last executing test programs: 9.999157863s ago: executing program 1 (id=3006): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xa4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000002140)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e44efeabe00", 0x7}], 0x1}}, {{0x0, 0x0, &(0x7f0000002040)=[{&(0x7f0000001b00)="c779a881400f168b3cd3b9dcb8505d626656e6b4f5441fb27838fa6f26bfe21f20605b23fffe6978fe6148e25caa0c0f9b6e4434877b8978a5caa4c641dfe5b407dd88d709f6c3aaf2eb6d966f38806c79f63870496f06f6", 0x58}, {&(0x7f0000000540)="6f433f8987fc9e72c982b56a37a1c7b7ab31e2f6b098f57a62f9d8a98a9d4f71997d1cd449c76702", 0x28}, {&(0x7f00000005c0)="8e26189d110469a886116da338167241f58b9e3a3d25fef3424da95dfc37a21add3be660fabda17c87a232ecdbee49495e0b9249d65983123d5a84", 0x3b}, {&(0x7f0000001d00)="45a4cdaed78e8aae62776ab5e19dab8363b642daf5ce06da88ce31cbf434c7758737d1610707c1be62e5680748b3b645a25af50508b344b621146721fc4a9657fd77ad93f48d94a70de115016171efb302adb61ee81ba5e41965e62716beb2de6762170181690f54affcfe", 0x6b}, {&(0x7f0000001dc0)="4423c554c1d89dfdb98e09e6c7cac32762158fa3479da58104548fdcc7ef57389b9f63250592f4cc92cc344e1b3cd46446f8d4481699666b5f9e6e2b8a82c435ed400d40d67f1e3cf3931905f34b74e7cadf145de53d91ecb305560836557a01a67cc87c52ae248f04c2ec28cdcb21d816fccdef1d80efc00616ef86a1ec5a51789f2473ef6bbda9461f1cca", 0x8c}, {&(0x7f0000001e80)="ec1d60ccbe85510cec58bd3786a575b46de8fd547ade80f426f7e4f4278fc924d53d9073acf8247cf722ba4e9c7bfb1ba70b921b3bd3b1e061033204d9629d417ea1d834bc2539294611e3b6e5abf5c3eb10dc92cbaae7e80dd65084164afde069218042d5d2d8e256856c0bd1e7568574b80c4d5e51bf8604a10fe5f3f69a0a794905f74f75f189780c86ace348c270b3a346061d7f669d723871fb66", 0x9d}], 0x6}}], 0x3, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="04", 0x1, 0x10008095, 0x0, 0x0) 9.73965273s ago: executing program 1 (id=3008): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, &(0x7f00000000c0)='/dev/input/event#\x00') r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0) syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f00000005c0)={0x0, 0x0, 0x5, &(0x7f00000002c0)={0x5, 0xf, 0x5}}) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x34, r5, 0x1, 0x1070bd2f, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x34}}, 0x20) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x14, r5, 0x325, 0x0, 0x0, {0x8}}, 0x14}, 0x1, 0x4000000000000000, 0x0, 0x40001}, 0x0) mlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000340)='cbc(cast6)\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2f) r8 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000380)=[@enable_nested={0x12c, 0x18}, @code={0xa, 0x66, {"f3260f35450f224266410febda66ba2100b82c000000ef66b8bf000f00d8640f0179a52636660f388186f5000000c74424000c010000c7442402df46715cff1c2466baf80cb84451a58bef66bafc0c66ed420f01ca"}}, @wrmsr={0x65, 0x20, {0xaf9, 0x1ff}}, @wr_crn={0x67, 0x20, {0x0, 0xd5}}, @cpuid={0x64, 0x18, {0x3, 0x4}}, @rdmsr={0x66, 0x18, {0x893}}, @enable_nested={0x12c, 0x18}, @wr_crn={0x67, 0x20, {0x0, 0x5}}, @nested_load_code={0x12e, 0x61, {0x1, "65660fe62066baf80cb884c5ba8eef66bafc0c66ed660f6e2366b81f018ec8440ffad90ad366400f3841700044d9ec66baf80cb8bc442685ef66bafc0cb800301a9aef66ba430066ed"}}, @nested_create_vm={0x12d, 0x18}, @nested_vmresume={0x130, 0x18}, @rdmsr={0x66, 0x18, {0x9d0}}, @in_dx={0x69, 0x20, {0x1803}}, @out_dx={0x6a, 0x28, {0x941a, 0x7, 0x4d}}, @code={0xa, 0x4c, {"c46151ec7158c421ad72e75f410fc5fe000f01c9670f79df3e0f0866ba4300edc4e135690f66baf80cb81cae548def66bafc0ced67d2a8f1bd35ff"}}, @nested_vmresume={0x130, 0x18, 0x2}, @wr_crn={0x67, 0x20, {0x3, 0x8}}], 0x29b}) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f00000001c0)="df32baf80c66b8b0830c8766efbafc0c66b80a00000066ef0f781e1e80360f01c40f011a62a6465166f20f129df28fbaf80c66b8c497ca8b66efbafc0ced66b9ae0800000f320f20e06635004000000f22e0", 0x52}], 0x1, 0x1, &(0x7f0000000100)=[@dstype3={0x7, 0xf}], 0x1) 7.884202127s ago: executing program 1 (id=3013): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r1, &(0x7f0000000400)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x9, 0x0, 0x85, "00000000000000000000ffff00"}) ioctl$TCSETSW2(r1, 0x402c542c, &(0x7f0000000100)={0xa, 0x80, 0x1, 0x1, 0x8, "c098e7b0bd21430de428cf78b7adfdec60be6a", 0x1, 0x5}) syz_open_pts(r1, 0x100) r2 = syz_io_uring_setup(0xbdc, &(0x7f0000000280)={0x0, 0xec25, 0x400, 0x3, 0x40000330}, &(0x7f00000006c0)=0x0, &(0x7f00000000c0)=0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz0\x00', 0x1ff) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xfffffe62}], 