last executing test programs: 19m19.84847403s ago: executing program 1 (id=2161): syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000009593d1044062180b738010203010902120001000000000904"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x208001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x20, 0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8894}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) quotactl_fd$Q_GETFMT(r0, 0xffffffff80000400, 0x0, &(0x7f00000001c0)) ptrace$cont(0x1f, 0x0, 0x6, 0x4) socket(0x10, 0x803, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) sendto$packet(r3, &(0x7f0000000180)="10031400e0ff020002004788aa96a13bb100001100007fca1a00", 0x1a, 0x0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x14) r4 = socket$qrtr(0x2a, 0x2, 0x0) r5 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="03040000b50000000100fefffeefffff"], 0xc8) sendmsg$sock(r4, &(0x7f0000000100)={&(0x7f00000002c0)=@pppoe={0x2a, 0x0, {0x4, @broadcast, 'macvlan0\x00'}}, 0x80, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x18, 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) 19m16.435590985s ago: executing program 1 (id=2169): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) unshare(0x8040480) socket$unix(0x1, 0x1, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r3 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x20004, r2, 0x80000}) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x289c2, 0x1) fcntl$setlease(r4, 0x400, 0x1) fremovexattr(r4, &(0x7f0000000040)=@known='system.posix_acl_default\x00') r5 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r7, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x16) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 19m14.763526125s ago: executing program 1 (id=2173): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x60fe, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x60}}]}}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x34) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r4 = syz_io_uring_setup(0x499, &(0x7f0000000380)={0x0, 0xd146, 0x0, 0x3, 0x287}, &(0x7f0000000100)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, 0x0, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r3, 0x0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[], 0x30}}) io_uring_enter(r4, 0x3516, 0xddd0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="e000000002010500000000000000000002000008080008400000064908000c40000000022800068014000400fe880000000000000000000000000001080001000a01010208000100e000000114001980080001004100000008000200100000000800034000002000540001800c000280050001003a0000000600034000040000060003400000000014000180080001000000000008000200000000001400018008000100e000000108000200ffffffff0c00028005000100210000002400198008000200200000000800010000000000"], 0xe0}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) syz_usb_control_io$hid(r0, &(0x7f0000000e80)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 19m11.117799985s ago: executing program 1 (id=2180): memfd_create(&(0x7f00000000c0)='-B\xd5N4\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\x8a\xd7Uw\x00\xbc\xa92\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8b\x066\xb8G\xd1c\xe1$\xff\x97\x8f~\xb90a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x19\xea\xef\xe3\xe1@\x84\x13\xefZb:\x8f\t\x01B\xec\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@Ip]D\xd6\r\xac\v#co\xd5\xb9\xc806\xa8\x99\xffs7\xa1b1\xb1;i)j\x0e\x1e\xedI\xa2\x80\x89\x1d\xd9p!\xc86s\xe07(\xee\xf9<\"\xf0\xc8\xae\x96J\xe2]\x01\x86\xb7.<\xf5N\xd3\x94W1\xff\x18z>\xa7q,\xf7\x96\xb8{\x8e\xbf4\xe0\x95\x1ce\xe4\x85\xcdi\xed\xd3>\xeb\xa5\xaf\x87\x90@\xd1\xbd`^\xfa\xb6\x9cj\x13/\xc5\\W\x04\br\x17X\xe3\xfb\xc8\xd4\xaeX\xc9s\xd18\xd9L\xbf\xa0\xa6\xdf2\a\x99i\xb1/\x19@\x1cq\xeb?\xc1z:\x913\xfa8\xac\xd3q\xe4vPGU', 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x8) r2 = eventfd2(0x6, 0x80800) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000400)) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000380)={0x1, r2}) r4 = pidfd_getfd(0xffffffffffffffff, r2, 0x0) ioctl$KVM_HYPERV_EVENTFD(r4, 0x4018aebd, &(0x7f0000000240)={0x2000001, r2}) r5 = semget$private(0x0, 0x6, 0x0) syz_open_dev$video4linux(&(0x7f0000000000), 0x30ba, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r4, 0xc02c5625, &(0x7f0000002940)={0x1c0f0f000, 0x9, "9a0f0134c9664000d14000aaaa7da80f8e4fa888dece6ffdb507a30100000028", 0xffffdfffff7fa4c8, 0xd, 0x9, 0x45, 0x2, 0x305, 0xfffffffe, 0x800000e, [0x7, 0x1000, 0x0, 0x2dc]}) semtimedop(r5, &(0x7f0000000380)=[{0x2, 0xf, 0x1000}, {0x2, 0x3, 0x3000}], 0x2, 0x0) semtimedop(r5, &(0x7f00000003c0), 0x0, 0x0) semop(0x0, &(0x7f0000000340)=[{0x2, 0x8001, 0x1000}], 0x1) semop(0x0, &(0x7f0000000300)=[{0x2, 0x0, 0x2000}], 0x1) semctl$IPC_RMID(0x0, 0x0, 0x0) r6 = syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) ioctl$DVB_DEMUX_DMX_SET_FILTER(r6, 0x403c6f2b, &(0x7f0000000000)={0x3800, {"e6a3785ef3ea62186288f8d2b35df471", "d35c65ff7462d83df18224e8fe7e024f", "82e70a363e66af9d666e017c542a839d"}, 0x7ad, 0x7}) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r7 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r8 = msgget$private(0x0, 0xafb0e20fef6483ff) msgsnd(r8, &(0x7f00000001c0)={0x3}, 0x4, 0x800) msgctl$MSG_STAT_ANY(r8, 0xd, &(0x7f00000002c0)=""/43) ioctl$I2C_RDWR(r7, 0x707, &(0x7f0000000200)={&(0x7f00000003c0)=[{0x8, 0x0, 0x99, &(0x7f0000000500)="9d1e7bed3a256f4beadfa2862bf4092ef3e174af130cda62853ff15ac26f7887c1fcab16680b8b58376f4d9301cfb48765f77a5e3a3f5d8a3407f95fc7a30a254d441d4c65f1a8e66f7781f1942e9f78952e007fa1032aa114e04749a5936d892ef4dfa94214d86cbb576f7c729a191838eda44a9da9b5a7febb883ac4165a1a8f1eb72a3d975190530b8ffb623fd75f625d4b44c4a55ce1a6"}], 0x1}) 19m10.19659798s ago: executing program 1 (id=2183): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b18, &(0x7f0000000000)={'veth1_to_batadv\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) fremovexattr(r0, &(0x7f0000000000)=@known='system.posix_acl_default\x00') socket$inet6_tcp(0xa, 0x1, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x3, &(0x7f0000000080)=[{0x81, 0x3, 0x2, 0x6}, {0xfff9, 0x3, 0x1, 0x6}, {0x8, 0x3, 0x7f, 0x3ff}]}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r1, &(0x7f00000001c0), 0x2, 0x0) r2 = openat$cgroup_procs(r1, 0x0, 0x2, 0x0) r3 = syz_clone(0x80100, 0x0, 0x62, 0x0, 0x0, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40)=r3, 0x12) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x1, 0x12) write$cgroup_pid(r5, 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a100efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb72b4b996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) 19m8.759581695s ago: executing program 1 (id=2188): ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f0000000080), 0x0}, 0x20) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/uevent_seqnum', 0x149b82, 0xb300bb1401d27a12) write$cgroup_int(r3, &(0x7f0000000000)=0x800, 0x12) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000200)='./file0\x00', 0x8, 0x1) r4 = syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) ioctl$VIDIOC_S_CTRL(r4, 0xc008561c, 0x0) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r8 = dup(r7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r8, 0x2000) ioctl$KVM_PRE_FAULT_MEMORY(r6, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) 18m53.3505753s ago: executing program 32 (id=2188): ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f0000000080), 0x0}, 0x20) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/uevent_seqnum', 0x149b82, 0xb300bb1401d27a12) write$cgroup_int(r3, &(0x7f0000000000)=0x800, 0x12) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000200)='./file0\x00', 0x8, 0x1) r4 = syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) ioctl$VIDIOC_S_CTRL(r4, 0xc008561c, 0x0) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r8 = dup(r7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r8, 0x2000) ioctl$KVM_PRE_FAULT_MEMORY(r6, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) 17.50307283s ago: executing program 3 (id=5373): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001e40), 0x0, 0x100, 0x0) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r2 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x1d24, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x14, 0x0, 0x301, 0x70bd28, 0x25dfdbfe, {0x1c}}, 0x14}, 0x1, 0xffff000000000000}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x48f, &(0x7f0000000000)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r6 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r8, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r12, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4000009c}]}) sendfile(r9, r9, 0x0, 0x2000fb) preadv2(r7, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) readv(r6, &(0x7f0000000340)=[{&(0x7f0000000140)=""/144, 0x8c}], 0x1000000000000360) ioctl$IMADDTIMER(r6, 0x80044940, &(0x7f0000000000)) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2a, 0xaf, 0xee, 0x8, 0xaf0, 0x6751, 0x758b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1}}]}}, 0x0) 13.441861993s ago: executing program 3 (id=5381): r0 = socket$nl_route(0x10, 0x3, 0x0) modify_ldt$write2(0x11, &(0x7f0000000100)={0xfffffff7, 0x20001000, 0x400, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$vcsa(0x0, 0xa40d, 0x2a8102) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r5, &(0x7f0000000080)={0xa, 0x0, 0x1000097, @ipv4={'\x00', '\xff\xff', @empty}, 0x4, 0x3}, 0x20) getsockname$l2tp6(r5, 0x0, &(0x7f0000000380)) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/igmp6\x00') r7 = socket(0x10, 0x3, 0x0) write(r7, &(0x7f0000000000)="240000001a005f0314f9f407000904000200", 0x12) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r8, 0x0, 0x0) preadv(r6, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x40000000, 0x0) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="010700ffffffc400000052"], 0x14}, 0x1, 0x0, 0x0, 0xc008}, 0x4008010) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x17b93}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 13.414930111s ago: executing program 5 (id=5382): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rt_acct\x00') r5 = socket(0x18, 0x800, 0x0) sendfile(r5, r4, 0x0, 0x8) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0xc858}, 0x80) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r9, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r10 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x80) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r7) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r12}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 11.758719015s ago: executing program 2 (id=5385): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="b4050000000000007112180000000000bc201000210000009500000000000000159bb11d55cd54f795ebc6c48b7ee57df364594defe47aa18c81fbb86c6042dbf743a90b61bae3a57ba478e003fe723b194058bc41fc8c6082cee0dce6c4e98c8804a03eb15abe991b86e1c207e4b9c2e545253ec3e0a8800fd697685e0d14ef22ee60615176aa2972a57268ec0127b3869d981e769df4fd0f63d8bde942339d7e8fa10c87b5562d7cd8a361f5801b6e29c575dac7f00846c103fa144116db9a8a8850b0715c590a250c52c2b47c7a4176a8c5e2702c9ad3df0cc0"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) write$binfmt_register(r3, &(0x7f0000000700)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x0, 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xea(J\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x1a\x92\'\xb6\xbcc\x96-\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xbd\x12\xd0\x1e\x98\xce\x00\x00\x00\x00\x00\x00\x0e\x00w\xcaC\xe1/\x19\xc8i\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132?\xbf\xb2\x93B\x01\'\xcb\xc0v\xces\xa4\x13\xb1\x14\x9e\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde44m\x96+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x8c\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aiI\xa1W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a\x86s\x04\xd6\xf4\x1c\x02A\xdbT`\x1d\xe2\xf1v\xa5\xe013?\xa4\xf6\xd9\x81\xc58m%\xf9\xf9&\xed\xed\xc3\xea:', 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, './file0'}, 0x256) socket(0x2, 0x3, 0x2) sendmsg$IPSET_CMD_FLUSH(r2, 0x0, 0x480c4) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = dup(r4) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40603d07, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_80211_join_ibss(&(0x7f0000000180)='wlan1\x00', &(0x7f0000000200)=@default_ibss_ssid, 0x6, 0x2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000000100)={r6}) socket$kcm(0x29, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r7 = socket(0x2, 0x80805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x640100ff, 0x4e20, 0x3, 'lblc\x00', 0x20, 0xa7e, 0x400070}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x8000, 0x100077}, {@remote, 0x4e20, 0x3, 0x8, 0x200}}, 0x44) 11.238449581s ago: executing program 3 (id=5386): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001e40), 0x0, 0x100, 0x0) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r2 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x1d24, 0x0) r4 = socket$inet(0x2b, 0x801, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x14, 0x0, 0x301, 0x70bd28, 0x25dfdbfe, {0x1c}}, 0x14}, 0x1, 0xffff000000000000}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x48f, &(0x7f0000000000)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r5 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r7, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4000009c}]}) sendfile(r8, r8, 0x0, 0x2000fb) preadv2(r6, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) readv(r5, &(0x7f0000000340)=[{&(0x7f0000000140)=""/144, 0x8c}], 0x1000000000000360) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f0000000000)) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2a, 0xaf, 0xee, 0x8, 0xaf0, 0x6751, 0x758b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1}}]}}, 0x0) 10.995474021s ago: executing program 5 (id=5389): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="b4050000000000007112180000000000bc201000210000009500000000000000159bb11d55cd54f795ebc6c48b7ee57df364594defe47aa18c81fbb86c6042dbf743a90b61bae3a57ba478e003fe723b194058bc41fc8c6082cee0dce6c4e98c8804a03eb15abe991b86e1c207e4b9c2e545253ec3e0a8800fd697685e0d14ef22ee60615176aa2972a57268ec0127b3869d981e769df4fd0f63d8bde942339d7e8fa10c87b5562d7cd8a361f5801b6e29c575dac7f00846c103fa144116db9a8a8850b0715c590a250c52c2b47c7a4176a8c5e2702c9ad3df0cc0"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) write$binfmt_register(r3, &(0x7f00000004c0)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x0, 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xea(J\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{G\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xbd\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132?\xbf\xb2\x93B\x01\'#\xc0v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde44m\x96+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x8c\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xa1W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a', 0x3a, './file0'}, 0x237) socket(0x2, 0x3, 0x2) sendmsg$IPSET_CMD_FLUSH(r2, 0x0, 0x480c4) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = dup(r4) ioctl$PTP_EXTTS_REQUEST2(r5, 0x40603d07, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_80211_join_ibss(&(0x7f0000000180)='wlan1\x00', &(0x7f0000000200)=@default_ibss_ssid, 0x6, 0x2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000000100)={r6}) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r7 = socket(0x2, 0x80805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) socket$kcm(0xa, 0x2, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x5}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r9, 0x0, 0x485, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x640100ff, 0x4e20, 0x3, 'lblc\x00', 0x20, 0xa7e, 0x400070}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x8000, 0x100077}, {@remote, 0x4e20, 0x3, 0x8, 0x200}}, 0x44) 9.38340277s ago: executing program 4 (id=5391): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001e40), 0x0, 0x100, 0x0) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r2 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x1d24, 0x0) r4 = socket$inet(0x2b, 0x801, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x14, 0x0, 0x301, 0x70bd28, 0x25dfdbfe, {0x1c}}, 0x14}, 0x1, 0xffff000000000000}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x48f, &(0x7f0000000000)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r5 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r7, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4000009c}]}) sendfile(r8, r8, 0x0, 0x2000fb) preadv2(r6, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) readv(r5, &(0x7f0000000340)=[{&(0x7f0000000140)=""/144, 0x8c}], 0x1000000000000360) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f0000000000)) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2a, 0xaf, 0xee, 0x8, 0xaf0, 0x6751, 0x758b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1}}]}}, 0x0) 9.36499478s ago: executing program 0 (id=5392): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000040)={0x28, 0x1, 0x0, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0xfffffffffffffffc}) r3 = open(&(0x7f0000000040)='.\x00', 0x0, 0x6c) fcntl$notify(r3, 0x402, 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) ftruncate(r4, 0x6000000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_IOAS_UNMAP$ALL(r2, 0x3b86, &(0x7f00000012c0)={0x18}) socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f00000028c0)={0x0, 0x0, {0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) fsopen(0x0, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x2e, &(0x7f0000002ac0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080046000020000000000011fe78ac1414ffac141416008903bc0000000000089078"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r7, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 9.211299829s ago: executing program 2 (id=5393): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000a93000/0x4000)=nil, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}]) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f0000000f40)=ANY=[@ANYBLOB="0100000000000000008000000700000014f7ffff0900000009000000af010000a2b9000001000000100000000800"]) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a6c000000060a0104000000000000000002000000400004803c0001800a0001006d617463680000002c00028014000300f4f03b0200000000030007116b61979e0c000100636c75737465720008000240000000000900010073797a30000000000900020073797a"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0x3}) write$FUSE_STATX(0xffffffffffffffff, &(0x7f0000000540)={0x130, 0x0, 0x0, {0x3, 0x6, 0x0, '\x00', {0x2000, 0x5, 0x7, 0xc07, 0x0, 0x0, 0xc000, '\x00', 0x1, 0x3ff, 0x0, 0x3, {0x0, 0x1}, {0x4, 0x800}, {0x961, 0x6a5ad1fb}, {0xfffffffffffffffe}, 0x80000000, 0xdc, 0x7e, 0xa}}}, 0x130) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d40)={0x750, r5, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@WGDEVICE_A_PEERS={0x728, 0x8, 0x0, 0x1, [{0x38, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e20, @loopback}}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x1, @local, 0x4}}]}, {0x98, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0x1, @empty, 0xd96}}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "722462f44843f8cdcfbf7696dd6365334b1cbe5c04ec4a20d26cb4e720e8f7ca"}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "d7017e586d63d13a9f7154c6c73787ee6235425fe68152cc590cc603a60797a6"}]}, {0x4}, {0x5c, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e23, @local}}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "f793f1dc8368b9309484a83ed7029bd346e38b70e680c8162763c5539c1426d3"}, @WGPEER_A_FLAGS={0x8, 0x3, 0x2}, @WGPEER_A_FLAGS={0x8, 0x3, 0x1}, @WGPEER_A_PROTOCOL_VERSION={0x8}]}, {0x2bc, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e23, @multicast2}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x2}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x5}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "524ad0b1e0dceae5bea7c1b5029320e20f8d3b596df04ce932e5f6db615c1539"}, @WGPEER_A_ALLOWEDIPS={0x268, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x40}}, {0x5, 0x3, 0x1}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @multicast1}}, {0x5}}]}, {0xa0, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private1}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010102}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x3}}]}, {0x7c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x6}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x5, 0x3, 0x1}}]}, {0x4}, {0xdc, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010101}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5}}]}]}, @WGPEER_A_PROTOCOL_VERSION={0x8}]}, {0x1f4, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}}, @WGPEER_A_PUBLIC_KEY={0x24}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e23, @multicast2}}, @WGPEER_A_ALLOWEDIPS={0x150, 0x9, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x2}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3f}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x22}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x29}}, {0x5, 0x3, 0x1}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @remote}}, {0x5, 0x3, 0x2}}]}, {0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5}}]}]}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x5}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e20, @rand_addr=0x64010101}}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "9719d2edda23592449434336c7e9f3a89a1845fb283d61bcc291e3b774d85de0"}]}, {0xd0, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x100, @remote, 0xfffffffd}}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "e050c75bb3599e01a1f0d47378bd76d943440925400018dabb4518b46d02f162"}, @WGPEER_A_FLAGS={0x8, 0x3, 0x4}, @WGPEER_A_ALLOWEDIPS={0x5c, 0x9, 0x0, 0x1, [{0x58, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x42}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x19}}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5, 0x3, 0x1}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}, {0x74, 0x0, 0x0, 0x1, [@WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x5, @local, 0x5}}, @WGPEER_A_PUBLIC_KEY={0x24}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "039265d561d14f4ab7e7b2034d7be9dc7fac6e631abbff146ea7e7dc25c38a08"}]}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x750}, 0x1, 0x0, 0x0, 0x4010}, 0x4008020) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) recvmsg(r6, &(0x7f000000c1c0)={0x0, 0x0, 0x0}, 0x20) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=ANY=[], 0x2e) 9.210290739s ago: executing program 5 (id=5394): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x8, 0x8001, 0x0, 0xaf, 0x0, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="2a000000400007012bbd700000000000017c0000040001800c00028005001780b0000000d31a8554928225ac036f2e22ba12b2dd4ed786ce0a9f977a3c90823f9d96bd4fd67c64e58aede0ac6a1819fb7ac1a1cfab413c1766972c2cddd27352bb1c6846839bd10fed0551f7c65feb2eb85cb2763b428bb315ba515895b1a85c612d6960364d5257dc816fa8a6dcdf5901cef48158753112a0a70290797ee340c015d50e6f3a98d9"], 0x24}, 0x1, 0x0, 0x0, 0x48815}, 0xc020) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000100)={0xc8, r4, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@WGDEVICE_A_FWMARK={0x8, 0x7, 0x9}, @WGDEVICE_A_PEERS={0x98, 