.294889][ T9929] loop5: detected capacity change from 0 to 7 [ 367.297620][ T155] bridge0: port 1(bridge_slave_0) entered blocking state [ 367.297730][ T155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 367.298186][ T9929] Dev loop5: unable to read RDB block 7 [ 367.298241][ T9929] loop5: unable to read partition table [ 367.298411][ T9929] loop5: partition table beyond EOD, truncated [ 367.298448][ T9929] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 367.388645][ T155] bridge0: port 2(bridge_slave_1) entered blocking state [ 367.388721][ T155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 367.424820][ T5640] Bluetooth: hci3: command tx timeout [ 367.674165][ T9768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 367.717808][ T9955] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1360'. [ 367.893642][ T9768] veth0_vlan: entered promiscuous mode [ 367.943472][ T9768] veth1_vlan: entered promiscuous mode [ 368.054905][ T5297] 8021q: adding VLAN 0 to HW filter on device eth4 [ 368.082578][ T9768] veth0_macvtap: entered promiscuous mode [ 368.129237][ T9768] veth1_macvtap: entered promiscuous mode [ 368.223749][ T9768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 368.266531][ T9768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 368.315902][ T7921] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.316606][ T7921] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.316644][ T7921] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.316680][ T7921] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.430484][ T5698] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 368.485738][ T7922] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 368.485761][ T7922] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 368.540800][ T7923] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 368.540823][ T7923] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 368.575839][ T5698] usb 3-1: device descriptor read/64, error -71 [ 368.600446][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 368.600466][ T31] audit: type=1326 audit(1794056694.275:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.618479][ T31] audit: type=1326 audit(1794056694.275:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=325 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.634157][ T31] audit: type=1326 audit(1794056694.305:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.637024][ T31] audit: type=1326 audit(1794056694.315:1558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.666943][ T31] audit: type=1326 audit(1794056694.345:1559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.667711][ T31] audit: type=1326 audit(1794056694.345:1560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.686144][ T992] usb 2-1: new low-speed USB device number 44 using dummy_hcd [ 368.692970][ T31] audit: type=1326 audit(1794056694.365:1561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.693121][ T31] audit: type=1326 audit(1794056694.365:1562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.700287][ T31] audit: type=1326 audit(1794056694.375:1563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.722937][ T31] audit: type=1326 audit(1794056694.375:1564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9975 comm="syz.4.1366" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f823639fb19 code=0x7ffc0000 [ 368.838999][ T992] usb 2-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 368.889537][ T992] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 368.889568][ T992] usb 2-1: config 0 has no interface number 0 [ 368.889609][ T992] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 368.889634][ T992] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 368.889662][ T992] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 368.889686][ T992] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 368.889712][ T992] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 368.889739][ T992] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 368.889783][ T992] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.903243][ T5698] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 368.917075][ T992] usb 2-1: config 0 descriptor?? [ 368.932911][ T9973] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 368.933065][ T9973] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 369.039280][ T992] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 369.096699][ T5698] usb 3-1: device descriptor read/64, error -71 [ 369.205053][ T5698] usb usb3-port1: attempt power cycle [ 369.265347][ T5640] Bluetooth: hci0: unexpected cc 0x203e length: 2 > 1 [ 369.266097][ T5640] Bluetooth: hci0: unexpected event for opcode 0x203e [ 369.269540][ T5640] Bluetooth: hci0: unexpected cc 0x203e length: 2 > 1 [ 369.269568][ T5640] Bluetooth: hci0: unexpected event for opcode 0x203e [ 369.304329][ T9984] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1368'. [ 369.304434][ T9984] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1368'. [ 369.358944][ T9986] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1367'. [ 369.574676][ T5698] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 369.595314][ T5698] usb 3-1: device descriptor read/8, error -71 [ 369.844681][ T5698] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 369.865463][ T2246] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 369.866614][ T5698] usb 3-1: device descriptor read/8, error -71 [ 369.974969][ T5698] usb usb3-port1: unable to enumerate USB device [ 370.035611][ T2246] usb 6-1: New USB device found: idVendor=1d50, idProduct=614d, bcdDevice=1.00 [ 370.038801][ T2246] usb 6-1: config 1 has an invalid descriptor of length 194, skipping remainder of the config [ 370.038856][ T2246] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 18640, setting to 1024 [ 370.038884][ T2246] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 370.038916][ T2246] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 370.038959][ T2246] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.080206][ T9998] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 370.682917][ T2246] usb 6-1: USB disconnect, device number 2 [ 370.760122][ T5698] usb 2-1: USB disconnect, device number 44 [ 370.772709][ T5698] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 370.889729][T10021] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1376'. [ 372.202452][T10053] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1391'. [ 372.273448][T10057] netlink: 9 bytes leftover after parsing attributes in process `syz.4.1392'. [ 372.293057][T10057] gretap0: entered promiscuous mode [ 372.312817][T10057] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1392'. [ 372.312928][T10057] 0ªî{X¹¦: renamed from gretap0 [ 372.331961][T10057] 0ªî{X¹¦: left promiscuous mode [ 372.331988][T10057] 0ªî{X¹¦: entered allmulticast mode [ 373.348856][ T5640] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 373.348916][ T5640] Bluetooth: hci0: Injecting HCI hardware error event [ 373.354414][ T53] Bluetooth: hci0: hardware error 0x00 [ 373.713829][T10085] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1400'. [ 373.906854][ T2246] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 374.066953][ T2246] usb 6-1: Using ep0 maxpacket: 16 [ 374.069239][ T2246] usb 6-1: New USB device found: idVendor=04b4, idProduct=bca1, bcdDevice=0.00 [ 374.073015][ T2246] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 374.073051][ T2246] usb 6-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 6 [ 374.073079][ T2246] usb 6-1: config 0 interface 0 has no altsetting 0 [ 374.073116][ T2246] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 374.142269][ T2246] usb 6-1: config 0 descriptor?? [ 374.711510][T10101] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1404'. [ 374.882798][T10103] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1404'. [ 375.059587][T10101] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1404'. [ 375.425964][ T53] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 376.461463][T10127] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1412'. [ 376.461543][T10127] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1412'. [ 376.604026][T10129] loop5: detected capacity change from 0 to 7 [ 376.624158][T10129] loop5: p1 p3 p4 [ 376.624188][T10129] loop5: partition table partially beyond EOD, truncated [ 376.648934][T10129] loop5: p3 size 3645588866 extends beyond EOD, truncated [ 376.716947][ T2246] usbhid 6-1:0.0: can't add hid device: -71 [ 376.717066][ T2246] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 376.721900][ T2246] usb 6-1: USB disconnect, device number 3 [ 377.002386][ T7584] udevd[7584]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 377.016086][ T7433] udevd[7433]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 377.030948][ T7583] udevd[7583]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory [ 377.525500][T10147] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 378.064999][T10153] trusted_key: syz.2.1424 sent an empty control message without MSG_MORE. [ 378.236970][T10161] tipc: Resetting bearer [ 378.304839][T10161] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 378.790214][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.790257][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.186866][T10188] vlan0: entered promiscuous mode [ 381.233792][T10188] team0: Port device vlan0 added [ 381.329926][T10212] xt_connbytes: Forcing CT accounting to be enabled [ 382.979171][T10237] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1439'. [ 385.263942][T10264] netlink: 'syz.0.1442': attribute type 2 has an invalid length. [ 385.263960][T10264] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1442'. [ 385.263973][T10264] netlink: 'syz.0.1442': attribute type 2 has an invalid length. [ 385.263981][T10264] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1442'. [ 385.367903][ T5643] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 385.557928][ T5643] usb 2-1: New USB device found: idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 385.563435][ T5643] usb 2-1: config 0 has an invalid interface number: 119 but max is 0 [ 385.563466][ T5643] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 385.563488][ T5643] usb 2-1: config 0 has no interface number 0 [ 385.563529][ T5643] usb 2-1: config 0 interface 119 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 385.619710][T10268] netlink: 'syz.0.1444': attribute type 11 has an invalid length. [ 385.655414][ T5643] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.655443][ T5643] usb 2-1: Product: syz [ 385.655459][ T5643] usb 2-1: Manufacturer: syz [ 385.655474][ T5643] usb 2-1: SerialNumber: syz [ 385.714329][ T5643] usb 2-1: config 0 descriptor?? [ 385.782130][ T5643] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.119/input/input29 [ 386.637914][ T10] usb 2-1: USB disconnect, device number 45 [ 387.142805][T10287] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1447'. [ 387.142827][T10287] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1447'. [ 387.761517][T10300] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.1450'. [ 387.893418][T10303] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 387.916842][ T5913] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 387.918033][ T5913] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 387.918061][ T5913] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 387.918086][ T5913] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 389.295694][ T10] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 389.325797][T10323] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 389.465508][ T10] usb 3-1: New USB device found: idVendor=1e7d, idProduct=30d4, bcdDevice=0.01 [ 389.478415][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 389.478440][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 389.478469][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.517252][ T10] usb 3-1: config 0 descriptor?? [ 390.187634][ T10] hid_parser_main: 59 callbacks suppressed [ 390.187655][ T10] arvo 0003:1E7D:30D4.001C: unknown main item tag 0x0 [ 390.187679][ T10] arvo 0003:1E7D:30D4.001C: unknown main item tag 0x0 [ 390.187699][ T10] arvo 0003:1E7D:30D4.001C: unknown main item tag 0x0 [ 390.187717][ T10] arvo 0003:1E7D:30D4.001C: unknown main item tag 0x0 [ 390.187736][ T10] arvo 0003:1E7D:30D4.001C: unknown main item tag 0x0 [ 390.187755][ T10] arvo 0003:1E7D:30D4.001C: unknown main item tag 0x0 [ 390.187773][ T10] arvo 0003:1E7D:30D4.001C: unknown main item tag 0x0 [ 390.263214][ T10] arvo 0003:1E7D:30D4.001C: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.2-1/input0 [ 390.434253][T10331] loop4: detected capacity change from 0 to 7 [ 390.459860][T10331] Dev loop4: unable to read RDB block 7 [ 390.459914][T10331] loop4: unable to read partition table [ 390.460079][T10331] loop4: partition table beyond EOD, truncated [ 390.460113][T10331] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 390.985224][ T10] arvo 0003:1E7D:30D4.001C: couldn't init struct arvo_device [ 390.985265][ T10] arvo 0003:1E7D:30D4.001C: couldn't install keyboard [ 391.046163][ T10] arvo 0003:1E7D:30D4.001C: probe with driver arvo failed with error -71 [ 391.065825][ T10] usb 3-1: USB disconnect, device number 47 [ 392.585785][T10359] ªªªªªª: renamed from vlan0 [ 392.607670][T10361] netlink: 