0x1}) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/key-users\x00', 0x0, 0x0) preadv(r5, &(0x7f0000000240)=[{&(0x7f0000004bc0)=""/68, 0x44}], 0x1, 0x29, 0x0) io_uring_enter(r2, 0x47ba, 0x0, 0x28, 0x0, 0x0) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280), 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) r7 = socket(0x11, 0x2, 0x54eb4371) unshare(0x400) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) rt_sigsuspend(0x0, 0x0) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r7, 0x84, 0x6, 0x0, 0x0) io_setup(0x2, &(0x7f0000000200)=0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00461311fddb72a38ec1042dbd7000fbdbdf25020000000400000008000200038000727c1a27bbb5bf69c41c94804841146a357dac0c8aff75113255e73b3b00853dba7341dd028b454873cbfc94a08b790a52b7af948c2630f8ddba3b"], 0x2c}, 0x1, 0x0, 0x0, 0x44801}, 0x0) io_submit(r8, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x18, 0x7000000, 0x41, 0x7, 0xffff, r6, 0x0, 0x0, 0x7}]) fsmount(r6, 0x1, 0x4) syz_usb_connect$uac1(0x0, 0xa0, &(0x7f0000000240)=ANY=[@ANYBLOB="12011001000000406b1d010140000102030109028e27a53c0003010600290904000000010100000a24010900080201022e240506046b483439c10709040100000102000009040101010102000007240102050500072401017f010009240202e6ff0500080905010908000706000725010006a6210904020000010200040904020101010200000c2402020200ff22a48080e40705fa811250a2305f33ff010600000724010b08021009853a7937cbcfb8bd1786627391afd835b99198c2b8ef239a34f232854d6e"], 0x0) 7.368108044s ago: executing program 2 (id=3015): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$sndctrl(&(0x7f0000000280), 0x84, 0xc8080) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) (async) r3 = syz_io_uring_setup(0x812ac, &(0x7f00000002c0)={0x0, 0x7495, 0x0, 0x2, 0x9}, &(0x7f0000000380)=0x0, &(0x7f0000000340)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r6 = socket$l2tp(0x2, 0x2, 0x73) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x80, &(0x7f00000000c0)=@in={0x2, 0x4e21, @multicast1}, 0x0, 0x0, 0x1}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000200)={r2, 0x0, 0x0, 0x4}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r7 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) (async) r8 = fsmount(r7, 0x0, 0x18) symlinkat(&(0x7f0000000000)='.\x00', r8, &(0x7f0000000140)='./file0\x00') (async) openat2(r8, &(0x7f00000003c0)='./file0/../file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x8}, 0x18) (async) write$binfmt_misc(r8, 0x0, 0x0) (async) socket(0x10, 0x3, 0x6) (async) socket(0x10, 0x3, 0x0) rt_sigpending(&(0x7f00000000c0), 0x8) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/address_bits', 0x70000, 0x0) write$sequencer(r9, &(0x7f0000000180)=ANY=[@ANYBLOB="9300000600"/19], 0x18) (async) openat$cgroup_ro(r9, &(0x7f0000000140)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000240)) socket$inet6_udp(0xa, 0x2, 0x0) 7.126452365s ago: executing program 2 (id=3017): openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e80)={0x908, 0x1b, 0x1, 0x7fff2, 0x25dfdbff, {0x1}, [@nested={0x8f2, 0xc9, 0x0, 0x1, [@generic="ec2d9d500fcfad90b1b5ebe2ee36e625a5fca8d8", @generic="504bdd7ce9b9b47794663a8b92bc0ddaaa2b3d1032c0a3e187003a4af53109616fb3f389568f8a4fd0a9", @generic="734badadeef0f9a88202805cb06eac9dd0e230c8245154023b1d53de22cbc515dd11f472291dcd352be7415445d4d6590458882d29f433f28689da65ac9be87efa51adc09c48a760d4d5", @generic="417ec092c16c41947135e20883a6f6e87c7825869b0fb6d5669a32f418e0bca9e167458069e53146a780ca2b6962f564d5b384bf937890a9e508d26a218b682dda3e6e5bc167dc3016cbfd322b47b3b9213f7d5a770000621793", @nested={0x80c, 0x85, 0x0, 0x1, [@typed={0x800, 0x14, 0x0, 0x0, @binary="e2551b88edaf7d98e3fe8f7ae1b8ff1a77ca4094e33ec3495f4402385d26ad29891845c0466898347ece52fa3c2b1e326e156a8dbf032b0d10423fedeb1f7d13c82e02e1cf68a6b4b060bf95d30093634d2a0ced57dfc596ea0e0a9f53515d3fc5af1fcfe69ce671ac13c5556b389c44cb3d8b92533500a1dc06ff4720524fa99620a9597bf614552648cbb7e0639414495e9dda1b5ed90bf3486aca77ac470c59ac313cd8a2e661d843ed2fef25b4a5a2f41158f6a0251ed60105e5c06810d343fd1a0d2b768b2eb85fd1ed56c45b330565a683f7d5a72878d86356f5a6001f839f0bc4c2169ff642221001e1da7bd85ed01a9a66a1057f1d66af85573f5d10e01212c4d633e035c1914d23df071f6fdd86df582f3ff686167b2c03c05ac7df4e4a116c04af59bfc7a3e33674b280cc3faa71f8b98cd11f496afbef4b4cfbcbc21fcb566fad3a1132b53fe8c6d20ca863140c7fca881d1d48169b4b278f0d6e0d79681d1f1782a71eeb485595855bbfaf78a2a9257626364156149ca1df844af2ba2e853ad53880fd8d74ace5f0347f72bb71fe5cb6146833481390cdbd758887727b6a1047451b60391c40247b05d03a83a1652e5e2cc1c685dfd5aeea7761663e3cb