0x8, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "9959076f17a3df260c32673333152e018f4fbe8eca2b76a7ccc30541f025a77c"}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x4}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}, @WGPEER_A_FLAGS={0x8, 0x3, 0x2}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xe}}}]}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4010}, 0x4008020) r5 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r5, &(0x7f0000000200)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) socket$kcm(0x29, 0x2, 0x0) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000080), 0x18) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) sendmmsg$inet(r0, &(0x7f0000000280), 0x0, 0x20000000) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='timers\x00') timer_create(0x0, 0x0, &(0x7f0000bbdffc)) preadv(r6, &(0x7f0000002380)=[{&(0x7f0000000200)=""/122, 0x7a}], 0x1, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {0xffff, 0xffff}, {0x6, 0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xe681}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x17}, 0x2000400c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e24, @rand_addr=0x64010102}], 0x10) 7.48434811s ago: executing program 5 (id=5395): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x20, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) add_key(0x0, 0x0, &(0x7f00000000c0)="010000000600275eaea4ca5826d8f50ee7f9ff0000006bb57ae0fffc5aadff07000088d18ee9cb1a75d14ff5cf5ad0ca816f40a8333c3532a19673b6dab6301fd45fb0393b6c91a6449faf9de0d0f990dbac85a3b278a5463e299aabc5b97b20e57a6bcb82df", 0x66, 0xffffffffffffffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) fcntl$getownex(r0, 0x10, &(0x7f0000000300)={0x0, 0x0}) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000240)={0x2d, 0x29, 0x17, 0x6, 0x8, 0x1, 0x3, 0x8e}) ptrace$cont(0x1f, r4, 0x100, 0x4) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x17, &(0x7f0000000480)=0x1d, 0x4) openat$nci(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) sendmsg$nl_route(r5, 0x0, 0x800) r7 = socket$inet_sctp(0x2, 0x5, 0x84) syz_open_dev$ttys(0xc, 0x2, 0x1) r8 = syz_open_dev$ptys(0xc, 0x3, 0x1) read(r8, &(0x7f00000000c0)=""/147, 0xb6) close_range(r7, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) 7.365162505s ago: executing program 3 (id=5396): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r2, 0xc0cc5640, &(0x7f00000000c0)={0x2, @sdr={0x32314d54, 0x400ffff}}) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmmsg(r3, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000840)=""/234, 0xea}, {&(0x7f0000003380)=""/4096, 0x1000}, {&(0x7f0000001a00)=""/50, 0x32}], 0x3}, 0xfffffffc}, {{0x0, 0x0, 0x0}}], 0x3, 0x42, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f00000004c0), 0xffffffffffffffff) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@gettaction={0x84, 0x32, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x478000}}]}, @action_gd=@TCA_ACT_TAB={0x40, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x25, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x14, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}]}, 0x84}}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) listen(0xffffffffffffffff, 0x0) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r4, 0xc01c64a3, &(0x7f0000000280)={0x3, r7, 0x1, 0xffff, 0xa, 0x1ff, 0x1}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x2, 0x0) sendmsg$unix(r9, &(0x7f0000000480)={&(0x7f0000000040)=@abs={0x0, 0x0, 0x4e20}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="6c00000010004b0429bd7000faffffff7a000000", @ANYRES32=0x0], 0x6c}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) 7.033320119s ago: executing program 0 (id=5397): r0 = socket$nl_route(0x10, 0x3, 0x0) modify_ldt$write2(0x11, &(0x7f0000000100)={0xfffffff7, 0x20001000, 0x400, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$vcsa(0x0, 0xa40d, 0x2a8102) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r5, &(0x7f0000000080)={0xa, 0x0, 0x1000097, @ipv4={'\x00', '\xff\xff', @empty}, 0x4, 0x3}, 0x20) getsockname$l2tp6(r5, 0x0, &(0x7f0000000380)) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/igmp6\x00') r7 = socket(0x10, 0x3, 0x0) write(r7, &(0x7f0000000000)="240000001a005f0314f9f407000904000200000001000000000000", 0x1b) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r8, 0x0, 0x0) preadv(r6, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x40000000, 0x0) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="010700ffffffc400000052"], 0x14}, 0x1, 0x0, 0x0, 0xc008}, 0x4008010) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x17b93}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 7.030241344s ago: executing program 2 (id=5398): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001e40), 0x0, 0x100, 0x0) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r2 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x1d24, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x14, 0x0, 0x301, 0x70bd28, 0x25dfdbfe, {0x1c}}, 0x14}, 0x1, 0xffff000000000000}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x48f, &(0x7f0000000000)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r6 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r8, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r12, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4000009c}]}) sendfile(r9, r9, 0x0, 0x2000fb) preadv2(r7, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) readv(r6, &(0x7f0000000340)=[{&(0x7f0000000140)=""/144, 0x8c}], 0x1000000000000360) ioctl$IMADDTIMER(r6, 0x80044940, &(0x7f0000000000)) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2a, 0xaf, 0xee, 0x8, 0xaf0, 0x6751, 0x758b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1}}]}}, 0x0) 5.911183541s ago: executing program 5 (id=5399): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001e40), 0x0, 0x100, 0x0) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r2 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x1d24, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x14, 0x0, 0x301, 0x70bd28, 0x25dfdbfe, {0x1c}}, 0x14}, 0x1, 0xffff000000000000}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x48f, &(0x7f0000000000)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r6 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r8, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r12, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4000009c}]}) sendfile(r9, r9, 0x0, 0x2000fb) preadv2(r7, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) readv(r6, &(0x7f0000000340)=[{&(0x7f0000000140)=""/144, 0x8c}], 0x1000000000000360) ioctl$IMADDTIMER(r6, 0x80044940, &(0x7f0000000000)) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2a, 0xaf, 0xee, 0x8, 0xaf0, 0x6751, 0x758b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1}}]}}, 0x0) 5.749017415s ago: executing program 4 (id=5400): r0 = open(&(0x7f0000000400)='.\x00', 0x0, 0x120) socket$pppoe(0x18, 0x1, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="d311000000010000180a000000000000000000000000000095000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x4, '\x00', 0x0, @fallback=0xa, r0}, 0x94) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000004c0)={'syztnl2\x00', 0x0}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, 0x0) mknod$loop(0x0, 0xfff, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x4001) r2 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r2, 0x107, 0xb, &(0x7f0000000000), &(0x7f0000000240)=0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021501700001e0a05010000000000000000070000000900020073797a31000000000900010073797a300000000024170380300000802c000180250001007bb0c03ce8ed22d039cce454fd98ae614b08a9f3d4ddf1f742d55995afac076948000000f01600800c00054000000000000000000c00054000000000000000000c00044000000000000000000c00044000000000000000000600064019d20000ac0201802800028008000340000000000900020073797a3100000000080003400000000008000180000000003800028008000340000000000800018000000000080003400000000008000340000000000900020073797a300000000008000340000000002c00028008000340000000000900020073797a31000000000900020073797a32000000000800034000000000d0000100b408b1e286b5c8f7a7321d1f80c982b3c96b4dac7dead86aceee30544dfdb289f2cae899fc3fe86ee3f122505d76d6b5878270ecb40c37908d60b9ed31d97a3e0ee856f3cf3c2fdfee967991f8d1ef7fdce37b30f8842735e543ac808675a64f66eb37009373328ddf992e92b3a5765bd5f765d73c578babbb08efd7b59dab641a88f3099e34bb7fbc04cb298bb0df6eb0dc4ca79864758aff38b7192698c89435c5699f4a9222ad4a2c68c9356b741f04ef667f7a169b8976632c7cb98f18ba558bc302c7b73401c42a76160c0002800800034000000000440002800900020073797a310000000008000340000000000900020073797a32000000000900020073797a320000000008000180000000"], 0x17d4}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="4801000042000100fffffffffddbdf250200000004003880100001800c00c8000200000000000000200104801c01"], 0x148}, 0x1, 0x0, 0x0, 0x8800}, 0x4040) 5.486129918s ago: executing program 4 (id=5401): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f0000000000)=0x639) select(0x40, &(0x7f0000000000)={0x9, 0x7, 0xffff, 0x0, 0x0, 0x1000}, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x2}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002c00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x60000000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x4}, 0x50) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7fff, 0x48b03) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r4, 0x80085665, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x2, &(0x7f0000000300)=ANY=[@ANYBLOB="81100600000000009500000000000000d3a2ea0b068e75da3a2fb6c46439324dfe021c305a753bf4fdf3549d7b7308bc4c0e6949bf81a89bd8b2dd97361a10b1ac2fcaa25e62f6030aee68326a7b880406a18e971ebf3f5dea83fa3fa037f00200e91d1d3b71eeb5346ca9193ad5a122de01c0d2212ae7d25d9e40c0c368a0d9bb21d008628c"], &(0x7f00000002c0)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x4}, 0x94) close(r5) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x498042, 0x0) getpid() syz_80211_join_ibss(&(0x7f0000000200)='wlan0\x00', &(0x7f00000002c0)=@default_ap_ssid, 0x6, 0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x40400) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000040)={0x191, 0x78, 0xa0, 0x78, 0x32, 0x1c0, 0x4, 0x0, {}, {}, {}, {}, 0x1, 0x40, 0xaa, 0x0, 0x1, 0x1, 0xffffffff, 0x1, 0x0, 0xfffffffd, 0x0, 0x8, 0xa, 0x0, 0x2, 0xa}) 5.304257898s ago: executing program 0 (id=5402): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x4840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f00006ef000/0x4000)=nil, 0x4000, 0x9, 0x10, 0xffffffffffffffff, 0x8000000) r4 = syz_open_dev$vim2m(&(0x7f0000000200), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r9, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000200)={r10, @in={{0x2, 0x4e23, @empty}}, 0x7, 0x400, 0x2, 0x41, 0x6, 0xffff, 0x10}, &(0x7f0000000080)=0x9c) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r8}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x24048180) sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r6, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x880) ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f0000000040)=@overlay={0x0, 0x1, 0x4, 0x0, 0xd, {}, {0x4, 0x0, 0x0, 0x1, 0x0, 0x0, "12848098"}, 0x3}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0xffffffff, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) 5.02652186s ago: executing program 3 (id=5403): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x2, 0x7, 0xfffffe0001000001, 0xfa11, 0xffffffff}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x13, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000480)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x28, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000100)={0x48}) r2 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb0160291d00090536"], 0x0) unshare(0x6020480) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000000d40)={0x0, 0x0, 0x0}, 0x20001) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008000}, 0x50) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f00000002c0)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) connect$inet6(r5, &(0x7f0000000480)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x3, @remote}, 0x1, 0x1}}, 0x2e) r7 = syz_open_dev$audion(&(0x7f0000000000), 0x3, 0x1) write$P9_RLCREATE(r7, &(0x7f0000000180)={0x18, 0xf, 0x1, {{0x0, 0x4, 0x5}, 0xffffff80}}, 0x18) ioctl$SNDCTL_DSP_SETTRIGGER(r7, 0x40045010, 0x0) 3.842441255s ago: executing program 2 (id=5404): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0xfffffffffffffe3e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x2, 0x89, 0x8, 0xb319, 0x3}, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f00000001c0)={0x0, 0x0, 0x0}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r4, 0x5421, &(0x7f0000000140)=0x1) writev(r4, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) close(r4) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mbind(&(0x7f00001ae000/0x4000)=nil, 0x4000, 0x4002, &(0x7f0000000200)=0x2001000000000004, 0x9, 0x3) syz_emit_ethernet(0x2c, &(0x7f0000000700)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000008902450c001e0064000004029078e0000001e0cb5a180fff1ffe"], 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r5 = syz_open_dev$video4linux(&(0x7f0000000400), 0x800000000401, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc040564a, &(0x7f0000000000)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0}) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="58000000020601080000000000000000010000030c000300686173683a6970000500010007000000050005000a0000000900020073797a300000000005000400000000bf0d00078008000840000000d308000640000000005fa51f"], 0x58}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) 3.5561557s ago: executing program 4 (id=5405): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x20001, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x3, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCPKT(r4, 0x5420, 0x0) add_key$user(0x0, &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) openat$sequencer(0xffffffffffffff9c, 0x0, 0x8002, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) msgget$private(0x0, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_LOG_STATUS(r5, 0x5646, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') preadv(r6, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000013c0)=@newlink={0x74, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x11418, 0x4000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x4}}}, @IFLA_AF_SPEC={0x38, 0x1a, 0x0, 0x1, [@AF_BRIDGE={0x4}, @AF_MPLS={0x4}, @AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}, @AF_INET6={0xc, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x4}]}, @AF_INET6={0xc, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x9}]}, @AF_BRIDGE={0x4}, @AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x400}]}, 0x74}, 0x1, 0x0, 0x0, 0x8800}, 0x40880) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, &(0x7f0000000200)={0x0, @reserved}) ioctl$SNDCTL_MIDI_PRETIME(r1, 0xc0046d00, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCOUTQ(r8, 0x5411, &(0x7f0000000040)) 3.487457398s ago: executing program 0 (id=5406): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001e40), 0x0, 0x100, 0x0) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r2 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x1d24, 0x0) r4 = socket$inet(0x2b, 0x801, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x14, 0x0, 0x301, 0x70bd28, 0x25dfdbfe, {0x1c}}, 0x14}, 0x1, 0xffff000000000000}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x48f, &(0x7f0000000000)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r5 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r7, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4000009c}]}) sendfile(r8, r8, 0x0, 0x2000fb) preadv2(r6, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) readv(r5, &(0x7f0000000340)=[{&(0x7f0000000140)=""/144, 0x8c}], 0x1000000000000360) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f0000000000)) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2a, 0xaf, 0xee, 0x8, 0xaf0, 0x6751, 0x758b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1}}]}}, 0x0) 2.089503608s ago: executing program 2 (id=5407): socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x21800, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$vim2m_VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f0000000040)={0x8, 0x9, 0x4, {0x2, @vbi={0x9, 0x1, 0x7, 0x34565559, [0x34565348, 0xb22], [0x7], 0x1}}, 0x8}) socket(0x1d, 0x2, 0x6) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000000200)=0x20022a, 0x4) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r4, 0x40505331, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000180), 0x1, 0x80000) ioctl$EVIOCGEFFECTS(r5, 0x80044584, &(0x7f0000000380)=""/196) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) r6 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r6, 0x10e, 0x2, &(0x7f0000000040)=0x12, 0x4) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x1, 0x50) io_setup(0x4fe, &(0x7f00000009c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000400)=[&(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x40, r7, &(0x7f0000000200)='8', 0x1, 0x10000000005971}]) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8b05, &(0x7f0000000100)={'wlan1\x00'}) 1.599569898s ago: executing program 3 (id=5408): openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffd000/0x2000)=nil, 0x2000}, 0x1}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x2, 0x3, 0xffffe000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xffffffffffffffff]}, 0x0, 0x8) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_RUN(r5, 0xae80, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x2, 0xf, &(0x7f00000000c0)=ANY=[@ANYBLOB="030000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000002e50c000004000018110000", @ANYRES32=0x1, @ANYBLOB], &(0x7f0000000000)='syzkaller\x00', 0xfffffc01, 0x3f, &(0x7f0000000140)=""/63, 0x40f00, 0xd, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x9, 0x1}, 0x8, 0x10, &(0x7f0000000200)={0x3, 0xd, 0x1, 0x6}, 0x10, 0x0, 0xffffffffffffffff, 0x4, &(0x7f0000000240)=[0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], &(0x7f00000002c0)=[{0x4, 0x2, 0x9, 0x1}, {0x2, 0x3, 0xd, 0x7}, {0x0, 0x3, 0x4, 0x4}, {0x3, 0x4, 0x0, 0x5}], 0x10, 0xb9}, 0x94) r7 = openat$cgroup_root(0xffffff9c, &(0x7f0000000440)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r8 = socket$nl_rdma(0x10, 0x3, 0x14) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e80)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000040)=r9, 0x4) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x140f, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}]}, 0x1c}}, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000400)={r6, r7, 0x12, 0x0, @val=@tracing={0xffffffffffffffff, 0x34b00000000000}}, 0x1c) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, r10) 1.348878535s ago: executing program 4 (id=5409): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e1e}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x93, 0x5, 0x8, 0x7fff, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000006c0)=ANY=[], 0x33fe0}}, 0x40010) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4092, 0xffc}], 0x1, 0x0, 0x0, 0x20000800}, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x8000002, 0xfffffffa, @rand_addr, 0x5}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) socket(0x10, 0x3, 0x0) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x280543) r7 = syz_open_dev$video(&(0x7f0000000280), 0x101, 0xab02) ioctl$VIDIOC_S_INPUT(r7, 0xc0045627, &(0x7f0000000180)=0x1) syz_io_uring_setup(0x4ce4, &(0x7f0000000200)={0x0, 0x3e1e, 0x400, 0x0, 0x182, 0x0, r4}, &(0x7f0000000040), &(0x7f00000002c0)) ioctl$VIDIOC_S_CROP(r7, 0x4014563c, &(0x7f0000000100)={0x9, {0xf8000002, 0x9, 0x8, 0xb}}) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00') ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f00000001c0)=0x7) read(r0, &(0x7f0000001140)=""/4096, 0x1000) 1.068344796s ago: executing program 5 (id=5410): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001e40), 0x0, 0x100, 0x0) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r2 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x1d24, 0x0) r4 = socket$inet(0x2b, 0x801, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x14, 0x0, 0x301, 0x70bd28, 0x25dfdbfe, {0x1c}}, 0x14}, 0x1, 0xffff000000000000}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x14, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x48f, &(0x7f0000000000)={0x1, @private, 0x0, 0x0, 'sed\x00', 0xa, 0xfffffffb, 0x14}, 0x2c) r5 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r7, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0xa0000, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4000009c}]}) sendfile(r8, r8, 0x0, 0x2000fb) preadv2(r6, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) readv(r5, &(0x7f0000000340)=[{&(0x7f0000000140)=""/144, 0x8c}], 0x1000000000000360) ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f0000000000)) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x2a, 0xaf, 0xee, 0x8, 0xaf0, 0x6751, 0x758b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1}}]}}, 0x0) 214.329483ms ago: executing program 0 (id=5411): r0 = open(&(0x7f0000000400)='.