'syz.1.1469': attribute type 10 has an invalid length. [ 393.150965][T10371] FAULT_INJECTION: forcing a failure. [ 393.150965][T10371] name failslab, interval 1, probability 0, space 0, times 0 [ 393.150992][T10371] CPU: 0 UID: 0 PID: 10371 Comm: syz.1.1473 Tainted: G L syzkaller #0 PREEMPT(full) [ 393.151013][T10371] Tainted: [L]=SOFTLOCKUP [ 393.151019][T10371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 393.151028][T10371] Call Trace: [ 393.151033][T10371] [ 393.151043][T10371] dump_stack_lvl+0xe8/0x150 [ 393.151094][T10371] should_fail_ex+0x3eb/0x540 [ 393.151117][T10371] should_failslab+0xa8/0x100 [ 393.151143][T10371] __kmalloc_cache_noprof+0x9e/0x600 [ 393.151168][T10371] ? __kmalloc_cache_noprof+0x148/0x600 [ 393.151191][T10371] ? kvm_dev_ioctl+0xa0f/0x1700 [ 393.151219][T10371] ? kvm_dev_ioctl+0xa0f/0x1700 [ 393.151244][T10371] kvm_dev_ioctl+0xa0f/0x1700 [ 393.151266][T10371] ? __fget_files+0x2a/0x420 [ 393.151286][T10371] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 393.151306][T10371] ? bpf_lsm_file_ioctl+0x9/0x20 [ 393.151329][T10371] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 393.151346][T10371] __se_sys_ioctl+0xfc/0x170 [ 393.151371][T10371] do_syscall_64+0x166/0x520 [ 393.151390][T10371] ? trace_irq_disable+0x3b/0x140 [ 393.151411][T10371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.151427][T10371] ? clear_bhb_loop+0x70/0xc0 [ 393.151445][T10371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.151462][T10371] RIP: 0033:0x7fe7c1d9fb19 [ 393.151477][T10371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.151490][T10371] RSP: 002b:00007fe7bfff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 393.151506][T10371] RAX: ffffffffffffffda RBX: 00007fe7c2025fa0 RCX: 00007fe7c1d9fb19 [ 393.151518][T10371] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003 [ 393.151527][T10371] RBP: 00007fe7bfff6090 R08: 0000000000000000 R09: 0000000000000000 [ 393.151537][T10371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 393.151546][T10371] R13: 00007fe7c2026038 R14: 00007fe7c2025fa0 R15: 00007fe7c214fa48 [ 393.151570][T10371] [ 393.503836][T10374] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1472'. [ 394.145036][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 394.257767][T10386] sit0: entered promiscuous mode [ 394.322393][T10386] netlink: 'syz.0.1478': attribute type 1 has an invalid length. [ 394.322415][T10386] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1478'. [ 394.704784][ T30] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 394.869176][ T30] usb 3-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 394.871724][ T30] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 394.871759][ T30] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 394.871782][ T30] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 394.871834][ T30] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 394.930065][T10396] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 394.931434][T10396] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 394.983651][ T30] usb 3-1: config 0 descriptor?? [ 395.311426][ T31] kauditd_printk_skb: 76 callbacks suppressed [ 395.311446][ T31] audit: type=1326 audit(1794056720.985:1641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.313876][ T31] audit: type=1326 audit(1794056720.985:1642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.373735][ T31] audit: type=1326 audit(1794056721.045:1643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.405508][ T31] audit: type=1326 audit(1794056721.085:1645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=226 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.406266][ T31] audit: type=1326 audit(1794056721.085:1646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.406447][ T31] audit: type=1326 audit(1794056721.085:1647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.406551][ T31] audit: type=1326 audit(1794056721.075:1644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.406931][ T31] audit: type=1326 audit(1794056721.085:1648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.407988][ T31] audit: type=1326 audit(1794056721.085:1649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.413003][ T31] audit: type=1326 audit(1794056721.085:1650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10389 comm="syz.0.1480" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7fe4f979fb19 code=0x7ffc0000 [ 395.491633][T10401] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1483'. [ 395.611288][ T30] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 395.611317][ T30] plantronics 0003:047F:FFFF.001D: unknown main item tag 0x0 [ 395.645714][T10401] netlink: 'syz.1.1483': attribute type 10 has an invalid length. [ 395.670830][T10388] socket: no more sockets [ 395.709120][ T30] plantronics 0003:047F:FFFF.001D: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 395.783762][ T30] usb 3-1: USB disconnect, device number 48 [ 395.992852][T10404] fido_id[10404]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 396.386815][T10411] netlink: 'syz.4.1486': attribute type 4 has an invalid length. [ 396.697699][T10414] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1487'. [ 396.879325][T10414] team0: Port device team_slave_0 removed [ 397.029097][T10423] syzkaller0: entered promiscuous mode [ 397.029131][T10423] syzkaller0: entered allmulticast mode [ 397.032963][ T5640] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 397.038757][ T5640] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 397.059174][ T5640] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 397.080762][T10423] tipc: Enabled bearer , priority 10 [ 397.082819][ T5640] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 397.084395][ T5640] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 397.111257][T10421] tipc: Resetting bearer [ 397.281528][T10421] tipc: Disabling bearer [ 397.339944][T10431] input: syz0 as /devices/virtual/input/input31 [ 397.423682][T10432] tipc: Started in network mode [ 397.423706][T10432] tipc: Node identity 080211000001, cluster identity 4711 [ 397.424150][T10432] tipc: Enabled bearer , priority 10 [ 397.584794][T10436] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.1494'. [ 397.797693][T10443] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1495'. [ 397.903172][T10446] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1498'. [ 397.974683][ T10] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 398.133003][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 398.133061][ T10] usb 2-1: New USB device found: idVendor=200c, idProduct=100b, bcdDevice=0.40 [ 398.139509][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 398.154488][ T10] usb 2-1: string descriptor 0 read error: -22 [ 398.164970][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.495120][T10459] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1502'. [ 398.568027][T10462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1502'. [ 398.595410][T10459] 8021q: adding VLAN 0 to HW filter on device bond1 [ 398.669729][ T5643] tipc: Node number set to 134418688 [ 398.804244][T10471] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1504'. [ 398.804273][T10471] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1504'. [ 398.824521][ T10] usb 2-1: current rate 2937664 is different from the runtime rate 48000 [ 399.078354][T10474] vlan4: entered allmulticast mode [ 399.078373][T10474] macvlan0: entered allmulticast mode [ 399.078383][T10474] veth1_vlan: entered allmulticast mode [ 399.143331][T10426] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.143629][T10426] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.143805][T10426] bridge_slave_0: entered allmulticast mode [ 399.170510][T10426] bridge_slave_0: entered promiscuous mode [ 399.183647][T10426] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.185332][ T53] Bluetooth: hci5: command tx timeout [ 399.187593][T10426] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.187954][T10426] bridge_slave_1: entered allmulticast mode [ 399.192156][T10426] bridge_slave_1: entered promiscuous mode [ 399.245009][ T5643] usb 3-1: new full-speed USB device number 49 using dummy_hcd [ 399.373123][ T5706] usb 5-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-terratec-h7-az6007.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 399.373228][ T5706] dvb_usb_az6007 5-1:0.0: probe with driver dvb_usb_az6007 failed with error -110 [ 399.406719][ T5643] usb 3-1: New USB device found: idVendor=13d8, idProduct=0001, bcdDevice=30.62 [ 399.427651][ T5643] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.427681][ T5643] usb 3-1: Product: syz [ 399.427696][ T5643] usb 3-1: Manufacturer: syz [ 399.427712][ T5643] usb 3-1: SerialNumber: syz [ 399.455569][ T5643] usb 3-1: config 0 descriptor?? [ 399.458168][ T5706] usb 5-1: USB disconnect, device number 33 [ 399.506567][ T5643] usb 3-1: selecting invalid altsetting 3 [ 399.506612][ T5643] comedi comedi5: could not set alternate setting 3 in high speed [ 399.506631][ T5643] usbdux 3-1:0.0: driver 'usbdux' failed to auto-configure device. [ 399.549359][ T5643] usbdux 3-1:0.0: probe with driver usbdux failed with error -22 [ 399.570754][T10426] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 399.585334][T10426] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 399.607568][ T2246] usb 2-1: USB disconnect, device number 46 [ 399.680199][ T5643] usb 3-1: USB disconnect, device number 49 [ 399.728713][T10426] team0: Port device team_slave_0 added [ 399.733712][T10426] team0: Port device team_slave_1 added [ 399.802954][T10426] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.802971][T10426] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 399.802996][T10426] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.844517][T10426] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 399.844537][T10426] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 399.845146][T10426] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 399.896139][ T5706] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 400.022698][T10426] hsr_slave_0: entered promiscuous mode [ 400.023745][T10426] hsr_slave_1: entered promiscuous mode [ 400.024518][T10426] debugfs: 'hsr0' already exists in 'hsr' [ 400.024535][T10426] Cannot create hsr debugfs directory [ 400.055733][ T5706] usb 5-1: unable to get BOS descriptor or descriptor too short [ 400.055787][ T5706] usb 5-1: New USB device found: idVendor=2c7c, idProduct=030a, bcdDevice=cf.d0 [ 400.058762][ T5706] usb 5-1: config 114 has an invalid interface number: 49 but max is 0 [ 400.058789][ T5706] usb 5-1: config 114 has no interface number 0 [ 400.058846][ T5706] usb 5-1: config 114 interface 49 altsetting 232 bulk endpoint 0x2 has invalid maxpacket 1023 [ 400.058873][ T5706] usb 5-1: config 114 interface 49 altsetting 232 has an endpoint descriptor with address 0xCA, changing to 0x8A [ 400.058900][ T5706] usb 5-1: config 114 interface 49 altsetting 232 bulk endpoint 0x8A has invalid maxpacket 16 [ 400.058925][ T5706] usb 5-1: config 114 interface 49 has no altsetting 0 [ 400.064766][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.064795][ T5706] usb 5-1: Product: syz [ 400.064811][ T5706] usb 5-1: Manufacturer: syz [ 400.064828][ T5706] usb 5-1: SerialNumber: syz [ 400.102673][T10450] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 400.128835][T10450] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 400.411015][T10450] xt_recent: Unsupported userspace flags (000000c5) [ 400.430839][ T5706] option 5-1:114.49: GSM modem (1-port) converter detected [ 400.471238][ T5706] usb 5-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 400.502873][ T5706] usb 5-1: USB disconnect, device number 34 [ 400.542266][ T5706] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 400.543918][ T5706] option 5-1:114.49: device disconnected [ 400.563125][ T9263] udevd[9263]: setting mode of /dev/bus/usb/005/034 to 020664 failed: No such file or directory [ 400.566541][ T9263] udevd[9263]: setting owner of /dev/bus/usb/005/034 to uid=0, gid=0 failed: No such file or directory [ 400.684523][T10490] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1512'. [ 400.890882][ T7929] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 400.918638][T10426] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 400.923328][T10426] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 400.939740][T10426] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 400.956867][T10426] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 400.958176][T10426] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 400.975029][T10426] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 400.978767][T10426] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 400.997633][T10426] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 401.053300][ T7929] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.143787][ T7929] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.186409][T10426] 8021q: adding VLAN 0 to HW filter on device bond0 [ 401.202661][ T992] usb 3-1: new low-speed USB device number 50 using dummy_hcd [ 401.221181][T10426] 8021q: adding VLAN 0 to HW filter on device team0 [ 401.243106][ T7929] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.264522][ T7922] bridge0: port 1(bridge_slave_0) entered blocking state [ 401.264685][ T7922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 401.265768][ T53] Bluetooth: hci5: command tx timeout [ 401.293617][ T5905] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.293696][ T5905] bridge0: port 2(bridge_slave_1) entered forwarding state [ 401.314954][ T2246] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 401.336209][ T992] usb 3-1: device descriptor read/64, error -71 [ 401.457733][ T7929] bridge_slave_1: left allmulticast mode [ 401.457763][ T7929] bridge_slave_1: left promiscuous mode [ 401.460845][ T7929] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.465600][ T2246] usb 5-1: New USB device found: idVendor=054c, idProduct=09cc, bcdDevice=0.00 [ 401.481075][ T2246] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 401.481178][ T2246] usb 5-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 401.481443][ T2246] usb 5-1: config 0 interface 0 has no altsetting 0 [ 401.481600][ T2246] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.495926][ T7929] bridge_slave_0: left allmulticast mode [ 401.495957][ T7929] bridge_slave_0: left promiscuous mode [ 401.497994][ T7929] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.507848][ T2246] usb 5-1: config 0 descriptor?? [ 401.594788][ T992] usb 3-1: new low-speed USB device number 51 using dummy_hcd [ 401.724763][ T992] usb 3-1: device descriptor read/64, error -71 [ 401.835134][ T992] usb usb3-port1: attempt power cycle [ 401.865941][ T7929] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 401.871305][ T7929] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 401.881006][ T7929] bond0 (unregistering): Released all slaves [ 401.991222][T10509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 401.993103][T10509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.034458][T10426] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 402.132409][ T2246] playstation 0003:054C:09CC.001F: hidraw0: USB HID v36.2c Joystick [HID 054c:09cc] on usb-dummy_hcd.4-1/input0 [ 402.174989][ T992] usb 3-1: new low-speed USB device number 52 using dummy_hcd [ 402.200589][ T992] usb 3-1: device descriptor read/8, error -71 [ 402.216273][ T10] asus 0005:0B05:8502.001E: hidraw1: BLUETOOTH HID v0.00 Mouse [syz0] on syz1 [ 402.372860][ T2246] playstation 0003:054C:09CC.001F: Failed to retrieve feature with reportID 18: -71 [ 402.372884][ T2246] playstation 0003:054C:09CC.001F: Failed to retrieve DualShock4 pairing info: -71 [ 402.372920][ T2246] playstation 0003:054C:09CC.001F: Failed to get MAC address from DualShock4 [ 402.372931][ T2246] playstation 0003:054C:09CC.001F: Failed to create dualshock4. [ 402.398499][ T2246] playstation 0003:054C:09CC.001F: probe with driver playstation failed with error -71 [ 402.464932][ T2246] usb 5-1: USB disconnect, device number 35 [ 402.484758][ T992] usb 3-1: new low-speed USB device number 53 using dummy_hcd [ 402.505258][ T992] usb 3-1: device descriptor read/8, error -71 [ 402.550447][T10521] fido_id[10521]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 402.605787][T10522] fido_id[10522]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 402.626540][ T992] usb usb3-port1: unable to enumerate USB device [ 402.691631][T10426] veth0_vlan: entered promiscuous mode [ 402.755318][ T7929] hsr_slave_0: left promiscuous mode [ 402.758434][ T7929] hsr_slave_1: left promiscuous mode [ 402.760845][ T7929] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 402.760900][ T7929] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 402.764224][ T7929] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 402.764247][ T7929] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 402.822843][ T7929] veth1_macvtap: left promiscuous mode [ 402.823186][ T7929] veth0_macvtap: left promiscuous mode [ 402.823297][ T7929] veth1_vlan: left promiscuous mode [ 402.823683][ T7929] veth0_vlan: left promiscuous mode [ 403.131742][ T2246] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 403.289926][ T2246] usb 2-1: Using ep0 maxpacket: 32 [ 403.301496][ T2246] usb 2-1: unable to get BOS descriptor or descriptor too short [ 403.301563][ T2246] usb 2-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 403.302774][ T2246] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 403.302800][ T2246] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 403.335355][ T2246] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.335430][ T2246] usb 2-1: Product: syz [ 403.335472][ T2246] usb 2-1: Manufacturer: syz [ 403.335513][ T2246] usb 2-1: SerialNumber: syz [ 403.359164][ T53] Bluetooth: hci5: command tx timeout [ 403.401916][ T2246] usb 2-1: selecting invalid altsetting 1 [ 403.628226][T10527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.628686][T10527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.681129][T10527] netlink: ct family unspecified [ 403.756195][ T7929] team0 (unregistering): Port device team_slave_1 removed [ 403.757205][T10547] fuse: Bad value for 'rootmode' [ 403.792770][T10547] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1520'. [ 403.814007][ T7929] team0 (unregistering): Port device team_slave_0 removed [ 404.252557][T10426] veth1_vlan: entered promiscuous mode [ 404.405023][ T5297] 8021q: adding VLAN 0 to HW filter on device eth5 [ 404.412276][ T2246] usb 2-1: 6:0: failed to get current value for ch 0 (-71) [ 404.488721][T10564] loop5: detected capacity change from 0 to 7 [ 404.493798][T10564] Dev loop5: unable to read RDB block 7 [ 404.493846][T10564] loop5: unable to read partition table [ 404.494060][T10564] loop5: partition table beyond EOD, truncated [ 404.494099][T10564] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 404.638349][T10426] veth0_macvtap: entered promiscuous mode [ 404.663620][T10426] veth1_macvtap: entered promiscuous mode [ 404.699341][T10426] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 404.730118][T10426] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 404.793442][ T162] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.793775][ T162] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.793818][ T162] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.793857][ T162] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.858553][ T2246] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 404.895013][ T2246] usb 2-1: USB disconnect, device number 47 [ 405.008629][ T9263] udevd[9263]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 405.188690][T10584] netlink: 'syz.2.1530': attribute type 10 has an invalid length. [ 405.235903][T10584] team0: Port device dummy0 removed [ 405.345969][ T7929] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.345994][ T7929] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.419052][T10592] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1532'. [ 405.425432][ T53] Bluetooth: hci5: command tx timeout [ 405.518749][ T162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.518773][ T162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.831041][T10603] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1535'. [ 405.916045][T10607] netlink: 'syz.0.1536': attribute type 12 has an invalid length. [ 405.916069][T10607] netlink: 'syz.0.1536': attribute type 29 has an invalid length. [ 405.916083][T10607] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1536'. [ 405.916118][T10607] netlink: 59 bytes leftover after parsing attributes in process `syz.0.1536'. [ 406.019122][T10607] loop9: detected capacity change from 0 to 7 [ 406.020633][ C0] blk_print_req_error: 10 callbacks suppressed [ 406.020654][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.020755][ C0] buffer_io_error: 10 callbacks suppressed [ 406.020770][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.022135][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.022206][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.027292][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.027506][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.028813][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.029003][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.033430][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.033714][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.039800][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.039984][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.040867][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.041072][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.042356][T10607] ldm_validate_partition_table(): Disk read failed. [ 406.044520][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.044787][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.047276][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.047347][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.052399][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 406.052677][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 406.053606][T10607] Dev loop9: unable to read RDB block 0 [ 406.063830][T10607] loop9: unable to read partition table [ 406.064060][T10607] loop9: partition table beyond EOD, truncated [ 406.064102][T10607] loop_reread_partitions: partition scan of loop9 (úù) failed (rc=-5) [ 406.554680][ T5721] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 406.644147][ T5297] 8021q: adding VLAN 0 to HW filter on device eth6 [ 406.705612][ T5721] usb 5-1: Using ep0 maxpacket: 16 [ 406.706359][ T5721] usb 5-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=0.40 [ 406.707688][ T5721] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 406.707713][ T5721] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 406.714753][ T5721] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.714778][ T5721] usb 5-1: Product: syz [ 406.714793][ T5721] usb 5-1: Manufacturer: syz [ 406.714808][ T5721] usb 5-1: SerialNumber: syz [ 406.780568][ T5721] usb 5-1: 0:2 : does not exist [ 406.837769][ T2246] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 406.966570][ T2246] usb 3-1: device descriptor read/64, error -71 [ 407.009500][ T5721] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 407.087344][ T5721] usb 5-1: USB disconnect, device number 36 [ 407.195098][ T9263] udevd[9263]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 407.226371][ T2246] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 407.245961][T10641] fuse: Unknown parameter 'user_i00000000000000000000' [ 407.364713][ T2246] usb 3-1: device descriptor read/64, error -71 [ 407.475557][ T2246] usb usb3-port1: attempt power cycle [ 407.735130][ T5297] 8021q: adding VLAN 0 to HW filter on device eth7 [ 407.815751][ T2246] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 407.835451][ T2246] usb 3-1: device descriptor read/8, error -71 [ 408.076757][ T2246] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 408.111753][ T2246] usb 3-1: device descriptor read/8, error -71 [ 408.215309][ T2246] usb usb3-port1: unable to enumerate USB device [ 409.376029][ T5297] 8021q: adding VLAN 0 to HW filter on device eth8 [ 409.437378][T10715] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1558'. [ 409.469027][T10710] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 409.522406][T10721] sch_tbf: burst 25 is lower than device ip6gre0 mtu (1448) ! [ 409.922650][T10732] bridge_slave_0: left allmulticast mode [ 409.922682][T10732] bridge_slave_0: left promiscuous mode [ 409.922923][T10732] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.988429][T10732] bridge_slave_1: left allmulticast mode [ 409.988460][T10732] bridge_slave_1: left promiscuous mode [ 409.988689][T10732] bridge0: port 2(bridge_slave_1) entered disabled state [ 410.087628][T10732] bond0: (slave bond_slave_0): Releasing backup interface [ 410.148636][T10732] bond0: (slave bond_slave_1): Releasing backup interface [ 410.217218][T10732] team0: Port device team_slave_0 removed [ 410.266051][T10732] team0: Port device team_slave_1 removed [ 410.270758][T10732] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 410.270776][T10732] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 410.301141][T10732] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 410.301167][T10732] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 410.335266][T10732] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 411.143807][T10770] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1575'. [ 411.207556][T10768] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 411.330635][T10779] xt_hashlimit: size too large, truncated to 1048576 [ 411.436299][T10787] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1579'. [ 411.535316][ T5698] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 411.571143][T10791] Cannot find set identified by id 0 to match [ 411.686095][ T5698] usb 3-1: New USB device found: idVendor=0a12, idProduct=0001, bcdDevice=0.00 [ 411.687354][ T5698] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 411.687379][ T5698] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 411.689827][ T5698] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.689851][ T5698] usb 3-1: Product: syz [ 411.689879][ T5698] usb 3-1: Manufacturer: syz [ 411.689891][ T5698] usb 3-1: SerialNumber: syz [ 411.851074][T10796] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1583'. [ 411.884675][ T1231] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 411.925751][T10798] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1584'. [ 411.964214][ T5698] usb 3-1: USB disconnect, device