9b8cb7590cf77c883273e29a294b03faf7e615893b15e56b96aceeae1ce151c7bea91079c4158940d375deb818969d0516c42e1cb5fa41874be513ebf5db2edb823fe1ca559359a2fa64f4168ef4353dd2df8992044daa323d664c6b2e86d2fc56102a917127fa907422eb589462b7a283801e184077b5d0476f10cf881a90c898b68d0c12a5163f062c920cffcb77ff98b180b10f80753048a24a9eefe7f9cf92e4821001bd8917d0427aa85384e0d4c5be360e2eb2023a67b43afe5d7f438e912bdaba504945051c7c011f2605c47ee8866e248c33d7a60cb6304fdad749c4167026ac4c8f3dee6916021c2b3945fd34ad5de30296bd9709281bbcb7f5952880115cfd8d48cda4a0d4a2f439ff1d190efb86c5297cfbfe9d576e8bfc33e09bba593b67fdb7d16361dffe333406cef37d9c39dfbe5ab230bba7f6a452ebaa5a8f452a4ba0e4cd4089a72f7e0b36e0be458481cf3a65f1a5a98b62285660a517f53b926518016c8fae73297cc188ef1279a082b22ef76d59ead434d392851f03d3ed8f824a7177c3edff2ca6bc99c43732b90e7ee28d9d6ba2fc0da00e20f7c552d6b4ecda2452a330ba9948675ddd7cb3824cf387c48db52d7cb06f9d049ba12fbb4a22886cf579758fc0fee8f49ecf276e3ddf40fff849b9ec38cd4122bb2b79cc37714fd02254133d80b6711b9f367ca851fb3db643e05769fce2f3c1cb17eeacd7cfc1b71c06ef5ee406b43210278fe284b112ee9287c29919521fece760b6527386adf0c7ba4d90af55a7a343c6672bafbe9c8ee0ee3f492886aa5bcd7ff7f1fdffd3401ec4787c04fa4c8cf20d40720146b3fee2182f212d45d1ff028c3afced9ec6a6fe24199c159b635a5b9cfe1ac4cd8b0d6d032c8d21466e1340adbb9a2a56c7a84840dfb99c4d7a2f8a25c8020a357c9bf8c3b8f1db1281eb655667147354123c2087d097128ca4435eca94dc68c92a746690197d15c7cf4a5a238cde23ce1b725501e808c544c254a71f214dd39aaa3e3d3ce8965f491989cd2785b47a5074672efe664be92888c92253dd0a7d36f1c5006af65ddc709e7adb322afec853b8c6de1422c2124077e4a680c624bb0681c3f173cb1a4d318607c0b1435a9cd4fa57e3bf03d3b84f57d46bcff71486ffba75a6d4607de07a3ce1776a468dc7ec4dca6d59f4416553cfe048f22d55d5008680e727fc9438bcefe1a5822e9d7f9e8f81a392fcd2255734ef080177c1b2071bb2a58b8b881801cf43f605f63972b2856c60ded31ac0554d3d06ce49f569d8a189e903f8c65def29148a197af24dbb2a49dc827ae86fe6596299aadaf8e3bdca13d1da0342cf68ed495b53f6374180ca96f4050342f9d740be5cc3c40f9042c588dc4fd61cec57d9d1688b0cb0c02e0c21f21b3c054d0be2ddc0ffd084335cde11d2d1fa63fbe759808e752a91e7576b547831259fa633ce6be79ec477e24028368bfb80e331af451385c64c10573363773d76f38c19363614c6f81f8139edd4e2a1ad9b3c90f972030fd59c2e95d6cfecc9ba11e1246185dc27e402988905a281bac4b3e13469158b08379f052596c7a297c676e0aaecff00192564a34e828d2219762c162435441c5fce63eb485ff7e36ce32c2addcfb5131a5d2195e81f41764aa0180b916aa11abd0eb047e54d28c05e618ffdc09a7c2b21ca8b8c3901ba0c620bb3a82e31e56bfed4a7c897aa54c847fb7628de32c348e6596ebaf4dc8e379a1092348957fa916c185dee5667fb1dd9bbf9725a56875407208d16e64cba04f5bb0d1727cef75824281453e855890e99a3790cf0902aa84b2351935b11cbc1e481be3b67758e189f647ce8460dc28d4864045637f403fc32b7042faaf17190b4161d52d522bff33c5cac89d1be4503e107f9746529b29456ecd01965979bd047c017ee51c2dc611e52e2cafc31cc70a5ed96c621ac4dcc1bce5c5a0ba75ab91652e0b41220e4cfb16c80018838ea60d11d49e4657c09afec56e2eadb02c5aeb7cd610ca51ab12c7d50eaf98235e9aec03ee18d6f515afa0cea5485486bce0fe85af5b8aaa08c11ad4057fb1ac8835d9f6eedd90f6320fd7d669659cfa35d0a43c3738e2aad86b95eec82e17d8a48ef066d3b5289d694f15fa60dc7c707e1d411c2825751837b016d8222cad20086968770937d0d713180f30f20f801b2696ad8ace63875ede9860c315aa31425a8cfc6f7c4a812b833eaec53740d2b1b96aecd2e7"}, @typed={0x8, 0x1b, 0x0, 0x0, @fd}]}]}]}, 0x908}, 0x1, 0x0, 0x0, 0x400c801}, 0x8094) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000e00)=ANY=[@ANYBLOB="e400000043000701fefffffffcdbdf25017c000004004580ca00018000005a00252b27272900", @ANYRES64], 0xe4}, 0x1, 0x0, 0x0, 0x50}, 0x4800) 6.938026539s ago: executing program 2 (id=3018): syz_open_dev$video4linux(&(0x7f0000000000), 0x7, 0x8000) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40080) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = userfaultfd(0x80001) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x17ef, 0x60ee, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000ac0)={0x2c, &(0x7f0000000740)={0x0, 0xd, 0x7, {0x7, 0x0, "8c8fde8535"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) read(r1, &(0x7f00000002c0)=""/153, 0x99) io_setup(0x490, &(0x7f0000000000)=0x0) r4 = io_uring_setup(0xe96, &(0x7f00000003c0)={0x0, 0x8238, 0x800, 0x2, 0x2e2}) close_range(r4, r4, 0x0) io_pgetevents(r3, 0x1, 0x0, 0x0, 0x0, 0x0) r5 = syz_io_uring_setup(0xe1a, &(0x7f0000000240)={0x0, 0xf803, 0x10100, 0x0, 0x229}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r5, 0x2ded, 0x4004, 0x0, 0x0, 0x0) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0) read(r8, &(0x7f0000000200)=""/202, 0xca) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r9, 