\x00', 0x0, 0x120) socket$pppoe(0x18, 0x1, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="d311000000010000180a000000000000000000000000000095000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x4, '\x00', 0x0, @fallback=0xa, r0}, 0x94) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000004c0)={'syztnl2\x00', 0x0}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, 0x0) mknod$loop(0x0, 0xfff, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x4001) r2 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r2, 0x107, 0xb, &(0x7f0000000000), &(0x7f0000000240)=0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021501700001e0a05010000000000000000070000000900020073797a31000000000900010073797a300000000024170380300000802c000180250001007bb0c03ce8ed22d039cce454fd98ae614b08a9f3d4ddf1f742d55995afac076948000000f01600800c00054000000000000000000c00054000000000000000000c00044000000000000000000c00044000000000000000000600064019d20000ac0201802800028008000340000000000900020073797a3100000000080003400000000008000180000000003800028008000340000000000800018000000000080003400000000008000340000000000900020073797a300000000008000340000000002c00028008000340000000000900020073797a31000000000900020073797a32000000000800034000000000d0000100b408b1e286b5c8f7a7321d1f80c982b3c96b4dac7dead86aceee30544dfdb289f2cae899fc3fe86ee3f122505d76d6b5878270ecb40c37908d60b9ed31d97a3e0ee856f3cf3c2fdfee967991f8d1ef7fdce37b30f8842735e543ac808675a64f66eb37009373328ddf992e92b3a5765bd5f765d73c578babbb08efd7b59dab641a88f3099e34bb7fbc04cb298bb0df6eb0dc4ca79864758aff38b7192698c89435c5699f4a9222ad4a2c68c9356b741f04ef667f7a169b8976632c7cb98f18ba558bc302c7b73401c42a76160c0002800800034000000000440002800900020073797a310000000008000340000000000900020073797a32000000000900020073797a32000000000800018000000000"], 0x17d4}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, 0x0, 0x4040) 212.272025ms ago: executing program 2 (id=5412): r0 = socket$nl_route(0x10, 0x3, 0x0) modify_ldt$write2(0x11, &(0x7f0000000100)={0xfffffff7, 0x20001000, 0x400, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$vcsa(0x0, 0xa40d, 0x2a8102) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r5, &(0x7f0000000080)={0xa, 0x0, 0x1000097, @ipv4={'\x00', '\xff\xff', @empty}, 0x4, 0x3}, 0x20) getsockname$l2tp6(r5, 0x0, &(0x7f0000000380)) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/igmp6\x00') r7 = socket(0x10, 0x3, 0x0) write(r7, &(0x7f0000000000)="240000001a005f0314f9f407000904000200000001000000000000", 0x1b) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r8, 0x0, 0x0) preadv(r6, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x40000000, 0x0) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="010700ffffffc400000052"], 0x14}, 0x1, 0x0, 0x0, 0xc008}, 0x4008010) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x17b93}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 792.388µs ago: executing program 4 (id=5413): r0 = fsopen(&(0x7f0000000580)='qnx4\x00', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x20801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0xd8a, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000200)={0x48}) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r5, 0x4611, 0x3) ioctl$FBIO_WAITFORVSYNC(r5, 0x40044620, 0x0) dup(0xffffffffffffffff) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0xff, "810000cc2b000000000000fa25ffff00ffffff"}) r8 = syz_open_pts(r7, 0x141601) fcntl$setstatus(r8, 0x4, 0x102800) write(r8, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000100)=0x19) close_range(r6, 0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=ANY=[@ANYBLOB="1820000000000000000a00000010000018110000", @ANYRES32, @ANYBLOB="0000020000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 0 (id=5414): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) kexec_load(0x0, 0x0, 0x0, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e21, 0x7, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0xff}, 0x1c) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={0x0, 0xff, 0xc}, 0x1b) getsockopt$sock_buf(r2, 0x1, 0x1c, 0x0, &(0x7f00000001c0)=0x3b) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r3, &(0x7f0000000100)="11e5a68e291a6f297bca1e72499a1c0b73c1486bc5cd08a7132b5dc14cefff", 0x1f, 0x40, &(0x7f0000000240)={0x2, 0x4e23, @local}, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x18, &(0x7f0000000280)=@req3={0x0, 0x8, 0x1, 0x101, 0x9, 0x9, 0x2}, 0x1c) r5 = syz_open_dev$sg(&(0x7f0000000280), 0xfffffffffffffffa, 0x109202) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000000c0)={0x0, 0xe4, 0x5d}) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCFLSH(r6, 0x5608, 0x1) socket$nl_route(0x10, 0x3, 0x0) kernel console output (not intermixed with test programs): idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 2062.031246][ T1025] usb 6-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 2062.073294][T27331] usb 3-1: USB disconnect, device number 31 [ 2062.083585][ T1025] usb 6-1: Manufacturer: syz [ 2062.107539][ T1025] usb 6-1: config 0 descriptor?? [ 2062.121195][ T1025] smsusb:smsusb_probe: board id=9, interface number 0 [ 2062.131119][ T1025] smsusb:smsusb_probe: Device initialized with return code -19 [ 2062.216435][ C1] usblp0: nonzero read bulk status received: -71 [ 2062.223809][ T7001] usb 4-1: USB disconnect, device number 10 [ 2062.377626][ T1025] usb 6-1: USB disconnect, device number 86 [ 2062.386066][T11302] usb 43-1: recv xbuf, 0 [ 2062.396781][ T8563] vhci_hcd vhci_hcd.5: stop threads [ 2062.402041][ T8563] vhci_hcd vhci_hcd.5: release socket [ 2062.436053][ T8563] vhci_hcd vhci_hcd.5: disconnect device [ 2062.437058][T11223] usblp0: removed [ 2062.465851][T24311] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 2063.355859][ T1025] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 2063.588625][ T1025] usb 6-1: Using ep0 maxpacket: 16 [ 2063.607984][ T1025] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 2063.650228][ T1025] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2063.675621][ T1025] usb 6-1: Product: syz [ 2063.683426][ T1025] usb 6-1: Manufacturer: syz [ 2063.691614][ T1025] usb 6-1: SerialNumber: syz [ 2063.746458][ T1025] r8152-cfgselector 6-1: Unknown version 0x0000 [ 2063.753075][ T1025] r8152-cfgselector 6-1: config 0 descriptor?? [ 2063.796452][ T7001] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 2063.980672][ T7001] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2064.016352][ T7001] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2064.042268][ T7001] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 2064.086741][ T7001] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2064.098140][ T7001] usb 4-1: config 0 descriptor?? [ 2064.203703][T11353] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2064.240003][T11353] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2064.277921][ T1025] r8152-cfgselector 6-1: USB disconnect, device number 87 [ 2064.531171][ T7001] pyra 0003:1E7D:2CF6.0020: item fetching failed at offset 0/7 [ 2064.576986][ T7001] pyra 0003:1E7D:2CF6.0020: parse failed [ 2064.595826][ T7001] pyra 0003:1E7D:2CF6.0020: probe with driver pyra failed with error -22 [ 2064.741861][T11386] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2064.759268][T11386] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2064.935862][ T1511] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 2065.110203][ T1511] usb 3-1: Using ep0 maxpacket: 16 [ 2065.134871][ T1511] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2065.181642][ T1511] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2065.232805][ T1511] usb 3-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 2065.269149][ T1511] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2065.313859][ T1511] usb 3-1: Product: syz [ 2065.331562][ T1511] usb 3-1: Manufacturer: syz [ 2065.355922][ T1511] usb 3-1: SerialNumber: syz [ 2065.373246][ T1511] usb 3-1: config 0 descriptor?? [ 2065.610629][ C0] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 2065.665118][ T1511] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input113 [ 2065.741713][ T1511] imon:send_packet: packet tx failed (-71) [ 2065.787164][ T1511] imon 3-1:0.0: panel buttons/knobs setup failed [ 2065.935811][ T1511] rc_core: IR keymap rc-imon-pad not found [ 2065.947049][ T1511] Registered IR keymap rc-empty [ 2065.957550][ T1511] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 2065.982704][ T1511] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 2066.005293][ T1511] imon:send_packet: packet tx failed (-71) [ 2066.036168][ T1511] imon 3-1:0.0: remote input dev register failed [ 2066.051719][ T1511] imon 3-1:0.0: imon_init_intf0: rc device setup failed [ 2066.118991][ T1511] imon 3-1:0.0: unable to initialize intf0, err 0 [ 2066.132134][ T1511] imon:imon_probe: failed to initialize context! [ 2066.149949][ T1511] imon 3-1:0.0: unable to register, err -19 [ 2066.179641][ T1511] usb 3-1: USB disconnect, device number 32 [ 2066.505892][ T1511] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 2066.581146][ T1896] usb 4-1: USB disconnect, device number 11 [ 2066.715887][ T1511] usb 3-1: Using ep0 maxpacket: 16 [ 2066.733292][ T1511] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2066.769678][ T1511] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2066.809079][ T1511] usb 3-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 2066.845836][ T1511] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2066.876203][ T1511] usb 3-1: Product: syz [ 2066.880431][ T1511] usb 3-1: Manufacturer: syz [ 2066.922184][ T1511] usb 3-1: SerialNumber: syz [ 2066.951229][ T1511] usb 3-1: config 0 descriptor?? [ 2067.229346][ T1511] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input115 [ 2067.349665][T11475] macsec0: entered promiscuous mode [ 2067.369494][T11475] macsec0: entered allmulticast mode [ 2067.396161][T11475] bridge0: entered allmulticast mode [ 2067.422608][T11475] bridge0: port 5(macsec0) entered blocking state [ 2067.462399][T11475] bridge0: port 5(macsec0) entered disabled state [ 2067.695982][ T1511] rc_core: IR keymap rc-imon-pad not found [ 2067.713832][ T1511] Registered IR keymap rc-empty [ 2067.730388][ T1511] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 2067.772211][ T1511] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 2067.859185][ T1511] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 2067.947232][ T1511] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input116 [ 2068.002102][ C0] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-75): ignored [ 2068.086118][ T1511] imon 3-1:0.0: iMON device (15c2:0041, intf0) on usb<3:33> initialized [ 2068.422232][ C0] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 2068.451322][ T1511] usb 3-1: USB disconnect, device number 33 [ 2068.686587][T11475] bridge0: left allmulticast mode [ 2069.228388][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.272334][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.315811][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.347830][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.384721][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.407767][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.429932][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.460873][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.493738][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.530732][ T1025] hid-generic 0006:0004:0009.0021: unknown main item tag 0x0 [ 2069.618554][ T1025] hid-generic 0006:0004:0009.0021: hidraw0: VIRTUAL HID v0.04 Device [syz1] on syz0 [ 2069.889087][T11544] syzkaller0: entered promiscuous mode [ 2069.985283][T11549] fido_id[11549]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 2070.136235][ T1025] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 2070.347665][ T1025] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2070.377510][ T1025] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2070.429039][ T1025] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2070.455778][ T1025] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2070.501028][ T1025] usb 3-1: Product: syz [ 2070.546160][ T1025] usb 3-1: Manufacturer: syz [ 2070.553847][ T1025] usb 3-1: SerialNumber: syz [ 2070.579513][ T1025] usb 3-1: config 0 descriptor?? [ 2070.593193][ T1025] usb 3-1: selecting invalid altsetting 0 [ 2070.786166][ T1511] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 2070.973629][ T1511] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 2071.036038][ T1511] usb 4-1: config 0 has no interface number 0 [ 2071.094099][ T1511] usb 4-1: config 0 interface 41 has no altsetting 0 [ 2071.117154][ T1025] usb 3-1: USB disconnect, device number 34 [ 2071.129826][ T1511] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 2071.213120][ T1511] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2071.257414][ T1511] usb 4-1: Product: syz [ 2071.261612][ T1511] usb 4-1: Manufacturer: syz [ 2071.341124][ T1511] usb 4-1: SerialNumber: syz [ 2071.390013][ T1511] usb 4-1: config 0 descriptor?? [ 2071.411791][T11601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2071.457989][T11601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2071.510255][T11606] netlink: 'syz.0.4796': attribute type 1 has an invalid length. [ 2071.603285][T11606] 8021q: adding VLAN 0 to HW filter on device bond9 [ 2071.662934][T11619] bond9: (slave bridge6): making interface the new active one [ 2071.698813][T11619] bond9: (slave bridge6): Enslaving as an active interface with an up link [ 2071.773270][T11539] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2072.254611][ T1511] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 2073.345941][ T1896] usb 6-1: new full-speed USB device number 88 using dummy_hcd [ 2073.518091][ T1511] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 2073.761189][ T1511] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -71 [ 2073.798614][ T1511] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -71 [ 2073.846277][ T1511] usb 4-1: USB disconnect, device number 12 [ 2074.410171][ T1896] usb 6-1: config 1 has an invalid interface number: 128 but max is 1 [ 2074.454034][ T1896] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2074.499248][ T1896] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2074.560193][ T1896] usb 6-1: config 1 has no interface number 0 [ 2074.609951][ T1896] usb 6-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2074.757097][ T1896] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2074.778651][ T1025] hid_parser_main: 7 callbacks suppressed [ 2074.778668][ T1025] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 2074.786018][ T1896] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2074.803110][ T1896] usb 6-1: Product: syz [ 2074.860529][ T1896] usb 6-1: Manufacturer: syz [ 2074.887700][ T1025] hid-generic 0000:0000:0000.0022: hidraw0: HID v0.00 Device [syz1] on syz0 [ 2074.922389][ T1896] usb 6-1: SerialNumber: syz [ 2075.040821][ T1896] cdc_wdm 6-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2076.711637][ T1896] usb 6-1: USB disconnect, device number 88 [ 2076.896366][T30985] bond0: (slave bond_slave_0): interface is now down [ 2076.906370][T11738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2076.925835][T30985] bond0: (slave bond_slave_1): interface is now down [ 2076.995930][T30985] bond0: now running without any active interface! [ 2077.289907][T11754] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=16394 (32788 ns) > initial count (48 ns). Using initial count to start timer. [ 2077.730520][T11768] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4817'. [ 2077.797169][T11768] syzkaller1: entered promiscuous mode [ 2077.802944][T11768] syzkaller1: entered allmulticast mode [ 2078.715851][ T7001] usb 3-1: new full-speed USB device number 35 using dummy_hcd [ 2078.724846][T11743] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2078.867009][T11809] netlink: 'syz.5.4824': attribute type 1 has an invalid length. [ 2078.958984][ T7001] usb 3-1: config 1 has an invalid interface number: 128 but max is 1 [ 2078.990032][ T7001] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2079.061893][ T7001] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2079.095777][ T7001] usb 3-1: config 1 has no interface number 0 [ 2079.111932][ T7001] usb 3-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2079.219147][ T7001] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2079.246402][ T7001] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2079.273533][ T7001] usb 3-1: Product: syz [ 2079.289106][ T7001] usb 3-1: Manufacturer: syz [ 2079.303554][ T7001] usb 3-1: SerialNumber: syz [ 2079.378178][ T7001] cdc_wdm 3-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2079.709188][T11829] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 2080.665382][ T29] audit: type=1804 audit(1772360487.278:1918): pid=11853 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.4833" name="/" dev="pidfs" ino=42711 res=1 errno=0 [ 2081.415621][ T1511] usb 3-1: USB disconnect, device number 35 [ 2081.802422][T11903] syzkaller0: entered promiscuous mode [ 2082.041251][T11919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2082.076959][T11919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2082.310376][T11919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2082.329719][T11919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2082.738015][ T1896] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 2082.951245][ T1896] usb 4-1: config 1 has an invalid interface number: 128 but max is 1 [ 2082.974554][ T1896] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2083.029839][T11946] macsec1: entered promiscuous mode [ 2083.037839][ T1896] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2083.060720][T11946] bridge0: entered promiscuous mode [ 2083.073834][T11946] macsec1: entered allmulticast mode [ 2083.080129][ T1896] usb 4-1: config 1 has no interface number 0 [ 2083.102456][ T1896] usb 4-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2083.120595][T11946] bridge0: entered allmulticast mode [ 2083.138173][T11946] bridge0: left allmulticast mode [ 2083.147656][T11946] bridge0: left promiscuous mode [ 2083.156373][ T1896] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2083.185351][ T1896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2083.211212][ T1896] usb 4-1: Product: syz [ 2083.224552][ T1896] usb 4-1: Manufacturer: syz [ 2083.235867][ T7001] usb 3-1: new low-speed USB device number 36 using dummy_hcd [ 2083.249433][ T1896] usb 4-1: SerialNumber: syz [ 2083.294438][ T1896] cdc_wdm 4-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2083.397665][ T7001] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 2083.418485][ T7001] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 73, setting to 8 [ 2083.435916][ T7001] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2083.468137][ T7001] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2083.487805][T11968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2083.507338][T11968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2083.508556][ T7001] usb 3-1: config 0 descriptor?? [ 2083.559935][T11950] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 2083.795321][ T7001] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 2084.029411][ T1896] usb 3-1: USB disconnect, device number 36 [ 2084.035486][ C0] iowarrior 3-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 2084.372770][T11995] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4858'. [ 2085.181410][T12017] netlink: 'syz.5.4863': attribute type 4 has an invalid length. [ 2085.880903][T12030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2085.900217][ T7001] usb 6-1: new full-speed USB device number 89 using dummy_hcd [ 2085.929625][T12030] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2086.069577][ T7001] usb 6-1: config 0 interface 0 altsetting 251 has an endpoint descriptor with address 0x93, changing to 0x83 [ 2086.131819][ T7001] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 2086.178741][ T7001] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x83 has invalid maxpacket 90, setting to 64 [ 2086.191489][ T7001] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2086.203005][ T7001] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2086.221388][ T7001] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2086.229884][ T1025] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 2086.247633][ T7001] usb 6-1: Product: syz [ 2086.257617][ T7001] usb 6-1: Manufacturer: syz [ 2086.269134][ T7001] usb 6-1: SerialNumber: syz [ 2086.299513][ T7001] usb 6-1: config 0 descriptor?? [ 2086.325184][T12022] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 2086.340718][T12040] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4867'. [ 2086.362382][ T7001] usb 6-1: selecting invalid altsetting 0 [ 2086.437228][ T1025] usb 3-1: Using ep0 maxpacket: 8 [ 2086.467768][ T1025] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2086.501119][ T1025] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2086.529105][ T1025] usb 3-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2086.559842][ T1025] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2086.613171][ T1025] usb 3-1: config 0 descriptor?? [ 2086.839624][ T1025] usb 6-1: USB disconnect, device number 89 [ 2087.516107][T12076] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4869'. [ 2088.225883][ T1025] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 2088.302635][ T1896] usb 3-1: USB disconnect, device number 37 [ 2088.423605][ T1025] usb 6-1: Using ep0 maxpacket: 16 [ 2088.453632][ T1025] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2088.481414][T12089] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2088.512737][ T1025] usb 6-1: New USB device found, idVendor=172f, idProduct=0034, bcdDevice= 0.00 [ 2088.534415][ T1025] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2088.671918][ T1025] usb 6-1: config 0 descriptor?? [ 2088.691515][ T1025] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 2088.875967][ T1511] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 2088.958095][ T1896] usb 6-1: USB disconnect, device number 90 [ 2089.072909][T12119] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4874'. [ 2089.077111][ T1511] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 2089.108545][ T1511] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2089.130468][ T1511] usb 3-1: Product: syz [ 2089.134646][ T1511] usb 3-1: Manufacturer: syz [ 2089.139650][ T1511] usb 3-1: SerialNumber: syz [ 2089.153520][ T1511] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 2089.186334][T24311] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 2089.238492][T12119] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4874'. [ 2089.338455][ T1511] usb 4-1: USB disconnect, device number 13 [ 2089.480528][ T1025] usb 3-1: USB disconnect, device number 38 [ 2089.974500][T12166] netlink: 'syz.5.4879': attribute type 1 has an invalid length. [ 2090.199408][T12166] 8021q: adding VLAN 0 to HW filter on device bond7 [ 2090.255582][T24311] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 2090.309158][T24311] ath9k_htc: Failed to initialize the device [ 2090.316751][T12168] vlan2: entered allmulticast mode [ 2090.339717][ T1025] usb 3-1: ath9k_htc: USB layer deinitialized [ 2090.340944][T12168] veth0_to_bond: entered allmulticast mode [ 2090.420166][T12168] bond7: (slave vlan2): Opening slave failed [ 2090.707238][ T1025] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 2090.891571][ T1025] usb 3-1: Using ep0 maxpacket: 32 [ 2090.918635][ T1025] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 2090.944841][ T1025] usb 3-1: config 0 has no interface number 0 [ 2090.965118][ T1025] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 2090.987879][ T1025] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 2091.008842][ T1025] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2091.054641][ T1025] usb 3-1: Product: syz [ 2091.077881][ T1025] usb 3-1: Manufacturer: syz [ 2091.082540][ T1025] usb 3-1: SerialNumber: syz [ 2091.130812][ T1025] usb 3-1: config 0 descriptor?? [ 2091.144444][T12203] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 2091.156191][ T7001] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 2091.310173][T12237] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4885'. [ 2091.329556][ T7001] usb 6-1: Using ep0 maxpacket: 16 [ 2091.329572][T12237] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4885'. [ 2091.355245][ T7001] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2091.383292][ T7001] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2091.401146][T12203] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 2091.418024][T12237] ip6gretap0: entered promiscuous mode [ 2091.429577][ T7001] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 2091.459463][T12237] ip6gretap0: left promiscuous mode [ 2091.483303][ T7001] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2091.522820][ T7001] usb 6-1: config 0 descriptor?? [ 2091.585107][T12245] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4886'. [ 2091.834223][T12254] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4887'. [ 2091.843653][ T1896] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 2091.930587][T12255] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2091.947314][T12255] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2092.010299][ T7001] nzxt-smart2 0003:1E71:2009.0023: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 