number 58 [ 411.975673][ T53] Bluetooth: hci3: CSR: Local version failed (-71) [ 412.056240][ T1231] usb 7-1: unable to get BOS descriptor or descriptor too short [ 412.058168][ T1231] usb 7-1: not running at top speed; connect to a high speed hub [ 412.058203][ T1231] usb 7-1: New USB device found: idVendor=13b1, idProduct=0042, bcdDevice=f5.e4 [ 412.059296][ T1231] usb 7-1: config 5 has an invalid interface number: 246 but max is 0 [ 412.059329][ T1231] usb 7-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 412.059348][ T1231] usb 7-1: config 5 has no interface number 0 [ 412.059387][ T1231] usb 7-1: config 5 interface 246 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 412.059414][ T1231] usb 7-1: config 5 interface 246 has no altsetting 0 [ 412.061666][ T1231] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.061691][ T1231] usb 7-1: Product: syz [ 412.061707][ T1231] usb 7-1: Manufacturer: syz [ 412.061722][ T1231] usb 7-1: SerialNumber: syz [ 412.214245][T10804] netlink: 9 bytes leftover after parsing attributes in process `syz.4.1586'. [ 412.226812][T10804] 0ªî{X¹¦: entered promiscuous mode [ 412.226837][T10804] 0ªî{X¹¦: left allmulticast mode [ 412.246389][T10804] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1586'. [ 412.246505][T10804] 1ªî{X¹¦: renamed from 30ªî{X¹¦ [ 412.249474][T10804] 1ªî{X¹¦: left promiscuous mode [ 412.249520][T10804] 1ªî{X¹¦: entered allmulticast mode [ 412.301969][T10789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.303426][T10789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.366693][ T1231] usb 7-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 412.370718][ T5913] usb 7-1: Failed to submit usb control message: -71 [ 412.370758][ T5913] usb 7-1: unable to send the bmi data to the device: -71 [ 412.370776][ T5913] usb 7-1: unable to get target info from device [ 412.370808][ T5913] usb 7-1: could not get target info (-71) [ 412.374229][ T1231] usb 7-1: USB disconnect, device number 2 [ 412.376289][ T5913] usb 7-1: could not probe fw (-71) [ 412.786168][T10826] bond2 (unregistering): Released all slaves [ 412.845636][T10828] loop0: detected capacity change from 0 to 3904 [ 413.002766][T10826] netlink: 'syz.2.1590': attribute type 25 has an invalid length. [ 413.411199][T10838] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1593'. [ 413.411279][T10838] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1593'. [ 413.515740][T10840] loop5: detected capacity change from 0 to 7 [ 413.520599][T10840] loop5: p1 p3 p4 [ 413.520632][T10840] loop5: partition table partially beyond EOD, truncated [ 413.531127][T10840] loop5: p3 size 3645588866 extends beyond EOD, truncated [ 413.710918][ T7433] udevd[7433]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 413.731833][ T7584] udevd[7584]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory [ 413.731984][ T9263] udevd[9263]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 413.803455][T10847] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1597'. [ 414.244782][ T1231] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 414.408413][ T1231] usb 2-1: New USB device found: idVendor=1d50, idProduct=614d, bcdDevice=1.00 [ 414.411527][ T1231] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 414.411582][ T1231] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 414.411605][ T1231] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 414.411630][ T1231] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 414.411675][ T1231] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.909851][T10829] netlink: 'syz.1.1589': attribute type 6 has an invalid length. [ 414.987326][ T1231] gud 2-1:1.0: probe with driver gud failed with error -71 [ 415.019989][ T1231] usb 2-1: USB disconnect, device number 48 [ 415.077852][ T31] kauditd_printk_skb: 19 callbacks suppressed [ 415.077877][ T31] audit: type=1800 audit(1794056740.745:1670): pid=10865 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1602" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=-22 [ 415.318054][T10879] netlink: 'syz.0.1608': attribute type 1 has an invalid length. [ 415.318073][T10879] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1608'. [ 415.495098][ T5643] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 415.614323][T10889] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1611'. [ 415.642026][T10889] netlink: 128 bytes leftover after parsing attributes in process `syz.6.1611'. [ 415.642054][T10889] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 415.653812][ T5643] usb 5-1: Using ep0 maxpacket: 8 [ 415.670447][ T5643] usb 5-1: New USB device found: idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 415.686137][T10889] kAFS: unable to lookup cell '(G|' [ 415.692983][T10889] ip_tables: iptables: counters copy to user failed while replacing table [ 415.712519][ T5643] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.712553][ T5643] usb 5-1: Product: syz [ 415.712569][ T5643] usb 5-1: Manufacturer: syz [ 415.712585][ T5643] usb 5-1: SerialNumber: syz [ 415.741516][ T5643] usb 5-1: config 0 descriptor?? [ 415.754423][ T5643] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 416.144157][ T5643] gspca_sonixj: reg_r err -32 [ 416.144250][ T5643] sonixj 5-1:0.0: probe with driver sonixj failed with error -32 [ 418.221907][T10914] netlink: 288 bytes leftover after parsing attributes in process `syz.2.1618'. [ 418.309244][ T5698] usb 5-1: USB disconnect, device number 37 [ 418.524846][ T5643] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 418.678854][ T5643] usb 3-1: New USB device found: idVendor=056a, idProduct=0331, bcdDevice=1.00 [ 418.682342][ T5643] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 418.682377][ T5643] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 418.682418][ T5643] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.728323][ T5643] usb 3-1: config 0 descriptor?? [ 418.756470][ T5698] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 418.904891][ T5698] usb 5-1: Using ep0 maxpacket: 16 [ 418.905872][ T5698] usb 5-1: New USB device found: idVendor=0c70, idProduct=f00d, bcdDevice=0.00 [ 418.907448][ T5698] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 418.907513][ T5698] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.913520][ T5698] usb 5-1: config 0 descriptor?? [ 418.914403][T10925] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 419.105175][ T5640] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 419.105241][ T5640] Bluetooth: hci2: Injecting HCI hardware error event [ 419.109938][ T53] Bluetooth: hci2: hardware error 0x00 [ 419.189106][ T5643] wacom 0003:056A:0331.0020: ignoring exceeding usage max [ 419.192906][ T5643] wacom 0003:056A:0331.0020: unknown main item tag 0x0 [ 419.192949][ T5643] wacom 0003:056A:0331.0020: unknown main item tag 0x0 [ 419.192982][ T5643] wacom 0003:056A:0331.0020: unknown main item tag 0x0 [ 419.193079][ T5643] wacom 0003:056A:0331.0020: item 0 4 0 8 parsing failed [ 419.194508][ T5643] wacom 0003:056A:0331.0020: parse failed [ 419.238979][ T5643] wacom 0003:056A:0331.0020: probe with driver wacom failed with error -22 [ 419.383425][T10947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.399299][T10947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.647090][T10953] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1630'. [ 419.689646][T10953] netdevsim netdevsim6 netdevsim0: entered promiscuous mode [ 419.713878][T10953] netdevsim netdevsim6 netdevsim0: left promiscuous mode [ 419.804785][ T5698] usbhid 5-1:0.0: can't add hid device: -71 [ 419.804870][ T5698] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 419.861118][ T5698] usb 5-1: USB disconnect, device number 38 [ 420.914762][ T992] usb 2-1: new low-speed USB device number 49 using dummy_hcd [ 421.065710][ T992] usb 2-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 421.067775][ T992] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 421.067803][ T992] usb 2-1: config 0 has no interface number 0 [ 421.067843][ T992] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 421.067867][ T992] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 421.067894][ T992] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 421.067919][ T992] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 421.067944][ T992] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 421.067970][ T992] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 421.068010][ T992] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.071673][ T992] usb 2-1: config 0 descriptor?? [ 421.073421][T10969] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 421.073522][T10969] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 421.186240][ T53] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 421.214910][ T992] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 421.344828][ T5643] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 421.359884][ T992] usb 3-1: USB disconnect, device number 59 [ 421.433918][T10984] FAULT_INJECTION: forcing a failure. [ 421.433918][T10984] name failslab, interval 1, probability 0, space 0, times 0 [ 421.433945][T10984] CPU: 0 UID: 0 PID: 10984 Comm: syz.6.1639 Tainted: G L syzkaller #0 PREEMPT(full) [ 421.433968][T10984] Tainted: [L]=SOFTLOCKUP [ 421.433974][T10984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 421.433984][T10984] Call Trace: [ 421.433989][T10984] [ 421.433996][T10984] dump_stack_lvl+0xe8/0x150 [ 421.434026][T10984] should_fail_ex+0x3eb/0x540 [ 421.434048][T10984] should_failslab+0xa8/0x100 [ 421.434075][T10984] __kmalloc_cache_noprof+0x9e/0x600 [ 421.434103][T10984] ? __pollwait+0x27f/0x430 [ 421.434117][T10984] ? __pollwait+0x27f/0x430 [ 421.434137][T10984] __pollwait+0x27f/0x430 [ 421.434153][T10984] ? __pfx___pollwait+0x10/0x10 [ 421.434169][T10984] pipe_poll+0x20f/0x570 [ 421.434184][T10984] ? __pfx_pipe_poll+0x10/0x10 [ 421.434198][T10984] do_sys_poll+0x98f/0x1150 [ 421.434219][T10984] ? do_sys_poll+0x4c1/0x1150 [ 421.434242][T10984] ? __pfx_do_sys_poll+0x10/0x10 [ 421.434264][T10984] ? lock_acquire+0x115/0x350 [ 421.434283][T10984] ? __pfx___pollwait+0x10/0x10 [ 421.434302][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434321][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434340][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434359][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434379][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434398][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434417][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434436][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434455][T10984] ? __pfx_pollwake+0x10/0x10 [ 421.434500][T10984] ? set_user_sigmask+0xc6/0x230 [ 421.434522][T10984] ? __pfx_set_user_sigmask+0x10/0x10 [ 421.434544][T10984] ? kmem_cache_free+0x182/0x650 [ 421.434609][T10984] __se_sys_ppoll+0x209/0x2b0 [ 421.434642][T10984] ? __pfx___se_sys_ppoll+0x10/0x10 [ 421.434659][T10984] ? __pfx_ksys_write+0x10/0x10 [ 421.434686][T10984] ? __x64_sys_ppoll+0x20/0xc0 [ 421.434704][T10984] do_syscall_64+0x166/0x520 [ 421.434723][T10984] ? trace_irq_disable+0x3b/0x140 [ 421.434744][T10984] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.434759][T10984] ? clear_bhb_loop+0x70/0xc0 [ 421.434778][T10984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.434792][T10984] RIP: 0033:0x7fbdf399fb19 [ 421.434806][T10984] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.434819][T10984] RSP: 002b:00007fbdf492c028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 421.434834][T10984] RAX: ffffffffffffffda RBX: 00007fbdf3c25fa0 RCX: 00007fbdf399fb19 [ 421.434845][T10984] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 421.434856][T10984] RBP: 00007fbdf492c090 R08: 00000000ffffff0f R09: 0000000000000000 [ 421.434865][T10984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 421.434875][T10984] R13: 00007fbdf3c26038 R14: 00007fbdf3c25fa0 R15: 00007fbdf3d4fa48 [ 421.434899][T10984] [ 421.593675][ T5643] usb 5-1: New USB device found: idVendor=1e7d, idProduct=2d50, bcdDevice=0.00 [ 421.773169][ T5643] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 246, changing to 11 [ 421.773207][ T5643] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 421.773254][ T5643] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.822775][ T5643] usb 5-1: config 0 descriptor?? [ 422.259694][ T5643] kovaplus 0003:1E7D:2D50.0021: unknown main item tag 0x0 [ 422.259726][ T5643] kovaplus 0003:1E7D:2D50.0021: unknown main item tag 0x0 [ 422.263256][ T5643] kovaplus 0003:1E7D:2D50.0021: unknown main item tag 0x0 [ 422.263293][ T5643] kovaplus 0003:1E7D:2D50.0021: unknown main item tag 0x0 [ 422.263335][ T5643] kovaplus 0003:1E7D:2D50.0021: unknown main item tag 0x0 [ 422.263364][ T5643] kovaplus 0003:1E7D:2D50.0021: unknown main item tag 0x0 [ 422.263393][ T5643] kovaplus 0003:1E7D:2D50.0021: unknown main item tag 0x0 [ 422.335853][ T5643] kovaplus 0003:1E7D:2D50.0021: hidraw0: USB HID v7f.fd Device [HID 1e7d:2d50] on usb-dummy_hcd.4-1/input0 [ 422.614827][ T31] audit: type=1326 audit(1794056748.295:1671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10998 comm="syz.2.1642" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faecf39fb19 code=0x0 [ 422.730875][T11000] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1642'. [ 422.730902][T11000] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 