0xc01064c8, &(0x7f00000000c0)={0x6, 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) unshare(0x22020400) 6.729616732s ago: executing program 3 (id=3020): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="0201000202000045c2493799bcf54100"], 0x10}, 0x19}, 0x0) setsockopt$sock_void(r0, 0x1, 0x1b, 0x0, 0x0) 6.410969569s ago: executing program 3 (id=3022): r0 = syz_open_dev$radio(&(0x7f0000000040), 0x2, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x0, 0x0, 0x80000001, 0xfffffffe}) r1 = socket(0x29, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x8, @local}, {0xa, 0x0, 0x0, @empty}, 0x1}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e24, 0x100, @local, 0x4}, {0xa, 0x4e23, 0x7, @empty, 0xd473}, 0x0, {[0x4, 0x7, 0x3, 0x8001, 0xe10, 0xe, 0x3]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @empty}, 0x1, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xe3]}}, 0x5c) r2 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000140)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) getsockopt(r2, 0x200000000114, 0x5, 0x0, &(0x7f0000000180)) syz_usb_connect(0x0, 0x24, &(0x7f0000000b80)={{0x12, 0x1, 0x0, 0x57, 0xb0, 0x2b, 0x40, 0x5ac, 0x253, 0x71eb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbe, 0x0, 0x0, 0x3, 0x98, 0x2}}]}}]}}, 0x0) syz_open_dev$radio(&(0x7f0000000040), 0x2, 0x2) (async) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x0, 0x0, 0x80000001, 0xfffffffe}) (async) socket(0x29, 0x3, 0x3a) (async) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x8, @local}, {0xa, 0x0, 0x0, @empty}, 0x1}, 0x5c) (async) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e24, 0x100, @local, 0x4}, {0xa, 0x4e23, 0x7, @empty, 0xd473}, 0x0, {[0x4, 0x7, 0x3, 0x8001, 0xe10, 0xe, 0x3]}}, 0x5c) (async) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @empty}, 0x1, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xe3]}}, 0x5c) (async) socket(0x40000000015, 0x5, 0x0) (async) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000140)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) (async) getsockopt(r2, 0x200000000114, 0x5, 0x0, &(0x7f0000000180)) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000b80)={{0x12, 0x1, 0x0, 0x57, 0xb0, 0x2b, 0x40, 0x5ac, 0x253, 0x71eb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xbe, 0x0, 0x0, 0x3, 0x98, 0x2}}]}}]}}, 0x0) (async) 4.672936338s ago: executing program 1 (id=3023): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) r0 = mq_open(&(0x7f0000000000)='e_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x8000000040000000, 0x4, 0x4, 0x9}) mq_timedsend(r0, 0x0, 0x0, 0x5, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0xfd, 0x0, 0x7ffc0002}]}) mq_timedreceive(r0, &(0x7f0000000140)=""/154, 0x9a, 0x0, 0x0) (fail_nth: 4) 4.619264939s ago: executing program 3 (id=3024): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0xc001) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000dc0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0}, 0x18) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUCODE(r3, 0xc018480d, &(0x7f0000000000)={0x3, 0x100, 0x2, 0xfffffffd, 0x8, 0x6}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r5}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f00000000c0)=[r5], &(0x7f0000000280), &(0x7f0000000300)=[r6], &(0x7f0000000340)}) r7 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x34, 0x70, 0x9d, 0x40, 0x55f, 0xc230, 0xb6ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf2, 0xa7, 0xcc}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x20, 0xe, 0x1, "c5"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r7, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000280)={0x40, 0x18}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$HIDIOCGDEVINFO(r3, 0x801c4803, &(0x7f00000006c0)=""/217) 3.509415962s ago: executing program 1 (id=3026): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r1, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 3.019202322s ago: executing program 2 (id=3029): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x208180, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a00000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000000), 0x7, r1}, 0x36) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)=0x19) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000002c0)=0x1) (async) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCL_SELLOADLUT(r2, 0x541c, &(0x7f0000000000)={0x5, 0x10000, 0x4, 0x95a2, 0x400}) 2.839645059s ago: executing program 1 (id=3030): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r2, 0xc1205531, &(0x7f0000000540)={0x1, 0x46, 0x7, 0x5, '\x00', '\x00', '\x00', 0x0, 0x20000000, 0x0, 0x0, "b6855a32674ffa64f778ddcf29c94337"}) r3 = fsopen(0x0, 0x0) fgetxattr(r3, &(0x7f0000000200)=@known='com.apple.FinderInfo\x00', 0x0, 0x0) r4 = socket(0x2, 0x80805, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f00000007c0)=@raw={'raw\x00', 0x9, 0x3, 0x200, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x410, 0xffffffff, 0xffffffff, 0x410, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0xa, 0x81, 0x2, 0x0, 'syz1\x00', 'syz1\x00', {0xffffffffffffff3f}}}}, {{@ip={@loopback, @broadcast, 0xffffffff, 0xff000000, 'syzkaller0\x00', 'netpci0\x00', {}, {0xff}, 0x29, 0x1, 0xc0}, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x260) sendmsg$unix(0xffffffffffffffff, 0x0, 0x40) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0xfffffffc, 0x80000000}, 0x0) syz_io_uring_setup(0x269, 0x0, &(0x7f0000000280), 0x0) shutdown(0xffffffffffffffff, 0x1) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r6, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r6, 0x0) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10) recvmmsg(r7, &(0x7f0000002b80)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000002c0)=""/80, 0x50}], 0x1}, 0x5}], 0x40000, 0x0, 0x0) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r8, 0xffffffffffffffff, 0x0) r9 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r9) 2.723312458s ago: executing program 0 (id=3031): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0xc, &(0x7f00000000c0)=0x10001, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000004c0)='net/ip_tables_targets\x00') r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd2(0xe5a, 0x80000) r1 = socket$key(0xf, 0x3, 0x2) pipe2(&(0x7f00000002c0)={0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x0, 0x44) ioctl$HIDIOCSREPORT(0xffffffffffffffff, 0x400c4808, 0x0) socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x100000000000000, 0x80, &(0x7f0000000500)=@broute={'broute\x00', 0x4011, 0x0, 0x90, [0x200000000100, 0x0, 0x0, 0x0, 0x200000000130], 0x2, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000067b1f9d2bc08328f51000000328557200000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000a88adf01a65b000000000000000000b440506300"/159, @ANYRES64=r4, @ANYRESDEC]}, 0x133) recvmmsg(r4, &(0x7f00000004c0), 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0xfffffffffffffffe, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x1ff, 0x0, 0xfffffe0000000001, 0xe00000}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={0x0}, 0x18) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r3, 0x40049366, &(0x7f0000000100)=0x2) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x3}, 0x1c) sendmmsg$sock(r5, &(0x7f00000003c0)=[{{&(0x7f0000000080)=@phonet={0x23, 0xff, 0x4, 0x7}, 0x14, 0x0, 0x0, &(0x7f0000000340)=[@mark={{0x14, 0x1, 0x24, 0x7ff}}], 0x18}}], 0x1, 0x40001) fcntl$setpipe(r2, 0x407, 0x80000000) sendmsg$key(r1, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={0x0}}, 0x880) syz_open_dev$video(&(0x7f0000000040), 0x34, 0x698480) 2.698963481s ago: executing program 4 (id=3032): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) eventfd(0xc) r0 = syz_io_uring_setup(0x66e, &(0x7f0000000240)={0x0, 0xd87f, 0x10100}, &(0x7f0000000380)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000001100)=[{0x0}, {&(0x7f0000001140)=""/30, 0x1e}], 0x2}) io_uring_enter(r0, 0x567, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) futex(0x0, 0x80000000000b, 0x4, &(0x7f0000000180)={0x77359400}, &(0x7f0000048000)=0xfffffffd, 0x0) (async) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r4, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0xffff, 0x3, @local}, {0xa, 0x0, 0x0, @empty}, 0x0, {[0x0, 0x0, 0x0, 0x2000, 0x0, 0xe3]}}, 0x5c) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'syztnl0\x00', 0x0, 0x2f, 0x9, 0x0, 0x6, 0x10, @local, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xf8b0, 0x8, 0x4, 0x219}}) sendmsg$nl_route(r3, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="780000001300010026bd7000fddbdf2500000000", @ANYRES32=r5, @ANYBLOB="022004000000000005001100a60000002c0019800c0002002e2724215c2c00000014000500e82dd30fb0789ccd2bd18b5ca67650ce240012800a00010069706f69620001000033f15cc2000500000000000000000000000000afcaa5dac225b9a6a87ff5f3f3b99447a00962bcd4e9d081dd80d33b7bb2dfa09b2de5d7b58856c649285867930b9d3ce59fffa5620956e65d439ff842540db9f339a7cb52dc8600000000000000"], 0x78}, 0x1, 