2092.039635][ T1896] usb 4-1: config 1 has an invalid interface number: 128 but max is 1 [ 2092.069638][ T1896] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2092.120955][ T1896] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2092.158729][ T1896] usb 4-1: config 1 has no interface number 0 [ 2092.196367][ T1896] usb 4-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2092.293906][ T1896] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2092.319698][ T1896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2092.338920][ T1896] usb 4-1: Product: syz [ 2092.351274][ T1896] usb 4-1: Manufacturer: syz [ 2092.362123][ T1896] usb 4-1: SerialNumber: syz [ 2092.386811][ T1896] cdc_wdm 4-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2092.576366][ T1896] usb 6-1: USB disconnect, device number 91 [ 2092.784945][T12234] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2093.288791][ T1025] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 2093.333298][T12292] netlink: 'syz.5.4888': attribute type 1 has an invalid length. [ 2093.341273][ T1025] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 2093.386299][ T1025] asix 3-1:0.188: probe with driver asix failed with error -71 [ 2093.420003][T12294] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4888'. [ 2093.464459][ T1025] usb 3-1: USB disconnect, device number 39 [ 2093.522893][ T4510] udevd[4510]: setting mode of /dev/bus/usb/003/039 to 020664 failed: No such file or directory [ 2093.539089][T12292] 8021q: adding VLAN 0 to HW filter on device bond8 [ 2093.580434][ T4510] udevd[4510]: setting owner of /dev/bus/usb/003/039 to uid=0, gid=0 failed: No such file or directory [ 2094.025861][ T1025] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 2094.205822][ T1025] usb 6-1: Using ep0 maxpacket: 16 [ 2094.222966][ T1025] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2094.259394][ T1025] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2094.272824][T12343] bridge0: entered promiscuous mode [ 2094.300584][T12343] macsec1: entered promiscuous mode [ 2094.306349][T12343] macsec1: entered allmulticast mode [ 2094.316670][T12343] bridge0: entered allmulticast mode [ 2094.337922][ T1025] usb 6-1: New USB device found, idVendor=06cd, idProduct=011c, bcdDevice=9a.2b [ 2094.354254][T12343] bridge0: port 2(macsec1) entered blocking state [ 2094.374690][ T1025] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2094.390588][T12343] bridge0: port 2(macsec1) entered disabled state [ 2094.400576][ T1025] usb 6-1: Product: syz [ 2094.404975][ T1025] usb 6-1: Manufacturer: syz [ 2094.426111][ T1025] usb 6-1: SerialNumber: syz [ 2094.437007][ T1025] usb 6-1: config 0 descriptor?? [ 2094.458573][T12343] bridge0: left allmulticast mode [ 2094.472983][T12343] bridge0: left promiscuous mode [ 2094.612154][T24311] usb 4-1: USB disconnect, device number 14 [ 2095.583062][T12378] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2095.629403][T12378] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2095.885841][T12378] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2095.940869][T12378] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2096.628879][T12398] ip6gre1: entered promiscuous mode [ 2096.648478][T12398] ip6gre1: entered allmulticast mode [ 2096.670582][T12401] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2097.137821][T12416] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4902'. [ 2097.514724][ T1896] usb 6-1: USB disconnect, device number 92 [ 2097.545920][T24311] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 2097.686412][T16523] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2097.729483][T16523] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2097.737672][ T1511] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2097.770883][T24311] usb 4-1: config 1 has an invalid interface number: 128 but max is 1 [ 2097.866021][T24311] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2097.934153][T24311] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2097.970769][T12396] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2097.982398][T24311] usb 4-1: config 1 has no interface number 0 [ 2098.001441][T24311] usb 4-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2098.016200][T12434] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4904'. [ 2098.066850][T24311] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2098.084509][T24311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2098.084541][T24311] usb 4-1: Product: syz [ 2098.084552][T24311] usb 4-1: Manufacturer: syz [ 2098.084561][T24311] usb 4-1: SerialNumber: syz [ 2098.100333][T24311] cdc_wdm 4-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2098.407162][T24311] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2098.454755][T12445] netlink: set zone limit has 4 unknown bytes [ 2098.516676][ T1896] usb 6-1: new full-speed USB device number 93 using dummy_hcd [ 2098.686758][ T1896] usb 6-1: config 1 has an invalid interface number: 128 but max is 1 [ 2098.702211][ T1896] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2098.726625][T24311] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2098.735080][ T1896] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2098.761720][ T1896] usb 6-1: config 1 has no interface number 0 [ 2098.826122][ T1896] usb 6-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2098.909516][ T1896] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2098.942458][ T1896] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2098.981434][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2098.988177][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2098.997396][ T1896] usb 6-1: Product: syz [ 2099.012609][ T1896] usb 6-1: Manufacturer: syz [ 2099.033416][ T1896] usb 6-1: SerialNumber: syz [ 2099.076391][ T1896] cdc_wdm 6-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2099.265885][ T1896] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 2099.281665][T12464] x_tables: unsorted entry at hook 2 [ 2099.352436][T12469] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4909'. [ 2099.446530][ T1896] usb 3-1: Using ep0 maxpacket: 16 [ 2099.469438][ T1896] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2099.484567][ T1896] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2099.502831][ T1896] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2099.520649][ T1896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2099.541196][ T1896] usb 3-1: Product: syz [ 2099.548502][ T1896] usb 3-1: Manufacturer: syz [ 2099.554458][ T1896] usb 3-1: SerialNumber: syz [ 2099.788904][ T1896] usb 3-1: 0:2 : does not exist [ 2099.811966][ T1896] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 2099.850718][T12494] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4912'. [ 2099.934425][ T1896] usb 3-1: USB disconnect, device number 40 [ 2100.014557][ T7478] udevd[7478]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2100.148973][T12524] No such timeout policy "syz1" [ 2100.157687][ T1025] usb 4-1: USB disconnect, device number 15 [ 2100.264797][T12530] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 2100.853094][ T1025] usb 6-1: USB disconnect, device number 93 [ 2101.388569][T24311] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 2101.588177][T24311] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2101.646180][T24311] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2101.669854][T24311] usb 4-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2101.738907][T24311] usb 4-1: config 1 interface 0 has no altsetting 1 [ 2101.758552][T24311] usb 4-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 2101.767998][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2101.807336][T24311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2101.835724][T24311] usb 4-1: Product: syz [ 2101.850286][T24311] usb 4-1: Manufacturer: syz [ 2101.854969][T24311] usb 4-1: SerialNumber: syz [ 2101.920926][T24311] smsusb:smsusb_probe: board id=8, interface number 0 [ 2102.048713][T12556] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2102.111138][T24311] smsusb:smsusb_probe: Device initialized with return code -19 [ 2102.325579][T12582] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4921'. [ 2102.416092][T12582] netlink: 'syz.3.4921': attribute type 13 has an invalid length. [ 2102.473394][T12582] gretap0: refused to change device tx_queue_len [ 2102.496706][T12582] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 2102.600281][T24311] usb 4-1: USB disconnect, device number 16 [ 2104.077246][T12645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2104.118463][T12645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2104.166860][T12645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2104.197966][T12645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2104.785853][T27331] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 2104.995891][T27331] usb 3-1: Using ep0 maxpacket: 16 [ 2105.032311][T27331] usb 3-1: config 0 has no interfaces? [ 2105.077038][T27331] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2105.100704][T27331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2105.145241][T27331] usb 3-1: Product: syz [ 2105.153712][T27331] usb 3-1: Manufacturer: syz [ 2105.164331][T27331] usb 3-1: SerialNumber: syz [ 2105.202911][T27331] usb 3-1: config 0 descriptor?? [ 2105.384935][T12666] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4935'. [ 2105.396092][ T1025] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 2105.412403][T12666] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2105.451357][T12666] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2105.645849][ T1025] usb 6-1: Using ep0 maxpacket: 16 [ 2105.681843][ T1025] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2105.718524][ T1025] usb 6-1: config 0 has no interfaces? [ 2105.738240][ T1025] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 2105.765395][ T1025] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2105.839005][ T1025] usb 6-1: config 0 descriptor?? [ 2105.869762][T12685] binder_alloc: 12683: pid 12683 spamming oneway? 1 buffers allocated for a total size of 4096 [ 2105.883451][T12685] binder_alloc: 12683: pid 12683 spamming oneway? 2 buffers allocated for a total size of 5120 [ 2105.992947][T12682] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4937'. [ 2106.096146][ T29] audit: type=1804 audit(1772360512.718:1919): pid=12693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.4940" name="/newroot/984/file1" dev="fuse" ino=1 res=1 errno=0 [ 2106.311862][T12700] syzkaller0: entered promiscuous mode [ 2106.332914][T12700] syzkaller0: entered allmulticast mode [ 2106.490415][T24311] usb 6-1: USB disconnect, device number 94 [ 2106.668423][T12715] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 2107.175810][T27331] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 2107.297882][T12737] bridge0: entered promiscuous mode [ 2107.310007][T12737] macsec2: entered promiscuous mode [ 2107.339996][T12737] macsec2: entered allmulticast mode [ 2107.346586][T27331] usb 6-1: Using ep0 maxpacket: 16 [ 2107.365424][T27331] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 2107.377315][T12737] bridge0: entered allmulticast mode [ 2107.395797][T27331] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2107.407095][T12737] bridge0: port 1(macsec2) entered blocking state [ 2107.414640][T12737] bridge0: port 1(macsec2) entered disabled state [ 2107.423981][T27331] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2107.459252][T27331] usb 6-1: Product: syz [ 2107.474153][T27331] usb 6-1: Manufacturer: syz [ 2107.511183][T27331] usb 6-1: SerialNumber: syz [ 2107.532171][T12743] kvm: pic: non byte write [ 2107.544501][T27331] usb 6-1: config 0 descriptor?? [ 2107.573340][T27331] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2107.610496][T27331] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 2107.673845][ T1025] usb 3-1: USB disconnect, device number 41 [ 2107.760225][T12737] bridge0: left allmulticast mode [ 2107.772384][T12737] bridge0: left promiscuous mode [ 2108.173218][T27331] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 2108.608777][T27331] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 2108.651368][T27331] em28xx 6-1:0.0: board has no eeprom [ 2108.775826][T27331] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 2108.846567][T27331] em28xx 6-1:0.0: dvb set to bulk mode. [ 2108.877877][ T1025] em28xx 6-1:0.0: Binding DVB extension [ 2108.934475][T27331] usb 6-1: USB disconnect, device number 95 [ 2108.973001][T12778] macsec0: entered promiscuous mode [ 2109.022775][T12778] macsec0: entered allmulticast mode [ 2109.029516][T12778] bridge0: entered allmulticast mode [ 2109.046321][T27331] em28xx 6-1:0.0: Disconnecting em28xx [ 2109.106825][T12778] bridge0: port 5(macsec0) entered blocking state [ 2109.138338][T12778] bridge0: port 5(macsec0) entered disabled state [ 2109.257367][ T1025] em28xx 6-1:0.0: Registering input extension [ 2109.285951][T12778] bridge0: left allmulticast mode [ 2109.304395][T27331] em28xx 6-1:0.0: Closing input extension [ 2109.451747][T27331] em28xx 6-1:0.0: Freeing device [ 2109.845932][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2111.496080][ T1720] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 2111.676427][ T1720] usb 3-1: Using ep0 maxpacket: 32 [ 2111.695378][ T1720] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 2111.746781][ T1720] usb 3-1: config 0 has no interface number 0 [ 2111.753119][ T1720] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 2111.805326][T12852] netlink: 'syz.3.4960': attribute type 4 has an invalid length. [ 2111.822050][ T1720] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 2111.858121][T12852] netlink: 'syz.3.4960': attribute type 4 has an invalid length. [ 2111.868835][ T1720] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2111.885202][T12853] picdev_read: 77 callbacks suppressed [ 2111.885217][T12853] kvm: pic: non byte read [ 2111.901302][ T1720] usb 3-1: Product: syz [ 2111.918106][ T1720] usb 3-1: Manufacturer: syz [ 2111.924679][T12853] kvm: pic: non byte read [ 2111.934136][ T1720] usb 3-1: SerialNumber: syz [ 2111.941032][T12853] kvm: pic: non byte read [ 2111.961029][T12853] kvm: pic: non byte read [ 2111.968565][ T1720] usb 3-1: config 0 descriptor?? [ 2111.982061][T12853] kvm: pic: non byte read [ 2111.989597][T12842] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 2112.011748][T12853] kvm: pic: non byte read [ 2112.031641][T12853] kvm: pic: non byte read [ 2112.042922][T12853] kvm: pic: non byte read [ 2112.055799][T12853] kvm: pic: non byte read [ 2112.073787][T12853] kvm: pic: non byte read [ 2112.244801][T12842] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 2113.492939][T12884] netlink: 'syz.0.4966': attribute type 1 has an invalid length. [ 2113.654384][T12890] bond10: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 2113.702203][T12890] bond10: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 2113.778760][T12890] bond10: (slave ipvlan0): Setting fail_over_mac to active for active-backup mode [ 2114.518824][ T1720] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 2114.572122][ T1720] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 2114.609207][ T1720] asix 3-1:0.188: probe with driver asix failed with error -71 [ 2114.672736][ T1720] usb 3-1: USB disconnect, device number 42 [ 2114.877392][T12947] syzkaller0: entered promiscuous mode [ 2114.893200][T12947] syzkaller0: entered allmulticast mode [ 2114.956617][T12951] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3089888063 (3089888063 ns) > initial count (2126324423 ns). Using initial count to start timer. [ 2115.811828][T12979] macsec1: entered promiscuous mode [ 2115.871098][T12979] bridge0: entered promiscuous mode [ 2115.986450][T12979] macsec1: entered allmulticast mode [ 2116.055866][T12979] bridge0: entered allmulticast mode [ 2116.418384][T12979] bridge0: port 3(macsec1) entered blocking state [ 2116.434089][T12979] bridge0: port 3(macsec1) entered disabled state [ 2116.473995][T12979] bridge0: left allmulticast mode [ 2116.479474][T12979] bridge0: left promiscuous mode [ 2117.004136][T13005] syzkaller0: entered promiscuous mode [ 2117.025037][T13005] syzkaller0: entered allmulticast mode [ 2118.234021][T13033] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2119.408715][T13069] syzkaller0: entered promiscuous mode [ 2119.425933][T13069] syzkaller0: entered allmulticast mode [ 2119.537179][T13068] xt_TPROXY: Can be used only with -p tcp or -p udp [ 2119.588592][T13075] netlink: 'syz.4.4994': attribute type 1 has an invalid length. [ 2119.716175][T13075] 8021q: adding VLAN 0 to HW filter on device bond4 [ 2119.752518][T13101] vlan3: entered allmulticast mode [ 2119.779586][T13101] bond4: entered allmulticast mode [ 2119.879130][T27331] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 2119.910870][T13118] bond4: (slave gretap4): making interface the new active one [ 2119.921880][T13118] gretap4: entered allmulticast mode [ 2119.933045][T13118] bond4: (slave gretap4): Enslaving as an active interface with an up link [ 2120.045814][T27331] usb 6-1: device descriptor read/64, error -71 [ 2120.314180][T27331] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 2120.541537][T27331] usb 6-1: device descriptor read/64, error -71 [ 2120.660759][T27331] usb usb6-port1: attempt power cycle [ 2121.058317][T27331] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 2121.106424][T27331] usb 6-1: device descriptor read/8, error -71 [ 2121.185874][T13181] vlan0: entered promiscuous mode [ 2121.365980][T27331] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 2121.410987][T27331] usb 6-1: device descriptor read/8, error -71 [ 2121.417995][T13187] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5003'. [ 2121.462295][T13187] netlink: 168 bytes leftover after parsing attributes in process `syz.3.5003'. [ 2121.556218][T27331] usb usb6-port1: unable to enumerate USB device [ 2121.663916][T13191] syzkaller0: entered promiscuous mode [ 2121.675766][T13191] syzkaller0: entered allmulticast mode [ 2122.781685][T13198] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2124.136069][T13239] syzkaller0: entered promiscuous mode [ 2124.185698][T13239] syzkaller0: entered allmulticast mode [ 2124.216994][T13247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2124.256487][T13247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2125.921523][T13280] netlink: 'syz.5.5021': attribute type 1 has an invalid length. [ 2126.064346][T13280] 8021q: adding VLAN 0 to HW filter on device bond9 [ 2126.243199][T13289] bond9: (slave gretap2): making interface the new active one [ 2126.305092][T13289] bond9: (slave gretap2): Enslaving as an active interface with an up link [ 2126.496007][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2127.692095][T13326] syzkaller0: entered promiscuous mode [ 2127.710867][T13326] syzkaller0: entered allmulticast mode [ 2127.876809][T13326] tipc: Started in network mode [ 2127.903682][T13326] tipc: Node identity 1ee38ac7a692, cluster identity 4711 [ 2127.951160][T13326] tipc: Enabled bearer , priority 0 [ 2128.036043][T13325] tipc: Resetting bearer [ 2128.220133][T13325] tipc: Disabling bearer [ 2128.357886][T13349] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 2128.410107][T13343] syzkaller0: entered promiscuous mode [ 2128.448463][T13343] syzkaller0: entered allmulticast mode [ 2128.534395][T13354] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5027'. [ 2128.756642][T13354] 8021q: adding VLAN 0 to HW filter on device bond10 [ 2128.860843][T13357] macvlan2: entered promiscuous mode [ 2128.899872][T13357] macvlan2: entered allmulticast mode [ 2128.936822][T13357] bond10: entered promiscuous mode [ 2128.987335][T13357] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 2129.022621][T13357] team0: Port device macvlan2 added [ 2129.659900][T13417] syzkaller0: entered promiscuous mode [ 2129.683006][T13417] syzkaller0: entered allmulticast mode [ 2129.683032][T13425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2129.706649][T13425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2129.724900][T13427] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5030'. [ 2129.777935][T13421] syzkaller0: entered promiscuous mode [ 2129.783455][T13421] syzkaller0: entered allmulticast mode [ 2129.793261][T13421] TC_ACT_REPEAT abuse ? [ 2130.352897][T13448] syzkaller0: entered promiscuous mode [ 2130.374133][T13448] syzkaller0: entered allmulticast mode [ 2131.766179][ T1896] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 2131.804081][ T29] audit: type=1326 audit(1772360538.418:1920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13484 comm="syz.5.5041" exe="/root/syz-executor" sig=9 arch=c000003e syscall=39 compat=0 ip=0x7f3d79596517 code=0x0 [ 2131.985836][ T1896] usb 4-1: Using ep0 maxpacket: 32 [ 2132.001834][ T1896] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 2132.061676][ T1896] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 2132.124557][ T1896] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2132.173950][ T1896] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 2132.263079][ T1896] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2132.320624][ T1896] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 2132.364436][ T1896] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 2132.401901][ T1896] usb 4-1: Product: syz [ 2132.427091][ T1896] usb 4-1: Manufacturer: syz [ 2132.449537][ T1896] usb 4-1: SerialNumber: syz [ 2132.490953][ T1896] usb 4-1: config 0 descriptor?? [ 2132.523716][ T1896] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 2132.582943][ T1896] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 2132.911670][T13499] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5043'. [ 2132.971907][T13479] ldusb 4-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 2132.979884][T27331] usb 4-1: USB disconnect, device number 17 [ 2132.985976][ C1] ldusb 4-1:0.0: usb_submit_urb failed (-19) [ 2133.106089][T27331] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 2133.109365][T13502] ldusb: No device or device unplugged -19 [ 2133.676076][T27331] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 2133.746103][ T1720] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 2133.848699][T27331] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 2133.867841][T13536] macsec1: entered promiscuous mode [ 2133.874188][T27331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2133.893607][T13536] bridge0: entered promiscuous mode [ 2133.911897][T13536] macsec1: entered allmulticast mode [ 2133.921074][T13536] bridge0: entered allmulticast mode [ 2133.946065][ T1720] usb 4-1: Using ep0 maxpacket: 16 [ 2133.952748][T27331] usb 3-1: Product: syz [ 2133.957526][T27331] usb 3-1: Manufacturer: syz [ 2133.963123][ T1720] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 2133.971786][ T1720] usb 4-1: config 0 has no interface number 0 [ 2133.980403][T27331] usb 3-1: SerialNumber: syz [ 2133.989580][T13536] bridge0: left allmulticast mode [ 2133.995122][T13536] bridge0: left promiscuous mode [ 2134.030384][ T1720] usb 4-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 2134.072306][ T1720] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2134.126713][ T1720] usb 4-1: Product: syz [ 2134.144320][ T1720] usb 4-1: Manufacturer: syz [ 2134.151478][ T1720] usb 4-1: SerialNumber: syz [ 2134.227116][ T1720] usb 4-1: config 0 descriptor?? [ 2134.274283][ T1720] hub 4-1:0.132: bad descriptor, ignoring hub [ 2134.282967][ T1720] hub 4-1:0.132: probe with driver hub failed with error -5 [ 2134.329913][ T1720] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.132/input/input118 [ 2134.534559][T27331] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 2134.576540][T27331] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 2134.615184][T13532] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2134.634922][ T1720] usb 4-1: USB disconnect, device number 18 [ 2135.068842][T13565] syzkaller0: entered promiscuous mode [ 2135.074487][T13565] syzkaller0: entered allmulticast mode [ 2135.590987][T13585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2135.613172][T13585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2135.695966][ T1896] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 2135.856696][ T1896] usb 6-1: Using ep0 maxpacket: 16 [ 2135.885527][ T1896] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 2135.893918][ T1896] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2135.918053][ T1896] usb 6-1: config 0 has no interface number 0 [ 2135.924805][ T1896] usb 6-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2135.977431][ T1896] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 2135.986762][ T1896] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 2135.994886][ T1896] usb 6-1: Product: syz [ 2135.999581][ T1896] usb 6-1: SerialNumber: syz [ 2136.020600][ T1896] usb 6-1: config 0 descriptor?? [ 2136.053034][ T1896] usbhid 6-1:0.8: couldn't find an input interrupt endpoint [ 2136.902157][T27331] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): EEPROM is busy [ 2137.102006][T27331] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 2137.131869][T27331] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 2137.156806][T27331] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 2137.180349][T27331] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 2137.202414][T27331] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 2137.224650][T27331] usb 3-1: USB disconnect, device number 43 [ 2138.905279][T13576] : renamed from vlan0 (while UP) [ 2138.968773][ T1896] usb 6-1: USB disconnect, device number 100 [ 2139.346471][T13637] tipc: Enabled bearer , priority 0 [ 2139.353591][T13652] syzkaller0: entered promiscuous mode [ 2139.361940][T13652] syzkaller0: entered allmulticast mode [ 2139.456635][T13652] tipc: Resetting bearer [ 2139.464325][T13633] tipc: Resetting bearer [ 2139.490325][T13633] tipc: Disabling bearer [ 2140.089198][T13687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2140.126857][T13687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2141.002130][T13691] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2141.706938][T13696] macsec1: entered promiscuous mode [ 2141.712258][T13696] bridge0: entered promiscuous mode [ 2141.903559][T13696] macsec1: entered allmulticast mode [ 2141.910425][T13696] bridge0: entered allmulticast mode [ 2141.916707][T13696] bridge0: port 3(macsec1) entered blocking state [ 2141.928161][T13696] bridge0: port 3(macsec1) entered disabled state [ 2141.937816][T13696] bridge0: left allmulticast mode [ 2141.942903][T13696] bridge0: left promiscuous mode [ 2141.962115][T13708] tipc: Enabled bearer , priority 0 [ 2141.969482][T13709] syzkaller0: entered promiscuous mode [ 2141.975206][T13709] syzkaller0: entered allmulticast mode [ 2141.987347][T13713] tipc: Resetting bearer [ 2141.995055][T13704] tipc: Resetting bearer [ 2142.016744][T13704] tipc: Disabling bearer [ 2142.244224][T13729] netlink: 'syz.0.5066': attribute type 13 has an invalid length. [ 2142.561860][T13745] syzkaller0: entered promiscuous mode [ 2142.588632][T13745] syzkaller0: entered allmulticast mode [ 2142.614969][T13745] 0: reclassify loop, rule prio 0, protocol 800 [ 2142.742344][T13758] tipc: Enabled bearer , priority 0 [ 2142.781759][T13758] syzkaller0: entered promiscuous mode [ 2142.796692][T13758] syzkaller0: entered allmulticast mode [ 2142.840269][T13758] tipc: Resetting bearer [ 2142.852631][T13750] tipc: Resetting bearer [ 2142.938949][T13750] tipc: Disabling bearer [ 2143.246282][T24311] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 2143.475889][T24311] usb 3-1: Using ep0 maxpacket: 8 [ 2143.493304][T24311] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2143.521024][T24311] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2143.568977][T24311] usb 3-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2143.613194][T24311] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2143.669766][T24311] usb 3-1: config 0 descriptor?? [ 2143.837594][T13788] tipc: Enabled bearer , priority 0 [ 2143.857540][T13788] syzkaller0: entered promiscuous mode [ 2143.875201][T13788] syzkaller0: entered allmulticast mode [ 2143.922286][T13788] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 2144.007059][T13788] tipc: Resetting bearer [ 2144.045529][T13787] tipc: Resetting bearer [ 2144.136058][T13787] tipc: Disabling bearer [ 2144.796062][T13799] syzkaller0: entered promiscuous mode [ 2144.802007][T13799] syzkaller0: entered allmulticast mode [ 2145.607935][ T1720] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 2145.777072][ T1720] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2145.817935][ T1720] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2145.827006][ T1720] usb 4-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2145.855447][ T1720] usb 4-1: config 1 interface 0 has no altsetting 1 [ 2145.893947][ T1720] usb 4-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 2145.915113][ T1720] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2145.923967][ T1720] usb 4-1: Product: syz [ 2145.928668][ T1720] usb 4-1: Manufacturer: syz [ 2145.933306][ T1720] usb 4-1: SerialNumber: syz [ 2145.967034][ T1720] smsusb:smsusb_probe: board id=8, interface number 0 [ 2146.172621][ T1720] smsusb:smsusb_probe: Device initialized with return code -19 [ 2146.447258][T13808] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5081'. [ 2146.541154][T13808] netlink: 'syz.3.5081': attribute type 13 has an invalid length. [ 2146.722067][T24311] usb 3-1: USB disconnect, device number 44 [ 2147.743714][T13805] macsec0: entered promiscuous mode [ 2147.749307][T13805] macsec0: entered allmulticast mode [ 2147.754745][T13805] bridge0: entered allmulticast mode [ 2147.762044][T13805] bridge0: port 5(macsec0) entered blocking state [ 2147.769609][T13805] bridge0: port 5(macsec0) entered disabled state [ 2147.779674][T13805] bridge0: left allmulticast mode [ 2147.941710][T13808] gretap0: refused to change device tx_queue_len [ 2147.976598][T13808] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 2148.305254][T13858] tipc: Enabled bearer , priority 0 [ 2148.313302][T13858] syzkaller0: entered promiscuous mode [ 2148.319377][T13858] syzkaller0: entered allmulticast mode [ 2148.387054][T13856] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 2148.411112][T13858] tipc: Resetting bearer [ 2148.433284][T13857] tipc: Resetting bearer [ 2148.463244][T13857] tipc: Disabling bearer [ 2148.721458][T13869] syzkaller0: entered promiscuous mode [ 2148.732804][T13869] syzkaller0: entered allmulticast mode [ 2149.081339][T13880] syzkaller0: entered promiscuous mode [ 2149.107206][T13880] syzkaller0: entered allmulticast mode [ 2149.131432][ T1720] usb 4-1: USB disconnect, device number 19 [ 2149.327557][ T8570] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2149.346908][ T8570] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 20001 - 0 [ 2149.732046][T13912] netlink: 'syz.2.5095': attribute type 1 has an invalid length. [ 2149.917144][T24311] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 2150.066096][ T1720] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 2150.107291][T24311] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 2150.187490][T24311] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 2150.236535][T13928] bridge0: entered promiscuous mode [ 2150.244258][T24311] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 2150.278812][T13928] macsec1: entered promiscuous mode [ 2150.316378][ T1720] usb 6-1: Using ep0 maxpacket: 8 [ 2150.327859][T13928] macsec1: entered allmulticast mode [ 2150.333332][T13928] bridge0: entered allmulticast mode [ 2150.358173][T24311] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 2150.390997][T13928] bridge0: port 2(macsec1) entered blocking state [ 2150.411489][T13928] bridge0: port 2(macsec1) entered disabled state [ 2150.430089][T24311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2150.454790][T24311] usb 4-1: Product: syz [ 2150.463690][ T1720] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2150.502480][ T1720] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2150.528412][T24311] usb 4-1: Manufacturer: syz [ 2150.542086][T13928] bridge0: left allmulticast mode [ 2150.551823][T24311] usb 4-1: SerialNumber: syz [ 2150.567577][ T1720] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2150.584179][T13928] bridge0: left promiscuous mode [ 2150.610747][T24311] usb 4-1: config 0 descriptor?? [ 2150.623081][ T1720] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2150.678679][T13907] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 2150.710262][T13907] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 2150.740011][ T1720] usb 6-1: config 0 descriptor?? [ 2150.818214][T24311] usb 4-1: ucan: probing device on interface #0 [ 2151.013794][T24311] usb 4-1: ucan: device protocol version 808464432 is not supported [ 2151.072806][T24311] usb 4-1: ucan: probe failed; try to update the device firmware [ 2152.373587][T13956] bond0: (slave dummy0): Releasing backup interface [ 2152.418633][T13956] bridge0: port 1(bridge_slave_0) entered disabled state [ 2152.458703][T13960] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5101'. [ 2152.657315][T24311] usb 6-1: USB disconnect, device number 101 [ 2153.334301][T13956] bridge_slave_1: left allmulticast mode [ 2153.352843][T13956] bridge0: port 2(bridge_slave_1) entered disabled state [ 2153.377641][T13956] bond0: (slave bond_slave_0): Releasing backup interface [ 2153.401875][T13956] bond0: (slave bond_slave_1): Releasing backup interface [ 2153.437293][T13956] team0: Port device team_slave_0 removed [ 2153.463296][T13956] team0: Port device team_slave_1 removed [ 2153.488568][T13956] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 2153.621475][ T1896] usb 4-1: USB disconnect, device number 20 [ 2153.718006][T13991] tipc: Enabled bearer , priority 0 [ 2153.749811][T13980] syzkaller0: entered promiscuous mode [ 2153.776041][T13980] syzkaller0: entered allmulticast mode [ 2153.926991][T13980] tipc: Resetting bearer [ 2154.033126][T13979] tipc: Resetting bearer [ 2154.197197][T13979] tipc: Disabling bearer [ 2154.402389][T14018] syzkaller0: entered promiscuous mode [ 2154.469874][T14018] syzkaller0: entered allmulticast mode [ 2156.474086][ T1896] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 2156.668939][ T1896] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2156.744706][ T1896] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2156.887903][ T1896] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 2156.966503][ T1720] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 2156.989018][ T1896] usb 3-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 2157.063624][ T1896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2157.086750][ T1896] usb 3-1: Product: syz [ 2157.119761][ T1896] usb 3-1: Manufacturer: syz [ 2157.136074][ T1720] usb 6-1: Using ep0 maxpacket: 8 [ 2157.151912][ T1720] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2157.182421][ T1720] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2157.204124][ T1896] usb 3-1: SerialNumber: syz [ 2157.204155][ T1720] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2157.245021][ T1720] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2157.279991][ T1720] usb 6-1: config 0 descriptor?? [ 2157.845934][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2157.875264][T14071] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5112'. [ 2157.907907][T14071] netlink: 'syz.2.5112': attribute type 13 has an invalid length. [ 2157.952230][ T29] audit: type=1804 audit(1772360564.568:1921): pid=14069 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.5114" name="/newroot/1016/file1" dev="fuse" ino=1 res=1 errno=0 [ 2158.341206][ T29] audit: type=1804 audit(1772360564.958:1922): pid=14076 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.5115" name="/newroot/1017/file1" dev="fuse" ino=1 res=1 errno=0 [ 2160.038087][T27331] usb 6-1: USB disconnect, device number 102 [ 2160.417886][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2160.424171][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2161.185446][T14071] gretap0: refused to change device tx_queue_len [ 2161.220447][T14071] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 2161.391566][T14107] syzkaller0: entered promiscuous mode [ 2161.420959][T14107] syzkaller0: entered allmulticast mode [ 2161.425772][T27331] usb 3-1: USB disconnect, device number 45 [ 2162.319050][T14131] syzkaller0: entered promiscuous mode [ 2162.334064][T14131] syzkaller0: entered allmulticast mode [ 2162.361160][T14131] TC_ACT_REPEAT abuse ? [ 2162.374482][T14136] [U] V3Fپ"S/4:XTZWTLW= [ 2162.699721][T14141] syzkaller0: entered promiscuous mode [ 2162.741255][T14141] syzkaller0: entered allmulticast mode [ 2162.878702][T14145] syzkaller0: entered promiscuous mode [ 2162.892938][T14145] syzkaller0: entered allmulticast mode [ 2163.255803][ T1720] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 2163.416809][T14127] [U] J"E:" [ 2163.426164][ T1720] usb 6-1: Using ep0 maxpacket: 16 [ 2163.452693][ T1720] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 2163.484670][ T1720] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2163.509966][ T1720] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 2163.596706][T14171] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5129'. [ 2163.597488][ T1720] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2163.658832][T14171] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2163.787388][T14171] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2163.840178][ T1720] usb 6-1: Product: syz [ 2163.852190][ T1720] usb 6-1: Manufacturer: syz [ 2163.868971][ T1720] usb 6-1: SerialNumber: syz [ 2163.919530][ T1720] usb 6-1: config 0 descriptor?? [ 2163.958160][ T1720] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 2163.994785][ T1720] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 2164.256388][ T1896] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 2164.301318][T14193] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 2164.321395][T14193] syzkaller0: entered promiscuous mode [ 2164.330249][T14193] syzkaller0: entered allmulticast mode [ 2164.361964][T14193] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5133'. [ 2164.428493][ T1896] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2164.440563][ T1896] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2164.476622][ T1896] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 2164.527622][ T1896] usb 3-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 2164.553365][ T1896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2164.570275][ T1720] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 2164.585231][ T1896] usb 3-1: Product: syz [ 2164.592696][ T1720] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 2164.617766][ T1896] usb 3-1: Manufacturer: syz [ 2164.648129][ T1896] usb 3-1: SerialNumber: syz [ 2165.221418][T14213] syzkaller0: entered promiscuous mode [ 2165.238688][ T1720] em28xx 6-1:0.0: Unknown AC97 audio processor detected! [ 2165.253560][T14213] syzkaller0: entered allmulticast mode [ 2165.327212][ T1720] em28xx 6-1:0.0: couldn't setup AC97 register 2 [ 2165.342696][ T1720] em28xx 6-1:0.0: couldn't setup AC97 register 4 [ 2165.413725][T14220] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5131'. [ 2165.433724][T14220] netlink: 'syz.2.5131': attribute type 13 has an invalid length. [ 2165.468680][T14220] gretap0: refused to change device tx_queue_len [ 2165.482595][T14220] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 2166.059039][T14227] syzkaller0: entered promiscuous mode [ 2166.084200][T14227] syzkaller0: entered allmulticast mode [ 2166.111273][T14230] 0: reclassify loop, rule prio 0, protocol 700 [ 2166.255144][ T1720] em28xx 6-1:0.0: couldn't setup AC97 register 54 [ 2166.268582][ T1720] em28xx 6-1:0.0: couldn't setup AC97 register 56 [ 2166.322586][ T1720] usb 6-1: USB disconnect, device number 103 [ 2166.468574][T14241] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 2166.508668][T14241] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 2166.546399][T14241] syzkaller0: entered promiscuous mode [ 2166.554293][T14241] syzkaller0: entered allmulticast mode [ 2166.785937][T14255] tipc: Enabled bearer , priority 0 [ 2166.810630][T14255] syzkaller0: entered promiscuous mode [ 2166.817996][T14255] syzkaller0: entered allmulticast mode [ 2166.859173][T14255] tipc: Resetting bearer [ 2166.875517][T14254] tipc: Resetting bearer [ 2166.902551][T14254] tipc: Disabling bearer [ 2167.370642][ T1511] usb 3-1: USB disconnect, device number 46 [ 2168.286969][T14277] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2169.124019][T14310] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5148'. [ 2169.133835][T14309] tipc: Enabled bearer , priority 0 [ 2169.162138][T14322] syzkaller0: entered promiscuous mode [ 2169.173935][T14322] syzkaller0: entered allmulticast mode [ 2169.189840][T14309] syzkaller0: entered promiscuous mode [ 2169.196159][T14309] syzkaller0: entered allmulticast mode [ 2169.308777][T14309] tipc: Resetting bearer [ 2169.383154][T14308] tipc: Resetting bearer [ 2169.453084][T14308] tipc: Disabling bearer [ 2169.459609][ T1896] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 2169.632894][ T1896] usb 4-1: config 1 has an invalid interface number: 128 but max is 1 [ 2169.641681][ T1511] usb 3-1: new full-speed USB device number 47 using dummy_hcd [ 2169.687195][ T1896] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2169.728752][ T1896] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2169.774304][ T1896] usb 4-1: config 1 has no interface number 0 [ 2169.799419][ T1896] usb 4-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2169.838178][ T1511] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2169.885410][ T1896] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2169.900127][ T1511] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2169.955917][ T1896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2169.967398][ T1511] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 128, setting to 64 [ 2169.990843][ T1896] usb 4-1: Product: syz [ 2170.014773][ T1896] usb 4-1: Manufacturer: syz [ 2170.062699][ T1511] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 2170.073748][ T1896] usb 4-1: SerialNumber: syz [ 2170.110888][ T1511] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2170.125874][ T1511] usb 3-1: Product: syz [ 2170.153763][ T1896] cdc_wdm 4-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2170.162869][ T1511] usb 3-1: Manufacturer: syz [ 2170.165870][T14350] macsec1: entered promiscuous mode [ 2170.172927][T14350] bridge0: entered promiscuous mode [ 2170.178317][ T1511] usb 3-1: SerialNumber: syz [ 2170.248072][T14350] macsec1: entered allmulticast mode [ 2170.289196][ T1511] usb 3-1: config 0 descriptor?? [ 2170.295584][T14350] bridge0: entered allmulticast mode [ 2170.316262][T14333] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 2170.358811][T14350] bridge0: port 3(macsec1) entered blocking state [ 2170.397716][T14350] bridge0: port 3(macsec1) entered disabled state [ 2170.497784][T14350] bridge0: left allmulticast mode [ 2170.522096][T14350] bridge0: left promiscuous mode [ 2170.582476][ T1511] rc_core: IR keymap rc-streamzap not found [ 2170.612025][T14333] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 2170.618595][T14333] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 2170.629853][ T1511] Registered IR keymap rc-empty [ 2170.658414][ T1511] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 2170.716548][T14333] vhci_hcd vhci_hcd.0: Device attached [ 2170.750867][ T1511] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input119 [ 2170.895993][ T1896] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 2170.975977][ T1896] usb 37-1: new full-speed USB device number 2 using vhci_hcd [ 2171.264915][T14361] vhci_hcd: connection reset by peer [ 2171.278876][ T1511] usb 3-1: USB disconnect, device number 47 [ 2171.304325][T16526] vhci_hcd vhci_hcd.2: stop threads [ 2171.325012][T16526] vhci_hcd vhci_hcd.2: release socket [ 2171.347939][T16526] vhci_hcd vhci_hcd.2: disconnect device [ 2171.692094][T14383] tipc: Enabled bearer , priority 0 [ 2171.764906][T14383] syzkaller0: entered promiscuous mode [ 2171.777476][T14383] syzkaller0: entered allmulticast mode [ 2171.873821][T14383] tipc: Resetting bearer [ 2171.929120][T14382] tipc: Resetting bearer [ 2172.057912][T14382] tipc: Disabling bearer [ 2172.426515][T27331] usb 4-1: USB disconnect, device number 21 [ 2173.459198][T14389] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2173.816957][T14421] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5162'. [ 2174.097719][T27331] usb 3-1: new full-speed USB device number 48 using dummy_hcd [ 2174.191205][T14430] lo: Caught tx_queue_len zero misconfig [ 2174.302191][T27331] usb 3-1: config 1 has an invalid interface number: 128 but max is 1 [ 2174.311026][T27331] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2174.330798][T27331] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2174.350555][T27331] usb 3-1: config 1 has no interface number 0 [ 2174.359061][T27331] usb 3-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2174.474754][T27331] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2174.501737][T27331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2174.529564][T27331] usb 3-1: Product: syz [ 2174.543110][T27331] usb 3-1: Manufacturer: syz [ 2174.554502][T27331] usb 3-1: SerialNumber: syz [ 2174.606889][T27331] cdc_wdm 3-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2174.862036][T14443] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 2175.305582][T14458] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5168'. [ 2176.075991][ T1896] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 2176.495789][T27331] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 2176.689826][T27331] usb 4-1: Using ep0 maxpacket: 8 [ 2176.715839][T27331] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2176.752204][T27331] usb 4-1: config 0 has no interfaces? [ 2176.774435][T27331] usb 4-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 2176.815096][T27331] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2176.845796][T27331] usb 4-1: Product: syz [ 2176.850020][T27331] usb 4-1: Manufacturer: syz [ 2176.854641][T27331] usb 4-1: SerialNumber: syz [ 2176.906214][T27331] usb 4-1: config 0 descriptor?? [ 2177.052632][T27331] usb 3-1: USB disconnect, device number 48 [ 2177.942904][T14495] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2178.189646][T14516] input: syz1 as /devices/virtual/input/input120 [ 2179.355101][ T1896] usb 4-1: USB disconnect, device number 22 [ 2179.980762][T14561] netlink: 'syz.5.5181': attribute type 2 has an invalid length. [ 2180.041174][T14561] !: entered promiscuous mode [ 2180.068356][T14561] netlink: 'syz.5.5181': attribute type 2 has an invalid length. [ 2180.077264][T14561] !: left promiscuous mode [ 2180.503967][T14575] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5183'. [ 2180.805983][T27331] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 2180.870437][T14535] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2181.003460][T27331] usb 4-1: config 1 has an invalid interface number: 128 but max is 1 [ 2181.047065][T27331] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2181.113081][T27331] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2181.171629][T27331] usb 4-1: config 1 has no interface number 0 [ 2181.204452][T27331] usb 4-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2181.282615][T27331] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2181.325804][T27331] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2181.357797][T27331] usb 4-1: Product: syz [ 2181.379526][T27331] usb 4-1: Manufacturer: syz [ 2181.406565][T27331] usb 4-1: SerialNumber: syz [ 2181.460582][T27331] cdc_wdm 4-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2181.858256][T14603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2181.901956][T14603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2181.966033][ T1896] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 2182.043302][T14603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2182.090456][T14603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2182.715794][ T1896] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2182.765105][ T1896] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2182.851803][ T1896] usb 3-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 2182.890121][ T1896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2182.944870][T14616] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5188'. [ 2182.960794][ T1896] usb 3-1: Product: syz [ 2182.984893][ T1896] usb 3-1: Manufacturer: syz [ 2182.999434][ T1896] usb 3-1: SerialNumber: syz [ 2183.042975][ T1896] usb 3-1: config 0 descriptor?? [ 2183.150458][T14620] vlan0: entered promiscuous mode [ 2183.178449][T14620] hsr_slave_1: entered promiscuous mode [ 2183.239105][T14620] vlan0: entered allmulticast mode [ 2183.279912][T14620] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5189'. [ 2183.649740][ T1896] usb 4-1: USB disconnect, device number 23 [ 2183.931175][T14673] dvmrp9: entered allmulticast mode [ 2183.963461][T14609] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2185.379325][T27331] usb 3-1: USB disconnect, device number 49 [ 2186.165825][ T1896] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 2186.359223][ T1896] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2186.415812][ T1896] usb 4-1: config 0 has no interfaces? [ 2186.457846][ T1896] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2186.524921][ T1896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2186.599196][ T1896] usb 4-1: Product: syz [ 2186.603476][ T1896] usb 4-1: Manufacturer: syz [ 2186.648101][ T1896] usb 4-1: SerialNumber: syz [ 2186.696160][ T1896] usb 4-1: config 0 descriptor?? [ 2186.964284][T14700] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2187.770218][T14741] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5200'. [ 2187.843338][T14741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2187.884150][T14741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2188.245840][ T1511] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 2188.435967][ T1511] usb 6-1: Using ep0 maxpacket: 8 [ 2188.453293][ T1511] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2188.528577][ T1511] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2188.597228][ T1511] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2188.669614][ T1511] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2188.716446][ T1511] usb 6-1: config 0 descriptor?? [ 2189.737790][ T1511] usb 4-1: USB disconnect, device number 24 [ 2191.286996][T27331] usb 6-1: USB disconnect, device number 104 [ 2191.448216][T14782] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5205'. [ 2191.670230][T14796] syzkaller0: entered promiscuous mode [ 2191.761533][T14796] syzkaller0: entered allmulticast mode [ 2191.839098][T14796] tipc: Enabled bearer , priority 0 [ 2191.897340][T14796] tipc: Resetting bearer [ 2191.932909][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2191.941436][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2191.991919][T14794] tipc: Resetting bearer [ 2192.049271][T14794] tipc: Disabling bearer [ 2192.493500][T14779] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2193.541454][T14834] dlm: non-version read from control device 0 [ 2193.825782][T27331] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 2193.995753][T27331] usb 6-1: Using ep0 maxpacket: 32 [ 2194.018892][T27331] usb 6-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 2194.047714][T27331] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2194.081122][T27331] usb 6-1: Product: syz [ 2194.094047][T27331] usb 6-1: Manufacturer: syz [ 2194.110608][T27331] usb 6-1: SerialNumber: syz [ 2194.134406][T27331] usb 6-1: config 0 descriptor?? [ 2194.366862][T27331] RobotFuzz Open Source InterFace, OSIF 6-1:0.0: version d4.15 found at bus 006 address 105 [ 2194.747031][ T29] audit: type=1326 audit(1772360601.368:1923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14852 comm="syz.4.5216" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f718879c799 code=0x0 [ 2194.868439][T14860] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 2195.225513][ T1896] usb 6-1: USB disconnect, device number 105 [ 2195.364493][ T29] audit: type=1326 audit(1772360601.978:1924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14885 comm="syz.2.5220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a1d79c799 code=0x7ffc0000 [ 2195.394476][ T29] audit: type=1326 audit(1772360601.978:1925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14885 comm="syz.2.5220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a1d79c799 code=0x7ffc0000 [ 2195.425801][ T29] audit: type=1326 audit(1772360601.978:1926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14885 comm="syz.2.5220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=132 compat=0 ip=0x7f5a1d79c799 code=0x7ffc0000 [ 2195.458563][ T29] audit: type=1326 audit(1772360601.978:1927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14885 comm="syz.2.5220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a1d79c799 code=0x7ffc0000 [ 2195.481506][ T29] audit: type=1326 audit(1772360601.978:1928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14885 comm="syz.2.5220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a1d79c799 code=0x7ffc0000 [ 2195.533695][ T29] audit: type=1326 audit(1772360602.048:1929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14885 comm="syz.2.5220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7f5a1d79c799 code=0x7ffc0000 [ 2195.745024][T14895] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5221'. [ 2196.489494][T14909] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5223'. [ 2197.436850][T14904] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2197.682596][T14925] netlink: 'syz.4.5225': attribute type 7 has an invalid length. [ 2198.498732][T14933] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 2198.859894][T14937] syzkaller0: entered promiscuous mode [ 2198.889651][T14937] syzkaller0: entered allmulticast mode [ 2199.314834][T14948] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 2199.334120][T14948] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 2199.349567][T14948] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 2199.615562][T14960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2199.676809][T14960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2199.742357][T14965] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5230'. [ 2199.972638][T14960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2200.103205][T14960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2201.824912][T15006] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5237'. [ 2202.630785][T15012] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 2203.484974][T15003] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2204.088633][T15029] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2204.975792][ T1896] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 2205.136061][ T1896] usb 4-1: Using ep0 maxpacket: 8 [ 2205.157589][ T1896] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2205.200630][ T1896] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2205.244237][ T1896] usb 4-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2205.289521][ T1896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2205.394039][ T1896] usb 4-1: config 0 descriptor?? [ 2205.444769][ T29] audit: type=1800 audit(1772360612.058:1930): pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.5245" name="SYSV00000000" dev="hugetlbfs" ino=11 res=0 errno=0 [ 2206.146271][ T7001] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 2206.317859][ T7001] usb 6-1: New USB device found, idVendor=046d, idProduct=08b6, bcdDevice=ca.8e [ 2206.342777][ T7001] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2206.393791][ T7001] pwc: Logitech/Cisco VT Camera webcam detected. [ 2207.199523][ T7001] pwc: Failed to set LED on/off time (-71) [ 2207.236781][ T7001] pwc: send_video_command error -71 [ 2207.268170][ T7001] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2207.317299][ T7001] Philips webcam 6-1:127.0: probe with driver Philips webcam failed with error -71 [ 2207.375413][ T7001] usb 6-1: USB disconnect, device number 106 [ 2207.715551][ T1896] usb 4-1: USB disconnect, device number 25 [ 2208.271245][T15108] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2208.278532][T15108] IPv6: NLM_F_CREATE should be set when creating new route [ 2208.285832][T15108] IPv6: NLM_F_CREATE should be set when creating new route [ 2208.293077][T15108] IPv6: NLM_F_CREATE should be set when creating new route [ 2208.399713][T15108] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2208.729410][T15125] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5253'. [ 2210.079466][T15129] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2210.147373][T15147] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5255'. [ 2210.198649][T15147] netlink: 'syz.5.5255': attribute type 2 has an invalid length. [ 2210.207896][T15147] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5255'. [ 2210.210577][T15148] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5255'. [ 2211.619100][T15151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2211.645349][T15151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2212.480915][T15179] netlink: 'syz.0.5261': attribute type 2 has an invalid length. [ 2212.498548][T15179] netlink: 'syz.0.5261': attribute type 12 has an invalid length. [ 2213.755770][ T1511] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 2213.922317][ T1511] usb 4-1: Using ep0 maxpacket: 32 [ 2213.948767][ T1511] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 2213.975811][ T1511] usb 4-1: config 0 has no interface number 0 [ 2213.991071][ T1511] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2214.031505][ T1511] usb 4-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 2214.089490][ T1511] usb 4-1: config 0 interface 119 altsetting 0 endpoint 0x83 has an invalid bInterval 115, changing to 7 [ 2214.169236][ T1511] usb 4-1: config 0 interface 119 altsetting 0 endpoint 0x83 has invalid maxpacket 25972, setting to 1024 [ 2214.238807][ T1511] usb 4-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 2214.330818][ T1511] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 2214.388613][ T1511] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2214.439260][ T1511] usb 4-1: Product: syz [ 2214.470986][ T1511] usb 4-1: Manufacturer: syz [ 2214.509168][ T1511] usb 4-1: SerialNumber: syz [ 2214.533346][ T1511] usb 4-1: config 0 descriptor?? [ 2214.572817][ T1511] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input122 [ 2216.175268][T15223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2216.238165][T15223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2216.709285][ T7001] usb 4-1: USB disconnect, device number 26 [ 2216.976503][T15248] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5269'. [ 2217.865769][ T7001] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 2218.055733][ T7001] usb 3-1: Using ep0 maxpacket: 8 [ 2218.096698][ T7001] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2218.155785][ T7001] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2218.194022][T15247] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2218.211491][ T7001] usb 3-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2218.271244][ T7001] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2218.365239][ T7001] usb 3-1: config 0 descriptor?? [ 2219.708329][T15285] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2219.753646][T15285] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2219.822080][ T1511] usb 3-1: USB disconnect, device number 50 [ 2220.211131][T15306] netlink: 'syz.5.5275': attribute type 1 has an invalid length. [ 2220.227496][T15306] netlink: 'syz.5.5275': attribute type 2 has an invalid length. [ 2220.250567][T15306] netlink: 268 bytes leftover after parsing attributes in process `syz.5.5275'. [ 2221.849326][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2221.850292][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2221.866738][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2222.687790][T27331] usb 6-1: new full-speed USB device number 107 using dummy_hcd [ 2223.315782][T27331] usb 6-1: config 8 has an invalid interface number: 177 but max is 0 [ 2223.356019][T27331] usb 6-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 2223.418064][T27331] usb 6-1: config 8 has no interface number 0 [ 2223.424871][T27331] usb 6-1: config 8 interface 177 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2223.578395][T27331] usb 6-1: config 8 interface 177 has no altsetting 0 [ 2223.623585][T27331] usb 6-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 2223.683949][T27331] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2223.713858][T15355] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2223.811009][T27331] ir_toy 6-1:8.177: required endpoints not found [ 2225.327708][T15373] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2225.890740][T15380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2225.947987][T15380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2226.132839][T27331] usb 6-1: USB disconnect, device number 107 [ 2226.368290][T15395] netlink: 'syz.5.5287': attribute type 1 has an invalid length. [ 2226.404599][T15395] netlink: 'syz.5.5287': attribute type 2 has an invalid length. [ 2226.418319][T15395] netlink: 268 bytes leftover after parsing attributes in process `syz.5.5287'. [ 2227.196955][ T1896] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 2227.356440][ T1896] usb 3-1: Using ep0 maxpacket: 32 [ 2227.364562][ T1896] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2227.378519][ T1896] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 2227.390612][ T1896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2227.432223][ T1896] usb 3-1: config 0 descriptor?? [ 2227.460658][ T1896] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 2228.577355][T15432] libceph: resolve 'c' (ret=-3): failed [ 2229.880066][T15462] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5296'. [ 2229.914325][T15462] netlink: 'syz.3.5296': attribute type 13 has an invalid length. [ 2230.044000][T15462] gretap0: refused to change device tx_queue_len [ 2230.139729][T15462] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 2230.908218][ T1896] usb 3-1: USB disconnect, device number 51 [ 2231.074209][T15478] netlink: 'syz.2.5298': attribute type 1 has an invalid length. [ 2231.122997][T15478] netlink: 'syz.2.5298': attribute type 2 has an invalid length. [ 2231.146803][T15478] netlink: 268 bytes leftover after parsing attributes in process `syz.2.5298'. [ 2231.349058][T15476] vivid-007: disconnect [ 2231.982999][T15467] vivid-007: reconnect [ 2232.012608][T15490] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2234.482317][T15533] tipc: Failed to remove unknown binding: 66,1,1/2455741920:4018086680/4018086682 [ 2234.517316][ T29] audit: type=1804 audit(1772360641.138:1931): pid=15531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.5306" name="/newroot/1097/file1" dev="fuse" ino=1 res=1 errno=0 [ 2234.726658][ T1511] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 2234.945914][ T1896] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 2235.016752][ T1511] usb 3-1: Using ep0 maxpacket: 16 [ 2235.056199][ T1511] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2235.091264][ T1511] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 2235.178909][ T1896] usb 4-1: config 0 has no interfaces? [ 2235.217475][ T1896] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 2235.247495][ T1896] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2235.295253][ T1896] usb 4-1: config 0 descriptor?? [ 2236.616091][T15566] macsec1: entered promiscuous mode [ 2236.634780][T15566] bridge0: entered promiscuous mode [ 2236.699475][T15566] macsec1: entered allmulticast mode [ 2236.704992][T15566] bridge0: entered allmulticast mode [ 2236.920546][T15566] bridge0: left allmulticast mode [ 2236.961651][T15566] bridge0: left promiscuous mode [ 2238.048779][ T1511] usb 3-1: string descriptor 0 read error: -71 [ 2238.162531][T24311] usb 4-1: USB disconnect, device number 27 [ 2238.204053][ T1511] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2238.348515][ T1511] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2238.394123][ T1511] usb 3-1: can't set config #1, error -71 [ 2238.422331][ T1511] usb 3-1: USB disconnect, device number 52 [ 2238.845892][ T1511] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 2238.885902][ T7001] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 2238.905848][T24311] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 2238.985811][ T1511] usb 3-1: device descriptor read/64, error -71 [ 2239.065813][ T7001] usb 6-1: Using ep0 maxpacket: 8 [ 2239.065870][T24311] usb 4-1: Using ep0 maxpacket: 16 [ 2239.097293][ T7001] usb 6-1: config 104 has an invalid interface number: 45 but max is 3 [ 2239.106232][ T7001] usb 6-1: config 104 has an invalid interface number: 4 but max is 3 [ 2239.117135][ T7001] usb 6-1: config 104 has an invalid interface number: 135 but max is 3 [ 2239.128981][T24311] usb 4-1: config 128 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2239.129002][ T7001] usb 6-1: config 104 has an invalid interface number: 221 but max is 3 [ 2239.129028][ T7001] usb 6-1: config 104 has no interface number 0 [ 2239.167417][ T7001] usb 6-1: config 104 has no interface number 1 [ 2239.176321][ T7001] usb 6-1: config 104 has no interface number 2 [ 2239.182729][ T7001] usb 6-1: config 104 has no interface number 3 [ 2239.189646][ T7001] usb 6-1: config 104 interface 45 altsetting 28 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 2239.190636][T24311] usb 4-1: config 128 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2239.211796][ T7001] usb 6-1: config 104 interface 45 altsetting 28 has an invalid descriptor for endpoint zero, skipping [ 2239.231063][ T7001] usb 6-1: config 104 interface 45 altsetting 28 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 2239.245866][ T1511] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 2239.263590][ T7001] usb 6-1: config 104 interface 45 altsetting 28 endpoint 0xD has invalid wMaxPacketSize 0 [ 2239.266131][T24311] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2239.305879][ T7001] usb 6-1: config 104 interface 45 altsetting 28 has an invalid descriptor for endpoint zero, skipping [ 2239.320549][ T7001] usb 6-1: config 104 interface 45 altsetting 28 bulk endpoint 0x3 has invalid maxpacket 64 [ 2239.333619][T24311] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2239.333619][ T7001] usb 6-1: config 104 interface 4 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 2239.365824][ T7001] usb 6-1: config 104 interface 135 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 2239.384287][ T7001] usb 6-1: config 104 interface 135 altsetting 1 has a duplicate endpoint with address 0xE, skipping [ 2239.385766][ T1511] usb 3-1: device descriptor read/64, error -71 [ 2239.396999][ T7001] usb 6-1: config 104 interface 135 altsetting 1 has a duplicate endpoint with address 0x8B, skipping [ 2239.422653][ T7001] usb 6-1: config 104 interface 135 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 2239.436933][ T7001] usb 6-1: config 104 interface 135 altsetting 1 has a duplicate endpoint with address 0x4, skipping [ 2239.459074][ T7001] usb 6-1: config 104 interface 135 altsetting 1 has a duplicate endpoint with address 0x3, skipping [ 2239.476386][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 2239.495798][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has a duplicate endpoint with address 0xA, skipping [ 2239.530565][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 2239.547171][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 2239.559046][ T7001] usb 6-1: config 104 interface 221 altsetting 2 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 2239.570980][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 2239.586021][ T7001] usb 6-1: config 104 interface 221 altsetting 2 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 2239.599388][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has a duplicate endpoint with address 0x6, skipping [ 2239.615955][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has an endpoint descriptor with address 0xF4, changing to 0x84 [ 2239.616368][ T1511] usb usb3-port1: attempt power cycle [ 2239.635859][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has a duplicate endpoint with address 0x84, skipping [ 2239.649192][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has a duplicate endpoint with address 0x6, skipping [ 2239.660668][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has a duplicate endpoint with address 0x3, skipping [ 2239.672228][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has a duplicate endpoint with address 0xC, skipping [ 2239.684235][ T7001] usb 6-1: config 104 interface 221 altsetting 2 has 14 endpoint descriptors, different from the interface descriptor's value: 13 [ 2239.716389][ T7001] usb 6-1: config 104 interface 45 has no altsetting 0 [ 2239.726011][ T7001] usb 6-1: config 104 interface 4 has no altsetting 0 [ 2239.738032][ T7001] usb 6-1: config 104 interface 135 has no altsetting 0 [ 2239.747906][ T7001] usb 6-1: config 104 interface 221 has no altsetting 0 [ 2239.771234][ T7001] usb 6-1: Dual-Role OTG device on HNP port [ 2239.777751][ T7001] usb 6-1: New USB device found, idVendor=08ca, idProduct=2016, bcdDevice=d4.cd [ 2239.789133][ T7001] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2239.799217][ T7001] usb 6-1: Product: ఇ [ 2239.803439][ T7001] usb 6-1: Manufacturer: ሮꊡ쿮㫜긼鸻哊ꮠ๗椀퍃戓䜟饸鼂庽⤬쮐앳쎒뻛椮韬 [ 2239.819605][ T7001] usb 6-1: SerialNumber: syz [ 2239.850006][T24311] mcp2221 0003:04D8:00DD.0024: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 2239.854343][T15608] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 2239.975834][ T1511] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 2240.027923][ T1511] usb 3-1: device descriptor read/8, error -71 [ 2240.243538][ T7001] usb 6-1: USB disconnect, device number 108 [ 2240.277444][T15638] random: crng reseeded on system resumption [ 2240.286368][ T1511] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 2240.327138][ T1511] usb 3-1: device descriptor read/8, error -71 [ 2240.427598][T15646] blktrace: Concurrent blktraces are not allowed on sg0 [ 2240.446385][ T1511] usb usb3-port1: unable to enumerate USB device [ 2240.459393][T15646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2240.471876][T15646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2241.136272][ T1896] usb 4-1: reset high-speed USB device number 28 using dummy_hcd [ 2242.435471][ T1511] usb 4-1: USB disconnect, device number 28 [ 2243.302034][T15697] bridge0: entered promiscuous mode [ 2243.314626][T15697] macsec1: entered promiscuous mode [ 2243.325051][T15697] macsec1: entered allmulticast mode [ 2243.330602][T15697] bridge0: entered allmulticast mode [ 2243.351977][T15697] bridge0: port 2(macsec1) entered blocking state [ 2243.359562][T15697] bridge0: port 2(macsec1) entered disabled state [ 2243.458955][T15697] bridge0: left allmulticast mode [ 2243.500902][T15697] bridge0: left promiscuous mode [ 2243.595903][ T1511] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 2243.821663][ T1511] usb 6-1: Using ep0 maxpacket: 8 [ 2243.931503][ T1511] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2243.945874][ T1511] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2243.965052][ T1511] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2243.982726][ T1511] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2244.024556][ T1511] usb 6-1: config 0 descriptor?? [ 2245.036044][ T1511] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 2245.145413][T15732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5329'. [ 2245.217559][ T1511] usb 3-1: Using ep0 maxpacket: 8 [ 2245.250505][ T1511] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2245.366259][ T1511] usb 3-1: New USB device found, idVendor=17cc, idProduct=1020, bcdDevice= 0.40 [ 2245.414519][ T1511] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2245.434610][ T1511] usb 3-1: Product: syz [ 2245.446444][ T1511] usb 3-1: Manufacturer: syz [ 2245.464442][ T1511] usb 3-1: SerialNumber: syz [ 2245.954060][T15741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2245.985734][T15741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2246.106883][T15741] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5330'. [ 2246.138393][ T1511] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 2246.168535][T15748] netlink: 'syz.4.5330': attribute type 13 has an invalid length. [ 2246.199254][ T1511] usb 3-1: USB disconnect, device number 57 [ 2246.281113][T15748] gretap0: refused to change device tx_queue_len [ 2246.288172][T15748] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 2246.471783][T15758] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5331'. [ 2246.631326][T15758] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5331'. [ 2246.962461][ T7001] usb 6-1: USB disconnect, device number 109 [ 2248.195576][T15784] fuse: Unknown parameter '0xffffffffffffffff' [ 2248.275999][T15789] bond0: left promiscuous mode [ 2248.546526][ T1511] usb 4-1: new low-speed USB device number 29 using dummy_hcd [ 2248.708612][ T1511] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2248.726175][ T1896] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 2248.740309][ T1511] usb 4-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2248.788479][ T1511] usb 4-1: config 1 interface 0 has no altsetting 0 [ 2248.810274][ T1511] usb 4-1: string descriptor 0 read error: -22 [ 2248.828812][ T1511] usb 4-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.40 [ 2248.864888][ T1511] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2248.915948][ T1896] usb 6-1: Using ep0 maxpacket: 16 [ 2248.934960][ T1896] usb 6-1: config 0 has no interfaces? [ 2248.943448][ T1511] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input124 [ 2248.964831][ T1896] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 2249.015334][ T1896] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 2249.034307][ T1896] usb 6-1: Manufacturer: syz [ 2249.065785][ T1896] usb 6-1: config 0 descriptor?? [ 2249.460284][ T5175] bcm5974 4-1:1.0: could not read from device [ 2249.483778][ T5175] bcm5974 4-1:1.0: could not read from device [ 2249.497131][ T1511] usb 4-1: USB disconnect, device number 29 [ 2249.534028][ T5175] bcm5974 4-1:1.0: could not read from device [ 2249.991467][T15795] 8021q: adding VLAN 0 to HW filter on device team0 [ 2250.029758][T15795] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2250.148278][T15846] macsec0: entered promiscuous mode [ 2250.169034][T15846] macsec0: entered allmulticast mode [ 2250.190171][T15846] bridge0: entered allmulticast mode [ 2250.231917][T15846] bridge0: port 1(macsec0) entered blocking state [ 2250.267496][T15846] bridge0: port 1(macsec0) entered disabled state [ 2250.312629][T15846] bridge0: left allmulticast mode [ 2252.171476][ T1896] usb 6-1: USB disconnect, device number 110 [ 2252.941629][T15907] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5346'. [ 2254.708403][T15932] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2254.741704][T15932] team0: Port device batadv0 added [ 2254.843741][T15932] hub 9-0:1.0: USB hub found [ 2254.871997][T15932] hub 9-0:1.0: 1 port detected [ 2254.952456][T15939] input: syz0 as /devices/virtual/input/input126 [ 2258.051188][T15994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2258.526077][T16008] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5360'. [ 2258.629421][T15995] fuse: Unknown parameter 'group_i00000000000000000000' [ 2258.881434][T16009] random: crng reseeded on system resumption [ 2260.071369][T15994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2260.375767][ T7014] usb 3-1: new full-speed USB device number 58 using dummy_hcd [ 2260.562780][ T7014] usb 3-1: config 1 has an invalid interface number: 128 but max is 1 [ 2260.589167][ T7014] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2260.625019][ T7014] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 2260.667542][ T7014] usb 3-1: config 1 has no interface number 0 [ 2260.678296][ T7014] usb 3-1: config 1 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2260.739895][ T7014] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2260.769833][ T7014] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2260.803341][ T7014] usb 3-1: Product: syz [ 2260.819926][ T7014] usb 3-1: Manufacturer: syz [ 2260.834682][ T7014] usb 3-1: SerialNumber: syz [ 2260.903574][ T7014] cdc_wdm 3-1:1.128: probe with driver cdc_wdm failed with error -22 [ 2261.702977][T16045] binder: 16036:16045 ioctl 4018620d 0 returned -22 [ 2262.065688][ T7014] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 2262.243060][ T7014] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 2262.262767][ T7014] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2262.287489][ T7014] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2262.329570][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2262.354158][ T7014] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2262.384652][ T7014] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2262.419322][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2262.442580][ T7014] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2262.466270][ T7014] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2262.492225][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2262.500833][ T7014] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2262.521067][ T7014] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2262.535442][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2262.559334][ T7014] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2262.585832][ T7014] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2262.635899][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2262.673721][ T7014] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2262.701148][ T7014] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2262.753482][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2262.774482][ T7014] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2262.794105][ T7014] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2262.832539][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2262.867262][ T7014] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 2262.885879][ T7014] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 2262.905764][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2262.936334][ T7014] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 2262.966628][ T7014] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 2262.985529][ T7014] usb 6-1: Product: syz [ 2262.995886][ T7014] usb 6-1: Manufacturer: syz [ 2263.015685][ T7014] usb 6-1: SerialNumber: syz [ 2263.033463][ T7014] usb 6-1: config 0 descriptor?? [ 2263.076723][ T7014] yurex 6-1:0.0: USB YUREX device now attached to Yurex #0 [ 2263.199494][T16061] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5366'. [ 2263.635945][ T7014] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 2263.807531][ T7001] usb 6-1: USB disconnect, device number 111 [ 2263.817930][ T7014] usb 4-1: device descriptor read/64, error -71 [ 2263.850998][ T7001] yurex 6-1:0.0: USB YUREX #0 now disconnected [ 2263.924793][T27331] usb 3-1: USB disconnect, device number 58 [ 2264.056001][ T7014] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 2264.116381][T16106] netlink: 'syz.2.5369': attribute type 4 has an invalid length. [ 2264.225749][ T7014] usb 4-1: device descriptor read/64, error -71 [ 2264.368893][ T7014] usb usb4-port1: attempt power cycle [ 2264.585967][ T7001] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 2264.729235][ T7014] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 2264.766420][ T7014] usb 4-1: device descriptor read/8, error -71 [ 2264.844090][ T7001] usb 3-1: Using ep0 maxpacket: 16 [ 2264.898233][ T7001] usb 3-1: config 0 has no interfaces? [ 2264.912615][ T7001] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 2264.931003][ T7001] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 2264.950985][ T7001] usb 3-1: Manufacturer: syz [ 2264.962857][ T7001] usb 3-1: config 0 descriptor?? [ 2265.031532][ T7014] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 2265.077855][ T7014] usb 4-1: device descriptor read/8, error -71 [ 2265.206349][ T7014] usb usb4-port1: unable to enumerate USB device [ 2266.437119][T16186] netlink: 'syz.5.5372': attribute type 6 has an invalid length. [ 2266.445517][T16186] netlink: 'syz.5.5372': attribute type 7 has an invalid length. [ 2266.453553][T16186] netlink: 'syz.5.5372': attribute type 8 has an invalid length. [ 2267.227511][ T7001] usb 3-1: USB disconnect, device number 59 [ 2267.417450][T16203] netlink: 'syz.2.5375': attribute type 1 has an invalid length. [ 2267.438595][T16203] netlink: 280 bytes leftover after parsing attributes in process `syz.2.5375'. [ 2267.775807][ T7014] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 2267.789500][ C0] raw-gadget.0 gadget.3: ignoring, device is not running [ 2267.887239][T16211] sysfs: cannot create duplicate filename '/class/ieee80211/1^!l1*$pOcɔr$Gt:u' [ 2267.922922][T16211] CPU: 1 UID: 0 PID: 16211 Comm: syz.0.5376 Tainted: G L syzkaller #0 PREEMPT(full) [ 2267.922967][T16211] Tainted: [L]=SOFTLOCKUP [ 2267.922976][T16211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2267.922987][T16211] Call Trace: [ 2267.922996][T16211] [ 2267.923005][T16211] dump_stack_lvl+0xe8/0x150 [ 2267.923040][T16211] sysfs_warn_dup+0x8e/0xa0 [ 2267.923058][T16211] sysfs_do_create_link_sd+0xc0/0x110 [ 2267.923077][T16211] device_add_class_symlinks+0x1cf/0x240 [ 2267.923093][T16211] device_add+0x475/0xb70 [ 2267.923107][T16211] wiphy_register+0x1d73/0x2d50 [ 2267.923133][T16211] ? __pfx_wiphy_register+0x10/0x10 [ 2267.923154][T16211] ? __pfx_netdev_run_todo+0x10/0x10 [ 2267.923167][T16211] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 2267.923186][T16211] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 2267.923208][T16211] ieee80211_register_hw+0x3562/0x4200 [ 2267.923229][T16211] ? ieee80211_register_hw+0x14d1/0x4200 [ 2267.923249][T16211] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 2267.923272][T16211] ? __hrtimer_setup+0x181/0x200 [ 2267.923287][T16211] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 2267.923304][T16211] mac80211_hwsim_new_radio+0x2f97/0x5330 [ 2267.923335][T16211] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 2267.923346][T16211] ? kstrndup+0xbf/0x160 [ 2267.923367][T16211] hwsim_new_radio_nl+0xf35/0x1bd0 [ 2267.923392][T16211] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 2267.923410][T16211] ? rcu_is_watching+0x15/0xb0 [ 2267.923426][T16211] ? trace_kmalloc+0x2a/0x110 [ 2267.923442][T16211] ? __nla_parse+0x40/0x60 [ 2267.923461][T16211] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 2267.923478][T16211] genl_family_rcv_msg_doit+0x22a/0x330 [ 2267.923501][T16211] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 2267.923526][T16211] ? bpf_lsm_capable+0x9/0x20 [ 2267.923541][T16211] ? security_capable+0x7e/0x2c0 [ 2267.923559][T16211] genl_rcv_msg+0x61c/0x7a0 [ 2267.923580][T16211] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2267.923596][T16211] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 2267.923608][T16211] ? __lock_acquire+0x6b5/0x2cf0 [ 2267.923630][T16211] netlink_rcv_skb+0x232/0x4b0 [ 2267.923645][T16211] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2267.923663][T16211] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2267.923689][T16211] ? down_read+0x272/0x2e0 [ 2267.923703][T16211] ? genl_rcv+0xd/0x40 [ 2267.923721][T16211] genl_rcv+0x28/0x40 [ 2267.923737][T16211] netlink_unicast+0x80f/0x9b0 [ 2267.923755][T16211] ? __pfx_netlink_unicast+0x10/0x10 [ 2267.923769][T16211] ? netlink_sendmsg+0x650/0xb40 [ 2267.923782][T16211] ? skb_put+0x11b/0x210 [ 2267.923800][T16211] netlink_sendmsg+0x813/0xb40 [ 2267.923820][T16211] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2267.923837][T16211] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2267.923852][T16211] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2267.923867][T16211] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2267.923880][T16211] ____sys_sendmsg+0xa68/0xad0 [ 2267.923896][T16211] ? futex_unqueue+0x211/0x240 [ 2267.923915][T16211] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2267.923946][T16211] ? import_iovec+0x73/0xa0 [ 2267.923964][T16211] ___sys_sendmsg+0x2a5/0x360 [ 2267.923985][T16211] ? __pfx____sys_sendmsg+0x10/0x10 [ 2267.924006][T16211] ? futex_wait+0x29a/0x380 [ 2267.924039][T16211] ? __fget_files+0x2a/0x420 [ 2267.924055][T16211] ? __fget_files+0x3a0/0x420 [ 2267.924077][T16211] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2267.924096][T16211] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2267.924120][T16211] ? rcu_is_watching+0x15/0xb0 [ 2267.924144][T16211] do_syscall_64+0x14d/0xf80 [ 2267.924155][T16211] ? trace_irq_disable+0x3b/0x150 [ 2267.924171][T16211] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2267.924184][T16211] ? clear_bhb_loop+0x40/0x90 [ 2267.924198][T16211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2267.924210][T16211] RIP: 0033:0x7fe59239c799 [ 2267.924223][T16211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2267.924233][T16211] RSP: 002b:00007fe593248028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2267.924248][T16211] RAX: ffffffffffffffda RBX: 00007fe592616180 RCX: 00007fe59239c799 [ 2267.924258][T16211] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000009 [ 2267.924266][T16211] RBP: 00007fe592432bd9 R08: 0000000000000000 R09: 0000000000000000 [ 2267.924274][T16211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2267.924281][T16211] R13: 00007fe592616218 R14: 00007fe592616180 R15: 00007fe59273fa48 [ 2267.924301][T16211] [ 2267.986242][ T7014] usb 4-1: device descriptor read/64, error -32 [ 2268.828217][ T1896] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 2269.218943][ T1896] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2269.264120][ T1896] usb 3-1: New USB device found, idVendor=1e7d, idProduct=3232, bcdDevice= 0.00 [ 2269.302797][ T1896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2269.361005][ T1896] usb 3-1: config 0 descriptor?? [ 2269.409515][ T1896] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 2270.969737][ T7014] usb 3-1: USB disconnect, device number 60 [ 2271.091315][T16258] bridge0: entered promiscuous mode [ 2271.119462][T16258] macsec2: entered promiscuous mode [ 2271.147121][T16258] macsec2: entered allmulticast mode [ 2271.161748][T16258] bridge0: entered allmulticast mode [ 2271.177599][T16258] bridge0: port 1(macsec2) entered blocking state [ 2271.192012][T16258] bridge0: port 1(macsec2) entered disabled state [ 2271.411213][T16258] bridge0: left allmulticast mode [ 2271.456102][T16258] bridge0: left promiscuous mode [ 2271.581287][T16279] bond0: Device is already in use. [ 2272.889410][T16302] netlink: 'syz.4.5387': attribute type 1 has an invalid length. [ 2272.912046][T16302] netlink: 280 bytes leftover after parsing attributes in process `syz.4.5387'. [ 2273.257877][ T7001] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 2273.477076][ T7001] usb 4-1: Using ep0 maxpacket: 8 [ 2273.512909][ T7001] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2273.566363][ T7001] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2273.603381][ T7001] usb 4-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2273.642897][ T7001] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2273.682880][ T7001] usb 4-1: config 0 descriptor?? [ 2274.920688][T16338] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2275.017952][T16344] ip6tnl0: Caught tx_queue_len zero misconfig [ 2275.665910][T16334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2275.829308][ T1896] usb 4-1: USB disconnect, device number 36 [ 2276.478247][T16334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2277.017152][T16374] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5396'. [ 2277.176483][T16379] macsec1: entered promiscuous mode [ 2277.182440][T16379] bridge0: entered promiscuous mode [ 2277.188881][T16379] macsec1: entered allmulticast mode [ 2277.194464][T16379] bridge0: entered allmulticast mode [ 2277.257194][T16379] bridge0: left allmulticast mode [ 2277.263962][T16379] bridge0: left promiscuous mode [ 2277.695833][ T7014] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 2277.955717][ T7014] usb 3-1: Using ep0 maxpacket: 8 [ 2278.029377][ T7014] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2278.071448][ T7014] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2278.138733][ T7014] usb 3-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2278.188530][ T7014] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2278.228136][ T7014] usb 3-1: config 0 descriptor?? [ 2278.311773][T16401] netlink: 'syz.4.5400': attribute type 1 has an invalid length. [ 2278.336156][T16401] netlink: 280 bytes leftover after parsing attributes in process `syz.4.5400'. [ 2278.796805][ T7001] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 2278.956512][ T7001] usb 6-1: Using ep0 maxpacket: 8 [ 2278.964401][ T7001] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2278.975981][ T7001] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2278.996774][ T7001] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2279.014718][ T7001] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2279.062492][ T7001] usb 6-1: config 0 descriptor?? [ 2279.286508][ T7001] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 2279.941597][ T7014] usb 3-1: USB disconnect, device number 61 [ 2280.165391][ T7001] usb 4-1: config 0 interface 0 altsetting 251 has an endpoint descriptor with address 0x36, changing to 0x6 [ 2280.223466][ T7001] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2280.400786][ T7001] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2280.444388][ T7001] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2280.469341][ T7001] usb 4-1: Product: syz [ 2280.481099][T16434] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5404'. [ 2280.496597][ T7001] usb 4-1: Manufacturer: syz [ 2280.504310][ T7001] usb 4-1: SerialNumber: syz [ 2280.526610][ T7001] usb 4-1: config 0 descriptor?? [ 2280.541674][T16434] netlink: 1 bytes leftover after parsing attributes in process `syz.2.5404'. [ 2280.594601][ T7001] usb 4-1: selecting invalid altsetting 0 [ 2281.755481][T16441] vivid-007: ================= START STATUS ================= [ 2281.764390][T16441] vivid-007: Enable Output Cropping: true [ 2281.775970][T16441] vivid-007: Enable Output Composing: true [ 2281.782382][T16441] vivid-007: Enable Output Scaler: true [ 2281.805860][T16441] vivid-007: Tx RGB Quantization Range: Automatic [ 2281.812413][T16441] vivid-007: Transmit Mode: HDMI [ 2281.833330][T16441] vivid-007: Hotplug Present: 0x00000000 [ 2281.839578][T16441] vivid-007: RxSense Present: 0x00000000 [ 2281.845466][T16441] vivid-007: EDID Present: 0x00000000 [ 2281.851550][T16441] vivid-007: ================== END STATUS ================== [ 2282.162037][ T7014] usb 4-1: USB disconnect, device number 37 [ 2282.224076][ T1896] usb 6-1: USB disconnect, device number 112 [ 2283.296373][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2283.303504][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2283.726530][ T7001] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 2283.946186][ T7001] usb 6-1: Using ep0 maxpacket: 8 [ 2283.953498][ T7001] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2283.967920][ T7001] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2283.979025][ T7001] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 2283.996298][ T7001] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2284.018508][ T7001] usb 6-1: config 0 descriptor?? [ 2284.059646][T16529] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2284.101517][ T29] audit: type=1326 audit(1772360690.698:1932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2284.207953][ T29] audit: type=1326 audit(1772360690.698:1933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2284.268947][T16536] bridge0: entered promiscuous mode [ 2284.274260][T16536] bond0: entered promiscuous mode [ 2284.279340][T16536] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 [ 2284.288741][T16536] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 16536, name: syz.2.5412 [ 2284.297887][T16536] preempt_count: 201, expected: 0 [ 2284.302900][T16536] RCU nest depth: 0, expected: 0 [ 2284.307849][T16536] 3 locks held by syz.2.5412/16536: [ 2284.313042][T16536] #0: ffffffff9011cc98 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 2284.322735][T16536] #1: ffffffff8fbcd048 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 2284.331823][T16536] #2: ffff88802b718370 (&dev_addr_list_lock_key#7/2){+...