422.760951][T11000] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 423.926560][T11010] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1644'. [ 423.926590][T11010] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1644'. [ 423.980742][T11010] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1644'. [ 424.014012][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-1) [ 424.021554][T11015] FAULT_INJECTION: forcing a failure. [ 424.021554][T11015] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 424.021606][T11015] CPU: 0 UID: 0 PID: 11015 Comm: syz.2.1645 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.021634][T11015] Tainted: [L]=SOFTLOCKUP [ 424.021643][T11015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 424.021661][T11015] Call Trace: [ 424.021669][T11015] [ 424.021679][T11015] dump_stack_lvl+0xe8/0x150 [ 424.021718][T11015] should_fail_ex+0x3eb/0x540 [ 424.021751][T11015] _copy_from_user+0x2d/0xb0 [ 424.021781][T11015] generic_map_update_batch+0x6b1/0xad0 [ 424.021826][T11015] ? __pfx_generic_map_update_batch+0x10/0x10 [ 424.021870][T11015] ? __fget_files+0x3a2/0x420 [ 424.021898][T11015] ? __fget_files+0x2a/0x420 [ 424.021928][T11015] ? fdget+0x1ac/0x250 [ 424.021955][T11015] ? __pfx_generic_map_update_batch+0x10/0x10 [ 424.021984][T11015] bpf_map_do_batch+0x391/0x630 [ 424.022031][T11015] __sys_bpf+0x977/0xe00 [ 424.022063][T11015] ? __pfx___sys_bpf+0x10/0x10 [ 424.022095][T11015] ? __fget_files+0x2a/0x420 [ 424.022143][T11015] ? ksys_write+0x242/0x270 [ 424.022178][T11015] ? __pfx_ksys_write+0x10/0x10 [ 424.022215][T11015] __x64_sys_bpf+0xba/0xd0 [ 424.022251][T11015] do_syscall_64+0x166/0x520 [ 424.022281][T11015] ? trace_irq_disable+0x3b/0x140 [ 424.022312][T11015] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.022335][T11015] ? clear_bhb_loop+0x70/0xc0 [ 424.022361][T11015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.022390][ T5721] usb 2-1: USB disconnect, device number 49 [ 424.022391][T11015] RIP: 0033:0x7faecf39fb19 [ 424.022413][T11015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 424.022432][T11015] RSP: 002b:00007faed02ea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 424.022454][T11015] RAX: ffffffffffffffda RBX: 00007faecf625fa0 RCX: 00007faecf39fb19 [ 424.022470][T11015] RDX: 0000000000000038 RSI: 00002000000000c0 RDI: 000000000000001a [ 424.022484][T11015] RBP: 00007faed02ea090 R08: 0000000000000000 R09: 0000000000000000 [ 424.022498][T11015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 424.022510][T11015] R13: 00007faecf626038 R14: 00007faecf625fa0 R15: 00007faecf74fa48 [ 424.022545][T11015] [ 424.280489][ T5721] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 424.681479][T11021] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1646'. [ 424.918081][T11029] warning: `syz.1.1649' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 425.199744][ T992] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 425.292607][T11036] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 425.365323][ T992] usb 2-1: Using ep0 maxpacket: 8 [ 425.367022][ T992] usb 2-1: New USB device found: idVendor=077d, idProduct=627a, bcdDevice=0.10 [ 425.369526][ T992] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 425.369557][ T992] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB3, changing to 0x83 [ 425.369611][ T992] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 425.374043][ T992] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.374071][ T992] usb 2-1: Product: syz [ 425.374087][ T992] usb 2-1: Manufacturer: syz [ 425.374129][ T992] usb 2-1: SerialNumber: syz [ 425.455511][ T992] usb 2-1: config 0 descriptor?? [ 425.476970][ T992] radioshark2 2-1:0.0: Invalid radioSHARK2 device [ 425.476999][ T992] radioshark2 2-1:0.0: probe with driver radioshark2 failed with error -22 [ 425.477442][ T992] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 425.668708][ T30] usb 2-1: USB disconnect, device number 50 [ 426.967642][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.004724][ T30] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 427.041741][T11067] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 427.083394][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.120238][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.153311][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.165228][ T30] usb 3-1: New USB device found: idVendor=04d8, idProduct=0082, bcdDevice=1.00 [ 427.169626][ T30] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 427.169700][ T30] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 1024 [ 427.169889][ T30] usb 3-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 427.169916][ T30] usb 3-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 255 [ 427.169984][ T30] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.245931][T11057] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 427.283223][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.439645][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.510149][ T5643] kovaplus 0003:1E7D:2D50.0021: couldn't init struct kovaplus_device [ 427.510320][ T5643] kovaplus 0003:1E7D:2D50.0021: couldn't install mouse [ 427.537262][ T5643] kovaplus 0003:1E7D:2D50.0021: probe with driver kovaplus failed with error -32 [ 427.555092][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.600085][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.629967][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.682286][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 427.691226][ T5698] usb 5-1: USB disconnect, device number 39 [ 427.859359][ T30] ims_pcu 3-1:1.0: GET_INFO command failed, error: -71 [ 427.861223][ T30] ims_pcu 3-1:1.0: probe with driver ims_pcu failed with error -71 [ 427.902230][T11066] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 428.063336][ T5698] usb 3-1: USB disconnect, device number 60 [ 428.488847][ T2246] usb 5-1: new low-speed USB device number 40 using dummy_hcd [ 428.635524][ T2246] usb 5-1: New USB device found: idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 428.641751][ T2246] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 428.641781][ T2246] usb 5-1: config 0 has no interface number 0 [ 428.641822][ T2246] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 428.641845][ T2246] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 428.641873][ T2246] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 428.641900][ T2246] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 428.641926][ T2246] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 428.641953][ T2246] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 428.642006][ T2246] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.752953][ T2246] usb 5-1: config 0 descriptor?? [ 428.753955][T11087] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 428.754086][T11087] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 428.781397][ T2246] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 429.136250][ T2246] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 429.200185][T11106] vivid-002: ================= START STATUS ================= [ 429.200286][T11106] vivid-002: Radio HW Seek Mode: Bounded [ 429.200334][T11106] vivid-002: Radio Programmable HW Seek: false [ 429.200357][T11106] vivid-002: RDS Rx I/O Mode: Block I/O [ 429.200379][T11106] vivid-002: Generate RBDS Instead of RDS: false [ 429.200487][T11106] vivid-002: RDS Reception: true [ 429.200509][T11106] vivid-002: RDS Program Type: 0 inactive [ 429.200542][T11106] vivid-002: RDS PS Name: inactive [ 429.200566][T11106] vivid-002: RDS Radio Text: inactive [ 429.200590][T11106] vivid-002: RDS Traffic Announcement: false inactive [ 429.200694][T11106] vivid-002: RDS Traffic Program: false inactive [ 429.200719][T11106] vivid-002: RDS Music: false inactive [ 429.200743][T11106] vivid-002: ================== END STATUS ================== [ 429.336996][ T2246] usb 7-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 429.340760][ T2246] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 429.340794][ T2246] usb 7-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 429.398692][ T2246] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.398724][ T2246] usb 7-1: Product: syz [ 429.398739][ T2246] usb 7-1: Manufacturer: syz [ 429.398833][ T2246] usb 7-1: SerialNumber: syz [ 429.469305][ T2246] cdc_mbim 7-1:1.0: skipping garbage [ 429.739597][T11099] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 430.102466][T11118] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 430.478412][ T5698] usb 5-1: USB disconnect, device number 40 [ 430.500506][ T5698] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 430.580385][T11123] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 430.580967][ T2246] cdc_mbim 7-1:1.0: setting tx_max = 16384 [ 430.606235][ T2246] cdc_mbim 7-1:1.0: cdc-wdm0: USB WDM device [ 430.612056][ T2246] wwan wwan0: port wwan0mbim0 attached [ 430.684339][ T2246] cdc_mbim 7-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.6-1, CDC MBIM, 12:c7:9e:40:45:c8 [ 430.827898][ C0] wdm_int_callback: 12 callbacks suppressed [ 430.827927][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.827950][ C0] wdm_int_callback: 12 callbacks suppressed [ 430.827970][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.828240][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.828269][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.828477][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.828498][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.828702][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.828723][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.828930][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.828950][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.829154][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.829174][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.829397][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.829418][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.829657][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.829677][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.829908][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.829929][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 430.830160][ C0] cdc_mbim 7-1:1.0: nonzero urb status received: -71 [ 430.830184][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - 0 bytes [ 432.040775][ C0] cdc_mbim 7-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 432.064303][ T2246] usb 7-1: USB disconnect, device number 3 [ 432.071649][ T2246] cdc_mbim 7-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.6-1, CDC MBIM [ 432.198492][ T2246] wwan wwan0: port wwan0mbim0 disconnected [ 432.377761][T11138] netdevsim netdevsim4 : renamed from netdevsim0 (while UP) [ 432.794072][T11153] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1673'. [ 433.017265][T11159] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1677'. [ 433.017322][T11159] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1677'. [ 433.096142][T11162] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1675'. [ 433.250998][T11162] bond1: entered promiscuous mode [ 433.259025][T11162] 8021q: adding VLAN 0 to HW filter on device bond1 [ 433.282935][T11169] input: syz0 as /devices/virtual/input/input35 [ 433.635535][ T1231] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 433.785318][ T1231] usb 5-1: Using ep0 maxpacket: 16 [ 433.791579][ T1231] usb 5-1: New USB device found: idVendor=1e7d, idProduct=2c2e, bcdDevice=0.00 [ 433.804383][ T1231] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 433.804421][ T1231] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.830104][ T1231] usb 5-1: config 0 descriptor?? [ 434.333843][ T1231] lua 0003:1E7D:2C2E.0022: item fetching failed at offset 0/38 [ 434.346049][ T1231] lua 0003:1E7D:2C2E.0022: parse failed [ 434.346128][ T1231] lua 0003:1E7D:2C2E.0022: probe with driver lua failed with error -22 [ 434.539268][T11199] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.539587][T11199] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.341091][T11223] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 435.565542][ T2246] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 435.718221][ T2246] usb 2-1: New USB device found: idVendor=1199, idProduct=68a3, bcdDevice=0.00 [ 435.723394][ T2246] usb 2-1: config 1 has an invalid interface number: 7 but max is 0 [ 435.723419][ T2246] usb 2-1: config 1 has no interface number 0 [ 435.723447][ T2246] usb 2-1: config 1 interface 7 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 435.723462][ T2246] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 435.723480][ T2246] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0xA has an invalid bInterval 128, changing to 11 [ 435.792048][ T2246] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.792071][ T2246] usb 2-1: Product: syz [ 435.792082][ T2246] usb 2-1: Manufacturer: syz [ 435.792092][ T2246] usb 2-1: SerialNumber: syz [ 435.825246][T11224] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 435.825400][T11224] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 435.835120][ T2246] usb 2-1: Expected 3 endpoints, found: 2 [ 436.456478][ T2246] usb 5-1: USB disconnect, device number 41 [ 436.619171][T11241] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1695'. [ 436.876020][T11246] tipc: Started in network mode [ 436.876071][T11246] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 436.876988][T11246] tipc: Enabled bearer , priority 0 [ 437.368196][T11264] FAULT_INJECTION: forcing a failure. [ 437.368196][T11264] name failslab, interval 1, probability 0, space 0, times 0 [ 437.368233][T11264] CPU: 1 UID: 0 PID: 11264 Comm: syz.2.1704 Tainted: G L syzkaller #0 PREEMPT(full) [ 437.368263][T11264] Tainted: [L]=SOFTLOCKUP [ 437.368272][T11264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 437.368302][T11264] Call Trace: [ 437.368311][T11264] [ 437.368320][T11264] dump_stack_lvl+0xe8/0x150 [ 437.368360][T11264] should_fail_ex+0x3eb/0x540 [ 437.368394][T11264] should_failslab+0xa8/0x100 [ 437.368430][T11264] __kmalloc_cache_noprof+0x9e/0x600 [ 437.368461][T11264] ? nfnetlink_rcv+0x1021/0x28c0 [ 437.368490][T11264] ? nfnetlink_rcv+0x1021/0x28c0 [ 437.368527][T11264] nfnetlink_rcv+0x1021/0x28c0 [ 437.368594][T11264] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 437.368684][T11264] ? lock_acquire+0x115/0x350 [ 437.368722][T11264] ? netlink_deliver_tap+0x2e/0x1b0 [ 437.368755][T11264] ? netlink_deliver_tap+0x2e/0x1b0 [ 437.368793][T11264] netlink_unicast+0x8ef/0xa80 [ 437.368845][T11264] netlink_sendmsg+0x7f0/0xb20 [ 437.368887][T11264] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.368926][T11264] ? aa_sock_msg_perm+0x144/0x210 [ 437.368968][T11264] ? apparmor_socket_sendmsg+0x98/0x360 [ 437.369003][T11264] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.369037][T11264] sock_sendmsg_nosec+0x14e/0x190 [ 437.369071][T11264] ____sys_sendmsg+0x54e/0x850 [ 437.369103][T11264] ? __pfx_____sys_sendmsg+0x10/0x10 [ 437.369138][T11264] ? import_iovec+0x73/0xa0 [ 437.369171][T11264] ___sys_sendmsg+0x2a5/0x360 [ 437.369194][T11264] ? __lock_acquire+0x747/0x2de0 [ 437.369227][T11264] ? __pfx____sys_sendmsg+0x10/0x10 [ 437.369296][T11264] ? __fget_files+0x3a2/0x420 [ 437.369322][T11264] ? __fget_files+0x2a/0x420 [ 437.369360][T11264] __x64_sys_sendmsg+0x1b1/0x290 [ 437.369387][T11264] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 437.369435][T11264] do_syscall_64+0x166/0x520 [ 437.369462][T11264] ? trace_irq_disable+0x3b/0x140 [ 437.369492][T11264] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.369512][T11264] ? clear_bhb_loop+0x70/0xc0 [ 437.369534][T11264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.369553][T11264] RIP: 0033:0x7faecf39fb19 [ 437.369572][T11264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.369588][T11264] RSP: 002b:00007faed02ea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 437.369608][T11264] RAX: ffffffffffffffda RBX: 00007faecf625fa0 RCX: 00007faecf39fb19 [ 437.369621][T11264] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 437.369633][T11264] RBP: 00007faed02ea090 R08: 0000000000000000 R09: 0000000000000000 [ 437.369643][T11264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.369654][T11264] R13: 00007faecf626038 R14: 00007faecf625fa0 R15: 00007faecf74fa48 [ 437.369684][T11264] [ 437.821132][T11269] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 437.874868][ T2246] tipc: Node number set to 11578026 [ 438.057821][T11276] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1708'. [ 438.382225][ T5643] usb 2-1: USB disconnect, device number 51 [ 438.538759][T11281] netlink: 'syz.4.1710': attribute type 1 has an invalid length. [ 438.614510][T11283] sg_write: data in/out 418780/98 bytes for SCSI command 0x0-- guessing data in; [ 438.614510][T11283] program syz.4.1710 not setting count and/or reply_len properly [ 438.680185][T11286] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 438.711356][T11281] 8021q: adding VLAN 0 to HW filter on device bond3 [ 438.791692][T11281] netlink: 'syz.4.1710': attribute type 1 has an invalid length. [ 438.791991][T11292] sg_write: data in/out 418780/98 bytes for SCSI command 0x0-- guessing data in; [ 438.791991][T11292] program syz.4.1710 not setting count and/or reply_len properly [ 439.287269][T11305] fuse: Unknown parameter 'fd0x0000000000000005' [ 439.647697][T11313] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 440.203401][T11327] openvswitch: netlink: Key type 322 is out of range max 32 [ 440.226770][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.226816][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.738139][T11340] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 441.029872][T11345] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1730'. [ 441.473255][T11352] kvm: pic: non byte write [ 441.768120][T11362] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1735'. [ 441.898779][T11365] netlink: 'syz.0.1735': attribute type 10 has an invalid length. [ 442.429053][T11371] loop5: detected capacity change from 0 to 7 [ 442.446326][T11371] Dev loop5: unable to read RDB block 7 [ 442.446364][T11371] loop5: unable to read partition table [ 442.446503][T11371] loop5: partition table beyond EOD, truncated [ 442.446529][T11371] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 442.698353][T11378] netlink: 'syz.2.1742': attribute type 3 has an invalid length. [ 442.698371][T11378] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1742'. [ 442.698396][T11378] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1742'. [ 442.864429][T11380] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 442.879897][T11382] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1744'. [ 442.920141][T11382] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 442.953100][T11382] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 443.494463][T11396] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 443.545049][ T30] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 443.706498][ T30] usb 3-1: New USB device found: idVendor=05d1, idProduct=2021, bcdDevice=9.00 [ 443.714471][ T30] usb 3-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 443.714494][ T30] usb 3-1: Product: syz [ 443.742723][ T30] usb 3-1: config 0 descriptor?? [ 443.773549][ T30] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 443.786041][ T30] usb 3-1: Detected FT232H [ 443.972348][ T30] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 444.269705][T11394] nvme_rdma: malformed address passed: 172.20.20.24:+ [ 444.611034][ T30] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 444.732498][ T30] usb 3-1: USB disconnect, device number 61 [ 444.816620][ T30] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 444.817421][ T30] ftdi_sio 3-1:0.0: device disconnected [ 445.971719][T11457] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1767'. [ 445.971840][T11457] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 446.052550][T11457] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 446.416498][ T5643] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 446.577778][ T5643] usb 3-1: New USB device found: idVendor=10c4, idProduct=ea90, bcdDevice=0.80 [ 446.580420][ T5643] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 446.580454][ T5643] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 446.580492][ T5643] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.648888][ T5643] usb 3-1: config 0 descriptor?? [ 446.784762][ T5698] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 446.944233][ T5698] usb 5-1: New USB device found: idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 446.958972][ T5698] usb 5-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 446.979298][ T5698] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.979330][ T5698] usb 5-1: Product: syz [ 446.979347][ T5698] usb 5-1: Manufacturer: syz [ 446.979363][ T5698] usb 5-1: SerialNumber: syz [ 447.089629][ T5643] hid_parser_main: 220 callbacks suppressed [ 447.089673][ T5643] cp2112 0003:10C4:EA90.0023: unknown main item tag 0x0 [ 447.089697][ T5643] cp2112 0003:10C4:EA90.0023: unknown main item tag 0x0 [ 447.089736][ T5643] cp2112 0003:10C4:EA90.0023: unknown main item tag 0x0 [ 447.089764][ T5643] cp2112 0003:10C4:EA90.0023: unknown main item tag 0x0 [ 447.089790][ T5643] cp2112 0003:10C4:EA90.0023: unknown main item tag 0x0 [ 447.089821][ T5643] cp2112 0003:10C4:EA90.0023: unknown main item tag 0x0 [ 447.089840][ T5643] cp2112 0003:10C4:EA90.0023: unknown main item tag 0x0 [ 447.139646][ T5643] cp2112 0003:10C4:EA90.0023: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 447.191304][ T5643] cp2112 0003:10C4:EA90.0023: error requesting version [ 447.215433][ T5643] cp2112 0003:10C4:EA90.0023: probe with driver cp2112 failed with error -32 [ 447.273979][ T5698] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 447.274083][ T5698] command write [95] error -22 [ 447.322882][T11477] binfmt_misc: register: failed to install interpreter ./cgroup [ 447.500806][T11482] netlink: 'syz.6.1774': attribute type 16 has an invalid length. [ 447.500836][T11482] netlink: 64138 bytes leftover after parsing attributes in process `syz.6.1774'. [ 447.559169][ T5698] usb 5-1: USB disconnect, device number 42 [ 448.326429][ T62] IPVS: starting estimator thread 0... [ 448.333878][T11502] batadv0: entered promiscuous mode [ 448.425525][T11505] IPVS: using max 33 ests per chain, 79200 per kthread [ 449.372196][ T5698] usb 3-1: USB disconnect, device number 62 [ 450.008655][T11543] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 450.008865][T11543] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 450.045987][T11543] tipc: Enabling of bearer rejected, already enabled [ 451.221029][T11558] set match dimension is over the limit! [ 451.839983][T11568] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 452.095574][ T1231] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 452.200127][T11575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.238836][T11575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.266715][ T1231] usb 7-1: New USB device found: idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 452.268922][ T1231] usb 7-1: config 0 has an invalid interface number: 168 but max is 0 [ 452.268942][ T1231] usb 7-1: config 0 has no interface number 0 [ 452.268962][ T1231] usb 7-1: too many endpoints for config 0 interface 168 altsetting 110: 154, using maximum allowed: 30 [ 452.268989][ T1231] usb 7-1: config 0 interface 168 altsetting 110 has 0 endpoint descriptors, different from the interface descriptor's value: 154 [ 452.269007][ T1231] usb 7-1: config 0 interface 168 has no altsetting 0 [ 452.269031][ T1231] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.343957][ T1231] usb 7-1: config 0 descriptor?? [ 452.434689][ T5643] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 452.596495][ T5643] usb 2-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 452.601424][ T5643] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 452.601459][ T5643] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 452.601490][ T5643] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 452.601535][ T5643] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.665197][ T5643] usb 2-1: config 0 descriptor?? [ 452.694680][ T1231] usb 7-1: string descriptor 0 read error: -32 [ 452.718280][ T1231] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 452.732080][T11569] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 452.887655][ T5643] usbhid 2-1:0.0: can't add hid device: -71 [ 452.887783][ T5643] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 452.909637][ T5643] usb 2-1: USB disconnect, device number 52 [ 453.296978][ T5698] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 453.446090][ T5698] usb 5-1: Using ep0 maxpacket: 8 [ 453.447033][ T5698] usb 5-1: New USB device found: idVendor=07ca, idProduct=a868, bcdDevice=c4.d4 [ 453.451804][ T5698] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.503089][ T5698] usb 5-1: config 0 descriptor?? [ 453.539012][ T5698] dvb-usb: found a 'AVerMedia AVerTVHD Volar (A868R)' in warm state. [ 453.739781][ T5698] dvb-usb: bulk message failed: -22 (1/0) [ 453.766459][ T5698] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 453.771321][ T5698] dvbdev: DVB: registering new adapter (AVerMedia AVerTVHD Volar (A868R)) [ 453.771365][ T5698] usb 5-1: media controller created [ 453.871564][ T5698] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 453.924970][ T5643] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 454.077744][ T5643] usb 3-1: New USB device found: idVendor=5543, idProduct=0064, bcdDevice=0.00 [ 454.080440][ T5643] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 454.080478][ T5643] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.120584][ T5643] usb 3-1: config 0 descriptor?? [ 454.282975][ T5698] DVB: Unable to find symbol lgdt330x_attach() [ 454.282993][ T5698] dvb-usb: no frontend was attached by 'AVerMedia AVerTVHD Volar (A868R)' [ 454.293437][ T5698] dvb-usb: bulk message failed: -22 (1/0) [ 454.293498][ T5698] dvb-usb: AVerMedia AVerTVHD Volar (A868R) successfully initialized and connected. [ 454.352404][ T5698] usb 5-1: USB disconnect, device number 43 [ 454.362551][T11592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.377511][T11592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.762760][ T5698] dvb-usb: AVerMedia AVerTVHD Volar (A868R) successfully deinitialized and disconnected. [ 