0x0, 0x0, 0x8040}, 0x8c4) sendmsg$nl_generic(r4, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1400000018008f7e59d71207e9fae5252b5d77529b2452b9bfe03e5be82a082878403ada38c0f54140563adaecc15563303dc5fe122d93899de17bdd1060d2a668d2139fc400"/84], 0x14}, 0x1, 0x0, 0x0, 0x840}, 0x840) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000040), 0x55af) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r6, 0x0) (async, rerun: 32) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='children\x00') (rerun: 32) read$FUSE(r7, &(0x7f0000002e40)={0x2020}, 0x2020) (async, rerun: 32) r8 = fsopen(&(0x7f0000000440)='cgroup2\x00', 0x0) (rerun: 32) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) (async) r9 = fsmount(r8, 0x0, 0x0) (async) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f00000004c0), 0x20000, 0x0) sendfile(r9, r10, 0x0, 0x201f00) (async) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000680)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x5b2, '\x00', r5, 0xffffffffffffffff, 0x1, 0x1, 0x2}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x10, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf349, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@call={0x85, 0x0, 0x0, 0x65}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x84, &(0x7f0000000580)=""/132, 0x41100, 0x43, '\x00', 0x0, 0x25, r7, 0x8, &(0x7f0000000340)={0x3, 0x4}, 0x8, 0x10, &(0x7f0000000640)={0x3, 0x8, 0x4, 0x8}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000700)=[r9, r11], &(0x7f0000000740)=[{0x4, 0x1, 0xc, 0xa}, {0x4, 0x5, 0x7, 0x1a}], 0x10, 0x35}, 0x94) 2.599192128s ago: executing program 2 (id=3033): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xa4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000800)="cc5a4dbac0affd0a979c63ea8352d608a51fc8625318716ddf62b7752be4540c4ac7d344c53a3ad28313abc2437b60b03c0e587cafcf9a435bf90c618351f70a828238fdf90bc5d36c7d614b82552649954e0185662defd28f78449f073bad544f586136c5076a6f0f1b6fc9adf80557eb44db1b41824e9ef104c95e999766bbf27d74ad5d8fa63210cde65d384dd3e87c1fedaec3144d1ee66a0eb0750363e346cb930dae6109df6b9955bf8af119b5c9a86622af4ff8b5949fb90f8edbde416d046d61512fe4c453bb601a780e1bbc00dbedc5e50d3cd9bc920810eaefd5f9a171e9d32ab46b42e3e78c60087318bab42e94653cbdd600fba37c5a31d095500e91d02256f101e82447e34733220cdaaabc947f5b815080b5214c94a06fe96450ea42f48006c032b24d9e8d722841b7c7244b1d2cc012fcda1f7472fdbabb673ef862e32b359fad715b3f5cef6ef951abab80a4a0f5f8574395c5820fa25d07a119e23b39a87cb3b763fbfb0493121eec3e05eacbe7835e79e74881d1179013622a2a6421d51c974e6abd48a9882c8fcadbcee369346a9ad948fd5dd8f87496a30a9d888cdbcee8f3592dd69165358c4cd474639fc13300317b7fed115fb9818b20d177a39157101dbd8e23bc9ed32efed96c410a103d35336fb4ee4000bfb3d32b0181ff3d726a7dc6432a336a42b50b2c6877cb63b410d746b35fc721e5992ba47c3a2bc2d3679abe0794d226b7b0c333c3000fee7adaafb6efd57382eb2a86d71acaae52a154", 0x228}, {&(0x7f0000000300)="17e37d3e106d9beae191613d45501cb6a8d8eaeb96ee68b2d800ad34b8c528b97ead9f051e427e309b714d3d12d8d4010c04a27e6c586b3956f0dfc7086e9550bd651b9e019d7b671b231c7a8cbfd52bea572b327362fd4db8e4a162096a0464fd2529fc31f79947d137520a8823ae6f0c068c299db997db4d44cfd7657ea53a691a386f018286b4dbe415596964ab56a9c0d7280e592ad174e737a4e5e4cd560030a7380c37f6629e3da2d24a2b6b5ea407e3f075fbf8174a58b3ffeb4d2a0fc8f94fe18a75bc699e8cea7bf13ba6388dc9a8", 0xd3}], 0x2}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e44efeabe00", 0x7}], 0x1}}, {{0x0, 0x0, &(0x7f0000002040)=[{&(0x7f0000001b00)="c779a881400f168b3cd3b9dcb8505d626656e6b4f5441fb27838fa6f26bfe21f20605b23fffe6978fe6148e25caa0c0f9b6e4434877b8978a5caa4c641dfe5b407dd88d709f6c3aaf2eb6d966f38806c79f63870496f06f64302d7f1292499f44695", 0x62}, {&(0x7f0000000540)="6f433f8987fc9e72c982b56a37a1c7b7ab31e2f6b098f57a62f9d8a98a9d4f71997d1cd449c76702", 0x28}, {&(0x7f00000005c0)="8e26189d110469a886116da338167241f58b9e3a3d25fef3424da95dfc37a21add3be660fabda17c87a232ecdbee49495e0b9249d65983123d5a84", 0x3b}, {&(0x7f0000001d00)="45a4cdaed78e8aae62776ab5e19dab8363b642daf5ce06da88ce31cbf434c7758737d1610707c1be62e5680748b3b645a25af50508b344b621146721fc4a9657fd77ad93f48d94a70de115016171efb302adb61ee81ba5e41965e62716beb2de6762170181690f54affcfe", 0x6b}, {&(0x7f0000001dc0)="4423c554c1d89dfdb98e09e6c7cac32762158fa3479da58104548fdcc7ef57389b9f63250592f4cc92cc344e1b3cd46446f8d4481699666b5f9e6e2b8a82c435ed400d40d67f1e3cf3931905f34b74e7cadf145de53d91ecb305560836557a01a67cc87c52ae248f04c2ec28", 0x6c}, {&(0x7f0000001e80)="ec1d60ccbe85510cec58bd3786a575b46de8fd547ade80f426f7e4f4278fc924d53d9073acf8247cf722ba4e9c7bfb1ba70b921b3bd3b1e061033204d9629d417ea1d834bc2539294611e3b6e5abf5c3eb10dc92cbaae7e80d", 