}-{3:3}, at: dev_uc_add+0x67/0x120 [ 2284.342046][T16536] Preemption disabled at: [ 2284.342055][T16536] [] dev_uc_add+0x56/0x120 [ 2284.352374][T16536] CPU: 1 UID: 0 PID: 16536 Comm: syz.2.5412 Tainted: G L syzkaller #0 PREEMPT(full) [ 2284.352396][T16536] Tainted: [L]=SOFTLOCKUP [ 2284.352401][T16536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2284.352408][T16536] Call Trace: [ 2284.352415][T16536] [ 2284.352420][T16536] dump_stack_lvl+0xe8/0x150 [ 2284.352441][T16536] __might_resched+0x378/0x4d0 [ 2284.352460][T16536] ? dev_uc_add+0x56/0x120 [ 2284.352477][T16536] __mutex_lock+0x119/0x1300 [ 2284.352494][T16536] ? __pfx_vprintk_emit+0x10/0x10 [ 2284.352510][T16536] ? __irq_work_queue_local+0x1f2/0x590 [ 2284.352529][T16536] ? dev_set_promiscuity+0x10e/0x260 [ 2284.352546][T16536] ? _printk+0xdd/0x130 [ 2284.352556][T16536] ? __pfx___mutex_lock+0x10/0x10 [ 2284.352572][T16536] ? __wake_up_klogd+0xe6/0x120 [ 2284.352585][T16536] ? __netdev_printk+0x36f/0x480 [ 2284.352600][T16536] dev_set_promiscuity+0x10e/0x260 [ 2284.352619][T16536] bond_change_rx_flags+0x21a/0x690 [ 2284.352636][T16536] ? __pfx_bond_change_rx_flags+0x10/0x10 [ 2284.352671][T16536] ? __pfx__printk+0x10/0x10 [ 2284.352697][T16536] ? __pfx_bond_change_rx_flags+0x10/0x10 [ 2284.352720][T16536] __dev_set_promiscuity+0x515/0x710 [ 2284.352750][T16536] ? netdev_info+0x11e/0x180 [ 2284.352765][T16536] netif_set_promiscuity+0x50/0xe0 [ 2284.352782][T16536] dev_set_promiscuity+0x126/0x260 [ 2284.352801][T16536] br_manage_promisc+0x180/0x560 [ 2284.352818][T16536] ? __pfx_br_dev_change_rx_flags+0x10/0x10 [ 2284.352833][T16536] __dev_set_promiscuity+0x515/0x710 [ 2284.352850][T16536] ? __hw_addr_add_ex+0x361/0x650 [ 2284.352869][T16536] __dev_set_rx_mode+0x17c/0x260 [ 2284.352887][T16536] dev_uc_add+0xc8/0x120 [ 2284.352908][T16536] macsec_dev_open+0xf2/0x5a0 [ 2284.352925][T16536] ? __pfx_macsec_dev_open+0x10/0x10 [ 2284.352937][T16536] ? hsr_netdev_notify+0x296/0xce0 [ 2284.352949][T16536] ? ib_device_get_by_netdev+0x81/0x4f0 [ 2284.352970][T16536] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 2284.352985][T16536] ? __pfx_hsr_netdev_notify+0x10/0x10 [ 2284.352996][T16536] ? udp_tunnel_nic_netdevice_event+0x1ac/0x17d0 [ 2284.353013][T16536] ? ip6_route_dev_notify+0x9a/0x5b0 [ 2284.353028][T16536] ? notifier_call_chain+0x3da/0x400 [ 2284.353048][T16536] __dev_open+0x44d/0x830 [ 2284.353065][T16536] ? __pfx___dev_open+0x10/0x10 [ 2284.353078][T16536] ? __dev_change_flags+0x1b0/0x690 [ 2284.353095][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2284.353112][T16536] __dev_change_flags+0x1f7/0x690 [ 2284.353131][T16536] ? __pfx___dev_change_flags+0x10/0x10 [ 2284.353151][T16536] rtnl_newlink_create+0x587/0xb70 [ 2284.353167][T16536] ? __pfx___nla_validate_parse+0x10/0x10 [ 2284.353188][T16536] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 2284.353205][T16536] ? __pfx___mutex_lock+0x10/0x10 [ 2284.353222][T16536] ? ns_capable+0x89/0xe0 [ 2284.353238][T16536] rtnl_newlink+0x1666/0x1be0 [ 2284.353260][T16536] ? __pfx_rtnl_newlink+0x10/0x10 [ 2284.353273][T16536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2284.353305][T16536] ? kasan_quarantine_put+0xbb/0x1f0 [ 2284.353319][T16536] ? lockdep_hardirqs_on+0x7a/0x110 [ 2284.353332][T16536] ? kmem_cache_free+0x187/0x630 [ 2284.353344][T16536] ? nlmon_xmit+0xb0/0x100 [ 2284.353365][T16536] ? __lock_acquire+0x6b5/0x2cf0 [ 2284.353382][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2284.353396][T16536] ? lockdep_hardirqs_on+0x7a/0x110 [ 2284.353406][T16536] ? __dev_queue_xmit+0x277/0x3890 [ 2284.353416][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2284.353429][T16536] ? __dev_queue_xmit+0x277/0x3890 [ 2284.353453][T16536] ? __pfx_rtnl_newlink+0x10/0x10 [ 2284.353466][T16536] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 2284.353483][T16536] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 2284.353497][T16536] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2284.353511][T16536] ? ref_tracker_free+0x693/0x840 [ 2284.353524][T16536] ? __copy_skb_header+0xa3/0x4a0 [ 2284.353541][T16536] ? __pfx_ref_tracker_free+0x10/0x10 [ 2284.353560][T16536] netlink_rcv_skb+0x232/0x4b0 [ 2284.353575][T16536] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2284.353590][T16536] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2284.353609][T16536] ? netlink_deliver_tap+0x2e/0x1b0 [ 2284.353627][T16536] netlink_unicast+0x80f/0x9b0 [ 2284.353644][T16536] ? __pfx_netlink_unicast+0x10/0x10 [ 2284.353664][T16536] ? netlink_sendmsg+0x650/0xb40 [ 2284.353677][T16536] ? skb_put+0x11b/0x210 [ 2284.353693][T16536] netlink_sendmsg+0x813/0xb40 [ 2284.353712][T16536] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2284.353728][T16536] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2284.353742][T16536] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2284.353756][T16536] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2284.353774][T16536] ____sys_sendmsg+0xa68/0xad0 [ 2284.353799][T16536] ? futex_unqueue+0x211/0x240 [ 2284.353829][T16536] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2284.353867][T16536] ? import_iovec+0x73/0xa0 [ 2284.353893][T16536] ___sys_sendmsg+0x2a5/0x360 [ 2284.353915][T16536] ? __pfx____sys_sendmsg+0x10/0x10 [ 2284.353935][T16536] ? futex_wait+0x29a/0x380 [ 2284.353963][T16536] ? __fget_files+0x2a/0x420 [ 2284.353978][T16536] ? __fget_files+0x3a0/0x420 [ 2284.353998][T16536] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2284.354015][T16536] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2284.354036][T16536] ? rcu_is_watching+0x15/0xb0 [ 2284.354057][T16536] do_syscall_64+0x14d/0xf80 [ 2284.354068][T16536] ? trace_irq_disable+0x3b/0x150 [ 2284.354083][T16536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2284.354094][T16536] ? clear_bhb_loop+0x40/0x90 [ 2284.354108][T16536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2284.354120][T16536] RIP: 0033:0x7f5a1d79c799 [ 2284.354133][T16536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2284.354146][T16536] RSP: 002b:00007f5a1e5f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2284.354160][T16536] RAX: ffffffffffffffda RBX: 00007f5a1da16270 RCX: 00007f5a1d79c799 [ 2284.354169][T16536] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 2284.354176][T16536] RBP: 00007f5a1d832bd9 R08: 0000000000000000 R09: 0000000000000000 [ 2284.354184][T16536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2284.354191][T16536] R13: 00007f5a1da16308 R14: 00007f5a1da16270 R15: 00007f5a1db3fa48 [ 2284.354208][T16536] [ 2284.354215][T16536] [ 2284.951925][T16536] ============================= [ 2284.956767][T16536] [ BUG: Invalid wait context ] [ 2284.961611][T16536] syzkaller #0 Tainted: G W L [ 2284.967577][T16536] ----------------------------- [ 2284.972416][T16536] syz.2.5412/16536 is trying to lock: [ 2284.977775][T16536] ffff88806935cd40 (&dev_instance_lock_key#24){+.+.}-{4:4}, at: dev_set_promiscuity+0x10e/0x260 [ 2284.988302][T16536] other info that might help us debug this: [ 2284.994182][T16536] context-{5:5} [ 2284.997627][T16536] 3 locks held by syz.2.5412/16536: [ 2285.002812][T16536] #0: ffffffff9011cc98 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 2285.012313][T16536] #1: ffffffff8fbcd048 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 2285.021368][T16536] #2: ffff88802b718370 (&dev_addr_list_lock_key#7/2){+...}-{3:3}, at: dev_uc_add+0x67/0x120 [ 2285.031576][T16536] stack backtrace: [ 2285.035325][T16536] CPU: 1 UID: 0 PID: 16536 Comm: syz.2.5412 Tainted: G W L syzkaller #0 PREEMPT(full) [ 2285.035345][T16536] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 2285.035351][T16536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2285.035359][T16536] Call Trace: [ 2285.035365][T16536] [ 2285.035370][T16536] dump_stack_lvl+0xe8/0x150 [ 2285.035389][T16536] __lock_acquire+0xec1/0x2cf0 [ 2285.035405][T16536] ? __show_trace_log_lvl+0x478/0x550 [ 2285.035424][T16536] lock_acquire+0xf0/0x2e0 [ 2285.035437][T16536] ? dev_set_promiscuity+0x10e/0x260 [ 2285.035453][T16536] ? __might_resched+0x378/0x4d0 [ 2285.035469][T16536] __mutex_lock+0x19f/0x1300 [ 2285.035480][T16536] ? dev_set_promiscuity+0x10e/0x260 [ 2285.035496][T16536] ? __pfx_vprintk_emit+0x10/0x10 [ 2285.035512][T16536] ? __irq_work_queue_local+0x1f2/0x590 [ 2285.035529][T16536] ? dev_set_promiscuity+0x10e/0x260 [ 2285.035545][T16536] ? __pfx___mutex_lock+0x10/0x10 [ 2285.035557][T16536] ? __wake_up_klogd+0xe6/0x120 [ 2285.035568][T16536] ? __netdev_printk+0x36f/0x480 [ 2285.035581][T16536] dev_set_promiscuity+0x10e/0x260 [ 2285.035679][T16536] bond_change_rx_flags+0x21a/0x690 [ 2285.035694][T16536] ? __pfx_bond_change_rx_flags+0x10/0x10 [ 2285.035707][T16536] ? __pfx__printk+0x10/0x10 [ 2285.035720][T16536] ? __pfx_bond_change_rx_flags+0x10/0x10 [ 2285.035732][T16536] __dev_set_promiscuity+0x515/0x710 [ 2285.035749][T16536] ? netdev_info+0x11e/0x180 [ 2285.035760][T16536] netif_set_promiscuity+0x50/0xe0 [ 2285.035776][T16536] dev_set_promiscuity+0x126/0x260 [ 2285.035792][T16536] br_manage_promisc+0x180/0x560 [ 2285.035807][T16536] ? __pfx_br_dev_change_rx_flags+0x10/0x10 [ 2285.035822][T16536] __dev_set_promiscuity+0x515/0x710 [ 2285.035838][T16536] ? __hw_addr_add_ex+0x361/0x650 [ 2285.035854][T16536] __dev_set_rx_mode+0x17c/0x260 [ 2285.035870][T16536] dev_uc_add+0xc8/0x120 [ 2285.035886][T16536] macsec_dev_open+0xf2/0x5a0 [ 2285.035901][T16536] ? __pfx_macsec_dev_open+0x10/0x10 [ 2285.035913][T16536] ? hsr_netdev_notify+0x296/0xce0 [ 2285.035925][T16536] ? ib_device_get_by_netdev+0x81/0x4f0 [ 2285.035940][T16536] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 2285.035954][T16536] ? __pfx_hsr_netdev_notify+0x10/0x10 [ 2285.035965][T16536] ? udp_tunnel_nic_netdevice_event+0x1ac/0x17d0 [ 2285.035979][T16536] ? ip6_route_dev_notify+0x9a/0x5b0 [ 2285.035992][T16536] ? notifier_call_chain+0x3da/0x400 [ 2285.036011][T16536] __dev_open+0x44d/0x830 [ 2285.036025][T16536] ? __pfx___dev_open+0x10/0x10 [ 2285.036037][T16536] ? __dev_change_flags+0x1b0/0x690 [ 2285.036053][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2285.036068][T16536] __dev_change_flags+0x1f7/0x690 [ 2285.036084][T16536] ? __pfx___dev_change_flags+0x10/0x10 [ 2285.036102][T16536] rtnl_newlink_create+0x587/0xb70 [ 2285.036118][T16536] ? __pfx___nla_validate_parse+0x10/0x10 [ 2285.036136][T16536] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 2285.036152][T16536] ? __pfx___mutex_lock+0x10/0x10 [ 2285.036165][T16536] ? ns_capable+0x89/0xe0 [ 2285.036179][T16536] rtnl_newlink+0x1666/0x1be0 [ 2285.036196][T16536] ? __pfx_rtnl_newlink+0x10/0x10 [ 2285.036209][T16536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2285.036228][T16536] ? kasan_quarantine_put+0xbb/0x1f0 [ 2285.036240][T16536] ? lockdep_hardirqs_on+0x7a/0x110 [ 2285.036251][T16536] ? kmem_cache_free+0x187/0x630 [ 2285.036263][T16536] ? nlmon_xmit+0xb0/0x100 [ 2285.036280][T16536] ? __lock_acquire+0x6b5/0x2cf0 [ 2285.036294][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2285.036307][T16536] ? lockdep_hardirqs_on+0x7a/0x110 [ 2285.036317][T16536] ? __dev_queue_xmit+0x277/0x3890 [ 2285.036327][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2285.036340][T16536] ? __dev_queue_xmit+0x277/0x3890 [ 2285.036356][T16536] ? __pfx_rtnl_newlink+0x10/0x10 [ 2285.036369][T16536] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 2285.036384][T16536] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 2285.036397][T16536] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2285.036410][T16536] ? ref_tracker_free+0x693/0x840 [ 2285.036423][T16536] ? __copy_skb_header+0xa3/0x4a0 [ 2285.036440][T16536] ? __pfx_ref_tracker_free+0x10/0x10 [ 2285.036455][T16536] netlink_rcv_skb+0x232/0x4b0 [ 2285.036469][T16536] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2285.036484][T16536] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2285.036499][T16536] ? netlink_deliver_tap+0x2e/0x1b0 [ 2285.036514][T16536] netlink_unicast+0x80f/0x9b0 [ 2285.036527][T16536] ? __pfx_netlink_unicast+0x10/0x10 [ 2285.036539][T16536] ? netlink_sendmsg+0x650/0xb40 [ 2285.036552][T16536] ? skb_put+0x11b/0x210 [ 2285.036567][T16536] netlink_sendmsg+0x813/0xb40 [ 2285.036589][T16536] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2285.036603][T16536] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2285.036617][T16536] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2285.036629][T16536] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2285.036642][T16536] ____sys_sendmsg+0xa68/0xad0 [ 2285.036659][T16536] ? futex_unqueue+0x211/0x240 [ 2285.036673][T16536] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2285.036690][T16536] ? import_iovec+0x73/0xa0 [ 2285.036707][T16536] ___sys_sendmsg+0x2a5/0x360 [ 2285.036723][T16536] ? __pfx____sys_sendmsg+0x10/0x10 [ 2285.036741][T16536] ? futex_wait+0x29a/0x380 [ 2285.036761][T16536] ? __fget_files+0x2a/0x420 [ 2285.036776][T16536] ? __fget_files+0x3a0/0x420 [ 2285.036792][T16536] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2285.036809][T16536] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2285.036826][T16536] ? rcu_is_watching+0x15/0xb0 [ 2285.036844][T16536] do_syscall_64+0x14d/0xf80 [ 2285.036855][T16536] ? trace_irq_disable+0x3b/0x150 [ 2285.036870][T16536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2285.036881][T16536] ? clear_bhb_loop+0x40/0x90 [ 2285.036893][T16536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2285.036905][T16536] RIP: 0033:0x7f5a1d79c799 [ 2285.036917][T16536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2285.036927][T16536] RSP: 002b:00007f5a1e5f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2285.036941][T16536] RAX: ffffffffffffffda RBX: 00007f5a1da16270 RCX: 00007f5a1d79c799 [ 2285.036949][T16536] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 2285.036957][T16536] RBP: 00007f5a1d832bd9 R08: 0000000000000000 R09: 0000000000000000 [ 2285.036964][T16536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2285.036971][T16536] R13: 00007f5a1da16308 R14: 00007f5a1da16270 R15: 00007f5a1db3fa48 [ 2285.036983][T16536] [ 2285.793237][T16536] macsec1: entered promiscuous mode [ 2285.798945][T16536] macsec1: entered allmulticast mode [ 2285.804275][T16536] bridge0: entered allmulticast mode [ 2285.833716][T16536] bridge0: port 2(macsec1) entered blocking state [ 2285.843423][T16536] bridge0: port 2(macsec1) entered disabled state [ 2285.870437][T16536] bridge0: left allmulticast mode [ 2285.875826][T16536] bridge0: left promiscuous mode [ 2285.880881][T16536] bond0: left promiscuous mode [ 2285.885715][T16536] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 [ 2285.894997][T16536] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 16536, name: syz.2.5412 [ 2285.904107][T16536] preempt_count: 201, expected: 0 [ 2285.909131][T16536] RCU nest depth: 0, expected: 0 [ 2285.914052][T16536] INFO: lockdep is turned off. [ 2285.918817][T16536] Preemption disabled at: [ 2285.918824][T16536] [] dev_uc_del+0x56/0x110 [ 2285.929219][T16536] CPU: 0 UID: 0 PID: 16536 Comm: syz.2.5412 Tainted: G W L syzkaller #0 PREEMPT(full) [ 2285.929240][T16536] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 2285.929245][T16536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2285.929253][T16536] Call Trace: [ 2285.929258][T16536] [ 2285.929263][T16536] dump_stack_lvl+0xe8/0x150 [ 2285.929282][T16536] __might_resched+0x378/0x4d0 [ 2285.929298][T16536] ? dev_uc_del+0x56/0x110 [ 2285.929314][T16536] __mutex_lock+0x119/0x1300 [ 2285.929327][T16536] ? __pfx_vprintk_emit+0x10/0x10 [ 2285.929345][T16536] ? dev_set_promiscuity+0x10e/0x260 [ 2285.929360][T16536] ? _printk+0xdd/0x130 [ 2285.929370][T16536] ? __pfx___mutex_lock+0x10/0x10 [ 2285.929383][T16536] ? __netdev_printk+0x36f/0x480 [ 2285.929396][T16536] dev_set_promiscuity+0x10e/0x260 [ 2285.929411][T16536] ? netdev_info+0x11e/0x180 [ 2285.929422][T16536] bond_change_rx_flags+0x21a/0x690 [ 2285.929436][T16536] ? __pfx_bond_change_rx_flags+0x10/0x10 [ 2285.929450][T16536] ? bond_set_rx_mode+0x409/0x4b0 [ 2285.929463][T16536] ? __pfx_bond_change_rx_flags+0x10/0x10 [ 2285.929475][T16536] __dev_set_promiscuity+0x515/0x710 [ 2285.929491][T16536] ? lock_release+0x4b/0x3d0 [ 2285.929505][T16536] netif_set_promiscuity+0x50/0xe0 [ 2285.929520][T16536] dev_set_promiscuity+0x126/0x260 [ 2285.929536][T16536] br_manage_promisc+0x4db/0x560 [ 2285.929550][T16536] ? __pfx_br_dev_change_rx_flags+0x10/0x10 [ 2285.929565][T16536] __dev_set_promiscuity+0x515/0x710 [ 2285.929580][T16536] ? __hw_addr_del_ex+0x73/0x4e0 [ 2285.929592][T16536] __dev_set_rx_mode+0x17c/0x260 [ 2285.929607][T16536] dev_uc_del+0xc0/0x110 [ 2285.929623][T16536] macsec_dev_stop+0x32f/0x410 [ 2285.929637][T16536] ? __pfx_macsec_dev_stop+0x10/0x10 [ 2285.929649][T16536] ? do_raw_spin_lock+0x12b/0x2f0 [ 2285.929660][T16536] ? rcu_is_watching+0x15/0xb0 [ 2285.929675][T16536] ? dev_deactivate_many+0xb62/0xd40 [ 2285.929690][T16536] ? rcu_is_watching+0x15/0xb0 [ 2285.929703][T16536] ? dev_deactivate_many+0xb62/0xd40 [ 2285.929717][T16536] ? trace_irq_enable+0x3b/0x150 [ 2285.929732][T16536] ? dev_deactivate_many+0xb62/0xd40 [ 2285.929746][T16536] ? dev_deactivate_many+0xb62/0xd40 [ 2285.929759][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2285.929773][T16536] ? dev_deactivate_many+0xd06/0xd40 [ 2285.929787][T16536] ? dev_deactivate_many+0x258/0xd40 [ 2285.929800][T16536] ? __pfx_macsec_dev_stop+0x10/0x10 [ 2285.929813][T16536] __dev_close_many+0x368/0x6d0 [ 2285.929828][T16536] ? __pfx___dev_close_many+0x10/0x10 [ 2285.929841][T16536] ? kasan_save_track+0x3e/0x80 [ 2285.929852][T16536] ? kasan_save_free_info+0x46/0x50 [ 2285.929867][T16536] ? kfree+0x1c1/0x630 [ 2285.929882][T16536] ? rtnl_newlink_create+0x843/0xb70 [ 2285.929897][T16536] ? rtnl_newlink+0x1666/0x1be0 [ 2285.929917][T16536] ? rtnetlink_rcv_msg+0x7d5/0xbe0 [ 2285.929931][T16536] netif_close_many+0x225/0x420 [ 2285.929943][T16536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2285.929957][T16536] ? __pfx_netif_close_many+0x10/0x10 [ 2285.929972][T16536] unregister_netdevice_many_notify+0xb47/0x2370 [ 2285.929987][T16536] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 2285.929999][T16536] ? rcu_is_watching+0x15/0xb0 [ 2285.930013][T16536] ? trace_irq_enable+0x3b/0x150 [ 2285.930029][T16536] ? kfree+0x1c1/0x630 [ 2285.930044][T16536] ? rtnl_newlink_create+0x843/0xb70 [ 2285.930060][T16536] rtnl_newlink_create+0x84b/0xb70 [ 2285.930075][T16536] ? __pfx___nla_validate_parse+0x10/0x10 [ 2285.930092][T16536] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 2285.930108][T16536] ? __pfx___mutex_lock+0x10/0x10 [ 2285.930120][T16536] ? ns_capable+0x89/0xe0 [ 2285.930134][T16536] rtnl_newlink+0x1666/0x1be0 [ 2285.930151][T16536] ? __pfx_rtnl_newlink+0x10/0x10 [ 2285.930164][T16536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2285.930181][T16536] ? kasan_quarantine_put+0xbb/0x1f0 [ 2285.930192][T16536] ? lockdep_hardirqs_on+0x7a/0x110 [ 2285.930203][T16536] ? kmem_cache_free+0x187/0x630 [ 2285.930214][T16536] ? nlmon_xmit+0xb0/0x100 [ 2285.930231][T16536] ? __lock_acquire+0x6b5/0x2cf0 [ 2285.930245][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2285.930258][T16536] ? lockdep_hardirqs_on+0x7a/0x110 [ 2285.930268][T16536] ? __dev_queue_xmit+0x277/0x3890 [ 2285.930278][T16536] ? __local_bh_enable_ip+0xd0/0x130 [ 2285.930290][T16536] ? __dev_queue_xmit+0x277/0x3890 [ 2285.930305][T16536] ? __pfx_rtnl_newlink+0x10/0x10 [ 2285.930319][T16536] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 2285.930333][T16536] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 2285.930347][T16536] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2285.930360][T16536] ? ref_tracker_free+0x693/0x840 [ 2285.930373][T16536] ? __copy_skb_header+0xa3/0x4a0 [ 2285.930389][T16536] ? __pfx_ref_tracker_free+0x10/0x10 [ 2285.930405][T16536] netlink_rcv_skb+0x232/0x4b0 [ 2285.930418][T16536] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2285.930432][T16536] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2285.930447][T16536] ? netlink_deliver_tap+0x2e/0x1b0 [ 2285.930461][T16536] netlink_unicast+0x80f/0x9b0 [ 2285.930475][T16536] ? __pfx_netlink_unicast+0x10/0x10 [ 2285.930487][T16536] ? netlink_sendmsg+0x650/0xb40 [ 2285.930499][T16536] ? skb_put+0x11b/0x210 [ 2285.930514][T16536] netlink_sendmsg+0x813/0xb40 [ 2285.930529][T16536] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2285.930544][T16536] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2285.930557][T16536] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2285.930570][T16536] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2285.930583][T16536] ____sys_sendmsg+0xa68/0xad0 [ 2285.930598][T16536] ? futex_unqueue+0x211/0x240 [ 2285.930612][T16536] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2285.930629][T16536] ? import_iovec+0x73/0xa0 [ 2285.930645][T16536] ___sys_sendmsg+0x2a5/0x360 [ 2285.930661][T16536] ? __pfx____sys_sendmsg+0x10/0x10 [ 2285.930678][T16536] ? futex_wait+0x29a/0x380 [ 2285.930698][T16536] ? __fget_files+0x2a/0x420 [ 2285.930713][T16536] ? __fget_files+0x3a0/0x420 [ 2285.930729][T16536] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2285.930745][T16536] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2285.930763][T16536] ? rcu_is_watching+0x15/0xb0 [ 2285.930779][T16536] do_syscall_64+0x14d/0xf80 [ 2285.930790][T16536] ? trace_irq_disable+0x3b/0x150 [ 2285.930805][T16536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2285.930816][T16536] ? clear_bhb_loop+0x40/0x90 [ 2285.930828][T16536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2285.930839][T16536] RIP: 0033:0x7f5a1d79c799 [ 2285.930851][T16536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2285.930861][T16536] RSP: 002b:00007f5a1e5f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2285.930876][T16536] RAX: ffffffffffffffda RBX: 00007f5a1da16270 RCX: 00007f5a1d79c799 [ 2285.930884][T16536] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 2285.930892][T16536] RBP: 00007f5a1d832bd9 R08: 0000000000000000 R09: 0000000000000000 [ 2285.930899][T16536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2285.930906][T16536] R13: 00007f5a1da16308 R14: 00007f5a1da16270 R15: 00007f5a1db3fa48 [ 2285.930923][T16536] [ 2287.021483][ T29] audit: type=1326 audit(1772360690.698:1934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2287.056388][T16528] program syz.0.5414 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2287.068217][ T29] audit: type=1326 audit(1772360690.698:1935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2287.122284][ T1720] usb 6-1: USB disconnect, device number 113 [ 2287.140561][ T29] audit: type=1326 audit(1772360690.708:1936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2287.185253][ T29] audit: type=1326 audit(1772360690.708:1937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2287.221783][ T29] audit: type=1326 audit(1772360690.708:1938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2287.295983][ T29] audit: type=1326 audit(1772360690.708:1939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2287.337536][ T29] audit: type=1326 audit(1772360690.708:1940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe59239c799 code=0x7ffc0000 [ 2287.389159][ T29] audit: type=1326 audit(1772360690.708:1941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16518 comm="syz.0.5414" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe59239c799 code=0x7ffc0000