454.846120][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846161][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846190][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846219][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846246][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846274][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846302][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846330][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846358][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.846386][ T5643] uclogic 0003:5543:0064.0024: unknown main item tag 0x0 [ 454.890995][ T5643] uclogic 0003:5543:0064.0024: unbalanced collection at end of report description [ 454.949887][ T5643] uclogic 0003:5543:0064.0024: parse failed [ 454.949967][ T5643] uclogic 0003:5543:0064.0024: probe with driver uclogic failed with error -22 [ 455.128158][ T5643] usb 7-1: USB disconnect, device number 4 [ 455.204310][T11604] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1812'. [ 455.215102][T11604] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1812'. [ 455.218497][ T31] audit: type=1326 audit(1794056780.895:1672): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11603 comm="syz.0.1812" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe4f979fb19 code=0x0 [ 455.261336][ T5721] usb 3-1: USB disconnect, device number 63 [ 455.313295][T11608] loop5: detected capacity change from 0 to 7 [ 455.323959][T11608] Dev loop5: unable to read RDB block 7 [ 455.324005][T11608] loop5: unable to read partition table [ 455.324214][T11608] loop5: partition table beyond EOD, truncated [ 455.324234][T11608] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 455.431609][T11607] loop3: detected capacity change from 0 to 1 [ 455.487866][T11607] Dev loop3: unable to read RDB block 1 [ 455.487914][T11607] loop3: unable to read partition table [ 455.488118][T11607] loop3: partition table beyond EOD, truncated [ 455.488155][T11607] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 455.593065][T11610] netlink: 'syz.6.1813': attribute type 3 has an invalid length. [ 455.593083][T11610] netlink: 152 bytes leftover after parsing attributes in process `syz.6.1813'. [ 455.593106][T11610] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1813'. [ 455.791205][T11612] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 455.810876][T11612] sch_tbf: burst 6281 is lower than device lo mtu (65550) ! [ 456.132637][T11616] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1815'. [ 456.390905][T11624] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1817'. [ 456.618733][T11631] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 456.802916][T11633] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 456.955716][T11635] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 458.022073][ T31] audit: type=1326 audit(1794056783.695:1673): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.022136][ T31] audit: type=1326 audit(1794056783.695:1674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.078955][ T31] audit: type=1326 audit(1794056783.755:1675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.080629][ T31] audit: type=1326 audit(1794056783.755:1676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.149705][ T31] audit: type=1326 audit(1794056783.815:1677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.149753][ T31] audit: type=1326 audit(1794056783.825:1678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=179 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.149788][ T31] audit: type=1326 audit(1794056783.825:1679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.149823][ T31] audit: type=1326 audit(1794056783.825:1680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.274193][ T31] audit: type=1326 audit(1794056783.945:1681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11653 comm="syz.2.1828" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=443 compat=0 ip=0x7faecf39fb19 code=0x7ffc0000 [ 458.376946][T11657] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1827'. [ 458.382117][T11654] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1828'. [ 459.156740][T11666] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1831'. [ 459.156798][T11666] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1831'. [ 459.724638][ T5721] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 459.876094][ T5721] usb 3-1: New USB device found: idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 459.880829][ T5721] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 459.913609][ T5721] usb 3-1: config 0 descriptor?? [ 459.947367][ T5721] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 461.550666][ T5721] gspca_stv06xx: HDCS-1020 sensor detected [ 461.808343][ T5721] STV06xx 3-1:0.0: probe with driver STV06xx failed with error -71 [ 461.828394][ T5721] usb 3-1: USB disconnect, device number 64 [ 462.182405][T11712] vlan3: entered promiscuous mode [ 462.182424][T11712] macvlan0: entered promiscuous mode [ 462.584899][ T5698] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 462.737947][ T5698] usb 5-1: Using ep0 maxpacket: 8 [ 462.740357][ T5698] usb 5-1: New USB device found: idVendor=0c45, idProduct=8003, bcdDevice=f9.64 [ 462.766832][ T5698] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=67 [ 462.766865][ T5698] usb 5-1: Product: syz [ 462.766881][ T5698] usb 5-1: Manufacturer: syz [ 462.766897][ T5698] usb 5-1: SerialNumber: syz [ 462.820136][ T5698] usb 5-1: config 0 descriptor?? [ 462.857299][ T5698] gspca_main: sn9c2028-2.14.0 probing 0c45:8003 [ 462.954670][ T5721] usb 2-1: new full-speed USB device number 53 using dummy_hcd [ 463.078523][ T5698] gspca_sn9c2028: read1 error -32 [ 463.172867][T11724] __nla_validate_parse: 2 callbacks suppressed [ 463.172887][T11724] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1852'. [ 463.477541][T11716] sch_tbf: burst 12 is lower than device syzkaller0 mtu (1514) ! [ 463.485294][T11716] syzkaller0: entered promiscuous mode [ 463.485318][T11716] syzkaller0: entered allmulticast mode [ 463.543592][T11716] tipc: Enabled bearer , priority 0 [ 463.587594][ T5698] gspca_sn9c2028: read1 error -110 [ 463.587694][ T5698] sn9c2028 5-1:0.0: probe with driver sn9c2028 failed with error -110 [ 463.633492][T11714] tipc: Resetting bearer [ 463.831133][T11714] tipc: Disabling bearer [ 463.900288][T11740] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1856'. [ 463.917587][ T5643] usb 5-1: USB disconnect, device number 44 [ 464.460059][T11749] netlink: 9 bytes leftover after parsing attributes in process `syz.6.1862'. [ 464.464368][T11749] gretap0: entered promiscuous mode [ 464.542170][T11749] netlink: 5 bytes leftover after parsing attributes in process `syz.6.1862'. [ 464.542285][T11749] 0ªî{X¹¦: renamed from gretap0 [ 464.586344][T11750] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 464.607672][T11749] 0ªî{X¹¦: left promiscuous mode [ 464.607698][T11749] 0ªî{X¹¦: entered allmulticast mode [ 465.298508][T11761] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 466.249095][T11753] ALSA: mixer_oss: invalid OSS volume '' [ 466.249133][T11753] ALSA: mixer_oss: invalid OSS volume ' aü=!ÿšê˹=·+LKWà„MšñŒëÓ:§~' [ 466.249147][T11753] ALSA: mixer_oss: invalid OSS volume 'ƒ%wÀ¹¼Ñº§ˆMò#i¥6[…ìNVLéúÃKK-' [ 466.249175][T11753] ALSA: mixer_oss: invalid OSS volume 'Ú¶ÿÌêZù•ç:Ñ 3.âôF?ºYùð¹Š^x1b' [ 466.249210][T11753] ALSA: mixer_oss: invalid OSS volume ' ”—$i.A<­”g—Õmo鱌‚éÜ)ã&:/“¢Œ' [ 466.249249][T11753] ALSA: mixer_oss: invalid OSS volume 'Ü~)~×ó·Š´¤‹ì}Úìk/FJ°¶éƒ—†]j' [ 466.249286][T11753] ALSA: mixer_oss: invalid OSS volume '§‹' [ 466.249314][T11753] ALSA: mixer_oss: invalid OSS volume 'FµµÈq(ã2÷Äž¾?åsÒï È[œ'|¾' [ 466.249351][T11753] ALSA: mixer_oss: invalid OSS volume '³§Û}`K’ƈãZ>_|¯#X³d#>zž^a¨' [ 466.249361][T11753] ALSA: mixer_oss: invalid OSS volume '*‹Ümo‹É×G%BuZkÂÄ@¤ª–m¸Iv¯Ó [ 470.448272][T11867] dump_stack_lvl+0xe8/0x150 [ 470.448317][T11867] should_fail_ex+0x3eb/0x540 [ 470.448359][T11867] _copy_from_user+0x2d/0xb0 [ 470.448391][T11867] kstrtouint_from_user+0xd6/0x180 [ 470.448420][T11867] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 470.448458][T11867] ? lock_acquire+0x115/0x350 [ 470.448496][T11867] proc_fail_nth_write+0x8e/0x210 [ 470.448523][T11867] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 470.448560][T11867] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 470.448585][T11867] vfs_write+0x296/0xba0 [ 470.448630][T11867] ? __pfx_vfs_write+0x10/0x10 [ 470.448666][T11867] ? __fget_files+0x2a/0x420 [ 470.448694][T11867] ? __fget_files+0x3a2/0x420 [ 470.448723][T11867] ? __fget_files+0x2a/0x420 [ 470.448760][T11867] ? fdget+0x1ac/0x250 [ 470.448800][T11867] ksys_write+0x150/0x270 [ 470.448838][T11867] ? __pfx_ksys_write+0x10/0x10 [ 470.448897][T11867] do_syscall_64+0x166/0x520 [ 470.448927][T11867] ? trace_irq_disable+0x3b/0x140 [ 470.448962][T11867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.448988][T11867] ? clear_bhb_loop+0x70/0xc0 [ 470.449019][T11867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.449044][T11867] RIP: 0033:0x7faecf36034e [ 470.449067][T11867] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 470.449088][T11867] RSP: 002b:00007faed02e9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 470.449114][T11867] RAX: ffffffffffffffda RBX: 00007faed02ea6c0 RCX: 00007faecf36034e [ 470.449132][T11867] RDX: 0000000000000001 RSI: 00007faed02ea0a0 RDI: 0000000000000004 [ 470.449146][T11867] RBP: 00007faed02ea090 R08: 0000000000000000 R09: 0000000000000000 [ 470.449162][T11867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 470.449177][T11867] R13: 00007faecf626038 R14: 00007faecf625fa0 R15: 00007faecf74fa48 [ 470.449218][T11867] [ 470.507567][ T30] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 470.764692][ T30] usb 2-1: Using ep0 maxpacket: 32 [ 470.765459][ T30] usb 2-1: New USB device found: idVendor=0763, idProduct=0150, bcdDevice=0.40 [ 470.766928][ T30] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 470.766953][ T30] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 470.769313][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.769339][ T30] usb 2-1: Product: syz [ 470.769355][ T30] usb 2-1: Manufacturer: syz [ 470.769371][ T30] usb 2-1: SerialNumber: syz [ 471.109776][ T1231] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 471.242126][T11878] FAULT_INJECTION: forcing a failure. [ 471.242126][T11878] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 471.242163][T11878] CPU: 0 UID: 0 PID: 11878 Comm: syz.6.1910 Tainted: G L syzkaller #0 PREEMPT(full) [ 471.242192][T11878] Tainted: [L]=SOFTLOCKUP [ 471.242205][T11878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 471.242218][T11878] Call Trace: [ 471.242226][T11878] [ 471.242235][T11878] dump_stack_lvl+0xe8/0x150 [ 471.242278][T11878] should_fail_ex+0x3eb/0x540 [ 471.242312][T11878] _copy_from_user+0x2d/0xb0 [ 471.242342][T11878] ___sys_sendmsg+0x1c6/0x360 [ 471.242366][T11878] ? __lock_acquire+0x747/0x2de0 [ 471.242400][T11878] ? __pfx____sys_sendmsg+0x10/0x10 [ 471.242423][T11878] ? __lock_acquire+0x747/0x2de0 [ 471.242457][T11878] ? kstrtouint+0x6e/0xe0 [ 471.242536][T11878] __sys_sendmmsg+0x273/0x4e0 [ 471.242569][T11878] ? __pfx___sys_sendmmsg+0x10/0x10 [ 471.242603][T11878] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 471.242649][T11878] ? ksys_write+0x242/0x270 [ 471.242684][T11878] ? __pfx_ksys_write+0x10/0x10 [ 471.242723][T11878] __x64_sys_sendmmsg+0xa0/0xc0 [ 471.242752][T11878] do_syscall_64+0x166/0x520 [ 471.242780][T11878] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.242810][T11878] ? clear_bhb_loop+0x70/0xc0 [ 471.242838][T11878] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.242860][T11878] RIP: 0033:0x7fbdf399fb19 [ 471.242881][T11878] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.242900][T11878] RSP: 002b:00007fbdf492c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 471.242922][T11878] RAX: ffffffffffffffda RBX: 00007fbdf3c25fa0 RCX: 00007fbdf399fb19 [ 471.242937][T11878] RDX: 00000000000004fc RSI: 0000200000000340 RDI: 0000000000000004 [ 471.242955][T11878] RBP: 00007fbdf492c090 R08: 0000000000000000 R09: 0000000000000000 [ 471.242965][T11878] R10: 00000000000c0041 R11: 0000000000000246 R12: 0000000000000001 [ 471.242974][T11878] R13: 00007fbdf3c26038 R14: 00007fbdf3c25fa0 R15: 00007fbdf3d4fa48 [ 471.243025][T11878] [ 471.308644][ T1231] usb 5-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=0.40 [ 471.459780][ T1231] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 471.459882][ T1231] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 471.521440][ T1231] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.521463][ T1231] usb 5-1: Product: syz [ 471.521491][ T1231] usb 5-1: Manufacturer: syz [ 471.521508][ T1231] usb 5-1: SerialNumber: syz [ 471.595335][ T1231] usb 5-1: 0:2 : does not exist [ 471.796114][ T1231] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 472.051937][ T30] usb 2-1: 0:1 : does not exist [ 472.051963][ T30] usb 2-1: 0:2 : does not exist [ 472.051980][ T30] usb 2-1: 0:3 : does not exist [ 472.051997][ T30] usb 2-1: 0:4 : does not exist [ 472.087896][ T1231] usb 5-1: USB disconnect, device number 46 [ 472.189326][ T30] usb 2-1: USB disconnect, device number 55 [ 472.391772][ T7433] udevd[7433]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 472.557154][ T9263] udevd[9263]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 473.035179][ T30] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 473.192420][ T30] usb 3-1: unable to get BOS descriptor or descriptor too short [ 473.192460][ T30] usb 3-1: New USB device found: idVendor=8086, idProduct=0ad2, bcdDevice=0.00 [ 473.213359][ T30] usb 3-1: config index 0 descriptor too short (expected 59573, got 181) [ 473.213391][ T30] usb 3-1: config 1 has too many interfaces: 140, using maximum allowed: 32 [ 473.213415][ T30] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 473.213436][ T30] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 140 [ 473.213483][ T30] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 473.257866][ T30] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 473.257890][ T30] usb 3-1: Product: syz [ 473.257901][ T30] usb 3-1: Manufacturer: syz [ 473.313080][ T30] uvcvideo 3-1:1.0: Found UVC 0.00 device syz (8086:0ad2) [ 473.313229][ T30] uvcvideo 3-1:1.0: No valid video chain found. [ 473.785649][ T5706] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 473.956965][ T5706] usb 5-1: Using ep0 maxpacket: 8 [ 473.962083][ T5706] usb 5-1: New USB device found: idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 473.992365][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 473.992388][ T5706] usb 5-1: Product: syz [ 473.992399][ T5706] usb 5-1: Manufacturer: syz [ 473.992411][ T5706] usb 5-1: SerialNumber: syz [ 474.037842][ T5706] usb 5-1: config 0 descriptor?? [ 474.040592][ T1231] usb 3-1: USB disconnect, device number 66 [ 474.091268][ T5706] gspca_main: sq905-2.14.0 probing 2770:9120 [ 474.460010][T11908] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.462276][T11908] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.491410][T11909] syzkaller0: entered promiscuous mode [ 474.491434][T11909] syzkaller0: entered allmulticast mode [ 474.513301][T11908] tipc: Enabled bearer , priority 0 [ 474.543661][T11910] tipc: Resetting bearer [ 474.662378][ T5706] gspca_sq905: sq905_command: usb_control_msg failed (-71) [ 474.662515][ T5706] sq905 5-1:0.0: probe with driver sq905 failed with error -71 [ 474.672007][ T992] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 474.703075][ T5706] usb 5-1: USB disconnect, device number 47 [ 474.703120][T11906] tipc: Resetting bearer [ 474.839465][ T992] usb 2-1: unable to get BOS descriptor or descriptor too short [ 474.839515][ T992] usb 2-1: New USB device found: idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 474.841668][ T992] usb 2-1: config 129 has an invalid interface number: 135 but max is 0 [ 474.841692][ T992] usb 2-1: config 129 has an invalid interface number: 5 but max is 0 [ 474.841710][ T992] usb 2-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 474.841874][ T992] usb 2-1: config 129 has no interface number 0 [ 474.841890][ T992] usb 2-1: config 129 has no interface number 1 [ 474.841931][ T992] usb 2-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 474.841954][ T992] usb 2-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 474.841985][ T992] usb 2-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 474.842007][ T992] usb 2-1: config 129 interface 135 has no altsetting 0 [ 474.842024][ T992] usb 2-1: config 129 interface 5 has no altsetting 0 [ 474.864401][T11906] tipc: Disabling bearer [ 474.972862][ T992] usb 2-1: string descriptor 0 read error: -22 [ 474.973006][ T992] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.041490][ T992] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 475.041668][ T992] usb 2-1: MIDIStreaming interface descriptor not found [ 475.424173][ T992] usb 2-1: USB disconnect, device number 56 [ 475.723234][T11934] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 475.723258][T11934] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 475.789763][T11934] tipc: Resetting bearer [ 475.823378][T11934] tipc: Resetting bearer [ 476.042620][T11940] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 476.042708][T11940] syzkaller1: linktype set to 823 [ 476.044297][T11943] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 476.044375][T11943] syzkaller1: linktype set to 823 [ 476.069878][T11940] syzkaller1: tun_chr_ioctl cmd 1074025680 [ 476.480384][ T31] kauditd_printk_skb: 70 callbacks suppressed [ 476.480410][ T31] audit: type=1326 audit(1794056802.155:1752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.482799][ T31] audit: type=1326 audit(1794056802.155:1753): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.488398][ T31] audit: type=1326 audit(1794056802.165:1754): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.488441][ T31] audit: type=1326 audit(1794056802.165:1755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.584993][ T31] audit: type=1326 audit(1794056802.225:1756): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.585181][ T31] audit: type=1326 audit(1794056802.225:1757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=179 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.585290][ T31] audit: type=1326 audit(1794056802.225:1758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.685578][ T31] audit: type=1326 audit(1794056802.365:1759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.687668][ T31] audit: type=1326 audit(1794056802.365:1760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=443 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.687813][ T31] audit: type=1326 audit(1794056802.365:1761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11949 comm="syz.1.1934" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7c1d9fb19 code=0x7ffc0000 [ 476.791381][T11953] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1934'. [ 476.873988][T11955] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1936'. [ 477.466110][ T992] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 477.621245][ T992] usb 7-1: New USB device found: idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 477.623704][ T992] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 477.665501][ T992] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.665524][ T992] usb 7-1: Product: syz [ 477.665535][ T992] usb 7-1: Manufacturer: syz [ 477.665576][ T992] usb 7-1: SerialNumber: syz [ 477.697152][ T992] usb 7-1: config 0 descriptor?? [ 477.718321][ T992] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 477.790037][T11968] netlink: 'syz.4.1942': attribute type 16 has an invalid length. [ 477.790064][T11968] netlink: 64130 bytes leftover after parsing attributes in process `syz.4.1942'. [ 478.096400][T11975] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1944'. [ 478.215340][T11975] lo: entered promiscuous mode [ 478.215497][T11975] tunl0: entered promiscuous mode [ 478.215688][T11975] gre0: entered promiscuous mode [ 478.217286][T11975] 0ªî{X¹¦: entered promiscuous mode [ 478.249254][T11975] erspan0: entered promiscuous mode [ 478.249386][T11975] ip_vti0: entered promiscuous mode [ 478.249516][T11975] ip6_vti0: entered promiscuous mode [ 478.249602][T11975] ip6tnl0: entered promiscuous mode [ 478.249705][T11975] ip6gre0: entered promiscuous mode [ 478.252018][T11975] syz_tun: entered promiscuous mode [ 478.252231][T11975] ip6gretap0: entered promiscuous mode [ 478.271910][T11975] bridge0: entered promiscuous mode [ 478.307123][T11975] vcan0: entered promiscuous mode [ 478.308967][T11975] bond0: entered promiscuous mode [ 478.308991][T11975] bond_slave_0: entered promiscuous mode [ 478.309496][T11975] bond_slave_1: entered promiscuous mode [ 478.310260][T11975] team0: entered promiscuous mode [ 478.310281][T11975] team_slave_0: entered promiscuous mode [ 478.310533][T11975] team_slave_1: entered promiscuous mode [ 478.310920][T11975] dummy0: entered promiscuous mode [ 478.313952][T11975] nlmon0: entered promiscuous mode [ 478.314171][T11975] veth0: entered promiscuous mode [ 478.314363][T11975] veth1: entered promiscuous mode [ 478.387205][T11975] wg0: entered promiscuous mode [ 478.387395][T11975] wg1: entered promiscuous mode [ 478.387570][T11975] wg2: entered promiscuous mode [ 478.406226][ T992] gspca_pac7302: reg_w() failed i: ff v: 01 error -71 [ 478.406233][T11975] veth0_to_bridge: entered promiscuous mode [ 478.406319][ T992] gspca_pac7302 7-1:0.0: probe with driver gspca_pac7302 failed with error -71 [ 478.412917][ T992] usb 7-1: USB disconnect, device number 6 [ 478.454865][T11975] veth1_to_bridge: entered promiscuous mode [ 478.455216][T11975] veth0_to_bond: entered promiscuous mode [ 478.455522][T11975] veth1_to_bond: entered promiscuous mode [ 478.455950][T11975] veth0_to_team: entered promiscuous mode [ 478.493373][T11975] veth1_to_team: entered promiscuous mode [ 478.493715][T11975] veth0_to_batadv: entered promiscuous mode [ 478.493886][T11975] batadv_slave_0: entered promiscuous mode [ 478.494050][T11975] veth1_to_batadv: entered promiscuous mode [ 478.494229][T11975] batadv_slave_1: entered promiscuous mode [ 478.498864][T11975] xfrm0: entered promiscuous mode [ 478.507853][T11975] veth0_to_hsr: entered promiscuous mode [ 478.508310][T11975] veth1_to_hsr: entered promiscuous mode [ 478.508608][T11975] hsr0: entered promiscuous mode [ 478.508859][T11975] veth1_virt_wifi: entered promiscuous mode [ 478.574253][T11975] veth0_virt_wifi: entered promiscuous mode [ 478.574420][T11975] virt_wifi0: entered promiscuous mode [ 478.585733][T11975] ªªªªªª: entered promiscuous mode [ 478.607296][T11975] vlan1: entered promiscuous mode [ 478.607688][T11975] macvlan1: entered promiscuous mode [ 478.607860][T11975] ipvlan0: entered promiscuous mode [ 478.608026][T11975] ipvlan1: entered promiscuous mode [ 478.608182][T11975] geneve0: entered promiscuous mode [ 478.608347][T11975] geneve1: entered promiscuous mode [ 478.608572][T11975] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 478.668898][T11975] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 478.669076][T11975] netdevsim netdevsim2 netdevsim2: entered promiscuous mode [ 478.669224][T11975] netdevsim netdevsim2 netdevsim3: entered promiscuous mode [ 478.789346][T11975] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 478.879033][T11975] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 478.919968][T11975] vxlan0: entered promiscuous mode [ 478.930462][T11975] ge: entered promiscuous mode [ 478.933307][T11975] tipc: Resetting bearer [ 478.972168][T11975] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 478.988920][T11975] &: entered promiscuous mode [ 479.040495][T11975] bond1: entered promiscuous mode [ 479.041184][T11975] ipvlan2: entered promiscuous mode [ 479.087003][T11975] macvlan2: entered promiscuous mode [ 479.119791][T11975] erspan1: entered promiscuous mode [ 479.149192][ C1] [ 479.151590][ C1] ============================= [ 479.156477][ C1] [ BUG: Invalid wait context ] [ 479.161409][ C1] syzkaller #0 Tainted: G L [ 479.167424][ C1] ----------------------------- [ 479.172297][ C1] swapper/1/0 is trying to lock: [ 479.177237][ C1] ffff888077ec5bc8 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x208/0x8d0 [ 479.186764][ C1] other info that might help us debug this: [ 479.192664][ C1] context-{2:2} [ 479.196124][ C1] locks held by swapper/1/0: 1, last CPU#1: [ 479.202038][ C1] #0: ffff888077ec6118 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1d2/0x8d0 [ 479.211980][ C1] stack backtrace: [ 479.215717][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 479.226231][ C1] Tainted: [L]=SOFTLOCKUP [ 479.230559][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 479.240613][ C1] Call Trace: [ 479.243898][ C1] [ 479.246743][ C1] dump_stack_lvl+0xe8/0x150 [ 479.251355][ C1] __lock_acquire+0xf5b/0x2de0 [ 479.256135][ C1] lock_acquire+0x115/0x350 [ 479.260650][ C1] ? kvm_xen_set_evtchn_fast+0x208/0x8d0 [ 479.266290][ C1] ? xa_load+0x1db/0x210 [ 479.270551][ C1] _raw_read_lock_irqsave+0x48/0x60 [ 479.275761][ C1] ? kvm_xen_set_evtchn_fast+0x208/0x8d0 [ 479.281505][ C1] kvm_xen_set_evtchn_fast+0x208/0x8d0 [ 479.286971][ C1] ? kvm_xen_set_evtchn_fast+0x1d2/0x8d0 [ 479.292696][ C1] xen_timer_callback+0x109/0x220 [ 479.297826][ C1] ? __pfx_xen_timer_callback+0x10/0x10 [ 479.303421][ C1] __hrtimer_run_queues+0x371/0xa10 [ 479.308652][ C1] hrtimer_interrupt+0x4cd/0xaa0 [ 479.313612][ C1] __sysvec_apic_timer_interrupt+0x102/0x430 [ 479.319603][ C1] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 479.325246][ C1] [ 479.328177][ C1] [ 479.331106][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 479.337089][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 479.342745][ C1] Code: 7b 92 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 1a 24 00 fb f4 3c 17 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 479.362461][ C1] RSP: 0018:ffffc900001a7e40 EFLAGS: 00000242 [ 479.368540][ C1] RAX: 00000000004e48d9 RBX: ffffffff819c9950 RCX: 8000000000000001 [ 479.376530][ C1] RDX: 0000000000000001 RSI: ffffffff8e6a81b9 RDI: ffffffff8c8ea280 [ 479.384505][ C1] RBP: ffffc900001a7f10 R08: ffff8880b8333d9b R09: 1ffff110170667b3 [ 479.392514][ C1] R10: dffffc0000000000 R11: ffffed10170667b4 R12: 0000000000000000 [ 479.400525][ C1] R13: 1ffff11003e5abb8 R14: 1ffff92000034fd0 R15: dffffc0000000000 [ 479.408535][ C1] ? do_idle+0x2e0/0x540 [ 479.412802][ C1] default_idle+0x9/0x20 [ 479.417072][ C1] default_idle_call+0x72/0xb0 [ 479.421843][ C1] do_idle+0x2e0/0x540 [ 479.425929][ C1] ? __pfx_do_idle+0x10/0x10 [ 479.430534][ C1] cpu_startup_entry+0x43/0x60 [ 479.435341][ C1] start_secondary+0x101/0x110 [ 479.440117][ C1] common_startup_64+0x13e/0x157 [ 479.445074][ C1] [ 480.131792][T11972] usb usb7: usbfs: process 11972 (syz.0.1941) did not claim interface 0 before use