0x59}], 0x6}}], 0x3, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="04", 0x1, 0x10008095, 0x0, 0x0) 1.707374999s ago: executing program 4 (id=3034): r0 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00001b1000/0xa000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f000007c000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000050000/0x3000)=nil, &(0x7f000005f000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x5}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={0x0}, 0x18) close(0xffffffffffffffff) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$netlink(r3, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000001f00)=[{&(0x7f0000000c40)=ANY=[@ANYBLOB="1401000027000100000000000000000001"], 0x114}], 0x1}, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x3, 0x0, @vifc_lcl_addr=@local, @local}, 0x10) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xfb, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0xd2}}}}}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r3, &(0x7f0000000100)={0x2008}) setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000000)) 1.655138224s ago: executing program 0 (id=3035): r0 = socket(0x11, 0x3, 0x0) sendmmsg(r0, &(0x7f0000000bc0)=[{{&(0x7f0000000400)=@qipcrtr={0x2a, 0x1, 0x4001}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000040)="d479183d7d98d181a4b5f3e38100e2f288a8d2", 0x13}, {&(0x7f0000001c00)="659900c3f7c8e544e1abc41796cae4c9908368acb3abdb908ada84b1c98b91c34352f80ed64e4606a25bcbab94869ac816a7fb9c29a8c768fbffb21ad7f6013ff676da589c2e0865cfd321543070c3dd36bf94deb1d137c220d9c559dd61fb2c8732b6ce023b635b5901ebe508133aeadc8f8f93a2198784aab8ae715ee249968c0429cc80bc8c85c985f4f5f04e3acb0ef2a012f59c82dca7d69dcecf011b0a44b1889cfdfa123ccc8c0cb6469c806560c7681f0c3cae69aeabd2fc80d666e8dd7962495507461967b881a6a840a22962f95d55a722cb40221b16e6a6482bab54591aec3770e27a80974d3e41795c35f7300c2ba523e8486dbf6d7988e56396d13f0c079d856946c3ef2a3aaa0dd0bce7389bfd2c112bed2c5e1ae45ae2be5624016a96be54a1e876acd47e6f3ea1e11f919a12c0db1885930d03ce0d622b1e8ed1bbef406bab5f09a6066b2c1fbc9ba713bf76930cf84520fbd9e3f550b8ea4473b30de57de284951111b723ec7c55d5b9b57022411357766680c60cb193ab17c680e44ebc39a149aba5d5c5d26b021e8275523e832018584a067c1a49a3ea9937d90ce4f04bdcacbe1e3c2dbed7aeed1d85714c7d29c7cbe8fccc9cc9d3bfa4dc80954c69ec3e5abc686ce1735726ef792fe7ffe003fedd7b9a478162e5a33a40014f2dd3a97231df13aa79463896dc0754336e79bd98afad2a36e6efbb4803d543d347cd5b80e4c0fd5333724465f6eddbddb6a176c522347195d64238aa7c6b373d172161f97d267f90fab6a941ddc7670061da257fd46a29919668c492f991e1a16be25638e41c7453d1a40b92a75b07f330a6e07b4b0850989f343998022c5cdb7d7473de1f67ce2ec2ddf0ff6e945dab94bed1abdb959995098a4ad8ca467208febec562fe7c06a8cec88cbe6847b6b24212144da679aa521263aa8c152535a0fbc67dccc7116278f8da118147e9efeb799f37ecde26d9aa2e158bde1bb36bb67218fc9d29eb5ee1a4eb87adb0d9a2c8b6cd04e0d6b3b04f347022afd3ee96f6092dc74e2a09e42a1846afa48c65cd83d2718b95bb2df495da53f6ecafaf5149cfade2ac94517c4765a4522e81b58924bc6471d266541b0f6cf44f0ff636092cb6bd7d2a995b21df583630e4fdbbde7da4da19d6786b9ba3d9c1df5fe2618414940d25d82561fd9bf7b39f704355a51621a86b0bf39dbcc305bd87c4542ac3f852962fc5dee1da8fa4a6d1bf0149f04c06b81f81aedb4f07c9bf0a022a5cc0bcc57819b46931b99b00a0489e79b2bc1edc7d2d0404e09c9742e08867d7eedbc3b511207678c5087c0e01a41538742fdca667f39d8962b876386f6d1d798d09eac55c9587a4c86b4d5e3cfb08c0a0487cc7293ce91a7ec11896140ec8c0074f09497dd9b67382ca77d019bedfe97437429bdff299ba2d27669f6a8533c4a4be188a4e8cd439a6c72b6fe737e7388c5b10680bdba183433e99ccd6f0cf584980712088013aa625f9f78f0141b9fc3491c594229ef182c04a9b0e403511e8fb985918eb5c7bbc1ca5dca429efb209559363283f866c10bb3e05ef2a21182edc045341578e5ac63ba19206d804541fd40e84f5a6c9a20a44d8c76a815c7336c66c24bd9c8e61b95857ba3f06d72b6324d9e63c5672cf5dab0e8002000123c3f98626486e1396c897d92e79e34c6abd10d3f86a968c6b7ec95da7b04799a6419550ad511a45120457907a54296edbb1d7389da99608701c3e5e74d7a814c54e33a8473a8c8c3a6520268fe022d2771076ba921b5dca80301ed5ddda7aa5d3051e15330819abb9ab1da62041b1ebcd1cb38f37b7c13b6afa1351f541fac5539aa442ce2864a9048ce224e2855483a1a8fa12373f2568d7ee56752e67b2b115a7922a9af25c71c9fb67ea62e2bde4c176b57f6bcaa38117a9b0b2802f9b169e615a9e62100aeb1bbd8d03a3a94258a3ceb800c0b7b22af4afe24b0d8656e8fb8b2800c54173d063fd2c2330fe9b66592e144410ffd77207cd55fc317c1e66b98de7396ef3622f98305a460533a17145786910a7cfb3790734855adfeb01a8a0948108258e9a5b6a4d5958024d82079bf032e15666709cf4ed535f5a3a5f2b99377294fe16c24a72a1d6d95e151f478e770b5284c46890901b02b8696f688aa965ec3a70a33bd44346389ae3de7e8fdd4834fabc9afbb6341c6493de8faecf655a259e55944c48e0336660af313d0286f3e221092c0e4dc3834efabbf6931c44a8f8045bb418dbdc5ab9cd454726919a8aded5c679e5f62cf622ce8acd67f0a86634ce09b95677babe70dc216767824e2bbd6b066eebab6e5efc26d07a9a11b0ec4f2a2049b8edd01aa9dada0fc70fe52f1cee95e8df64532348c7317033ac4f54c76e5dfc5b532e237231a15b6bd0700f214a61ad7ace3f546e5f363055ba9f217cbc51ff5d0e4042d51761b8f055c775a305fdcb583c66ae2520c384aaf63d625c569ef2f4d2554d440e9e61118b8fbe1159d0558992a71db056dc5f16430b87fd329af2d7fe5928f430324dbbd247b938e4a4062fa7530da3e04a2b7824d17298e24bd7df0eba8caddfe808fe8a813c93c348eb9cbd651e92da3757450251ba9b2a5c96839fb3e3aadddbddc90a2dbb638b1fb87f990cfa2f96a8bfedf997b89f12dddf259fa1499c430f3cb8340c5cf66c85caf5c172cd0f651d1c2dba1cf26d8b936b17f0385183dfab24fd3bbaabfe866946b290dc278fd8418dc0ddb7785ab7e0f259a85fba0eabaaee55f52305d33339007e73fcded5f2613c710a32caad845b6c99958ccd5712097889f98858223d74042952bd238ee39eb7a1ebe0f0766946709cbb3a92d1551e5feb042452a76c557665fc9fab49768abcc7cb1977f7804d328421c30264b68a7ed05cbb7497a5014e6cdf32df82d41b33f55c67c9c15e723f629af4ac66a62ecc3214140354ef48bc73d3fb0eeb0719473498c2f3d192da0b360e5f3bf8f1ef579ed37a5d0c20eec42714bab59c134d4468736f19f5d32f5b8dc3df45941275264fca42ccb35cacd9965abb06dd7bd3bd0b1d8f32fb4b00d213d5f5d82ebf975b1fb4aeff137783f8b8da73864c3ed63f4142e4b3af5a3b82228eeb95f5d51f671f5b67964d2131c5e8869f8289997811dffe5b58d3dded907839316dbbf75ac8bebf35f036b4f2471808f389f3288ca48a3ae5d78343872df2fa6c67fd69f366c7861bfdde0b5126d5efdf825a03c6520b3a59ecc00469b0c9941f12ddead1f58d37da3ac1582ec701c47532629ae7e038707e3831e9a45f5cad2108f6e48c0c89bdd10bcebf29cb7cc84819cc292ad9c26f767159f2e13d8fc920401c8a682ad3c356d44ca1e7639ddd2c0f92d450069aaa5b778fa713c6c3813cafe6cf610916b02da8fd9ada5e02e0d08326df3dee4b203ddaaeff338be751e769e5c583d1488c5a22f644369d9079f387b36516dd5d706e4a29700d07986cbe1d64271ca0496ffd483fcf12ba1c2e891a2c9d940c61b61406a82a0157648acf3bc598d53046ec5a51c459a8e251ea0641d3d9148883dbb2a27cca1f0937505977689f4c89e045e6e45eec8939bece21fc3f3ff6b3437efe76b4bffdabcf34aaee2d04f21b482e3f2d20f904e723c572f5053e2642ffbf0287be1dc5c75c8e91cd446b1370d9c1c8a076a5eeceb11ad0b0ec959c2df769ae47751530c587b65b1a6feb8915dde7c11ddeaf6947392f746ab6a74630f5ec3a4d5499d46b8561e091c61c522063561ef31d91f680a5f660bf84020257657e79ef0670d93cf9f78c362954ac6f02602492c9f6bca75fe35fd371fe0db76a0a802bb5d04f6cacefb4ec79a3bdb5b0d7ce7b6b1734351b52225a31b16b8414b988f31c6e2aa07efc741e2ca1c3e4d7a382c863540497b12090acb69956e14ed51e569dc52bbbb747c335006a34333c32dac619ffc2d7e3abd7a5b53fde8eccc4f8963e996fabc8a96416d15fa7150faa154b97e685e6316fb73387a616d11aa486120a0d897c2055332eed5f07e50234b0383cb164ddd0501785f5d0109dabbf994be4fdd3e0c81e82cd19dffb63b312678d53c63c05b46739b61e363d944f36d48222476032db59415254879cd368d027fca68361d630fa93422badfc8b91e18e4fdcc2f0532dc7ff57a4100e8b15368a47af303c550542105860542d6fdf78d17e85ab334b7080237c5dd928e07ac0dfcdcd9c34ed4ad8ff47c0c9aa585f0c4f5d227eddf8b65802082a93bb82344162868df6cd2d804e7f9afd6a900f04157e30c796e0ece9998975723a6a9e6ea9f8159ad362bc35abcf779a174791a4aa7c043627075a44a1c93ccdd1df28fdc90d376551548bda51c390b4666c08cc23b1bd76993de97001aa7ccb5dd75dbd74f64b6bb2efdb672797060701e78bc1b5d72c025bba9c2d29c78024425af0e291a3f7386d3791aee91bc20d0f933ee2b2881c4c51720b3a5f5567ba105286c38f64f47b262f83f84e4f46907bca9c936b57e5196b4bbd64c1c8d7ae3e1ed64c598204f5cb90a26efd77ebec403e06f5c37eff5ddff5c30c615d8044e96a0b57a196af2deef36d7be5eada24a40a1eccb50e3466a208b94e2b69c66413ea0dae7eff6cef18fe83ee1717860b2cea2001ad3168f76733c6240c84a9eea9da926f29a74827843d40cf486dfb737ff1d4a9eed5ade6ea400eabea97481a58cdf8697225e71c6b5d22ad66fcfbee3955f3e186bc29a690f1d2874e70f032774a43ac4eec14117a31ef0a00ad6115223e2532dcca9310976ea7222a5c97703b3424bd9c7cf12bc5339d4705cf7dbf03d126b4da27e291a719ff3b1300ed21b425a2e8f7fd2002d137a47af192dd0dd1e26c2a49a16e0204a34fd92b7c3ca69861cdd143a494977e481b0e7c46bea8bedbc995e5a56702c9ab59c0f0cb90cae7a4f2185d50d1c699e4aa2a45177bb6827eb9422b23b8f78d20cec6bc373f62c07872eef3b1b4b7c77838b4e26e9573609f7bef3dcedc2fdf6c2c4aee6ebb9719b8ff578cf5e09933bc39083565e4fe1c18b90b40a72cf45bcfaec0f2c5cad49c606c9588bba24a1ad78be7ab315811c4b02c04b8d04866fa64147bb06f268ea9bc8a35440c4a1f73bd712107e86d5ac2864f592b7fb3aef2661a889475209c80c1adcf2bf165667253a452f1a2f7afb8cdd9ce3aa0b2193220773f11429d4e9f2bcef0c2128d34e632f351fea3b4538dbdf1c699b573b93fbba7a5256e5e3ae42e9fe120940d21f1e00b777031833e8d232283a86fa7ef511a7645d6fc6b0102aebe5b39ddddd4395a5a43dcb2d8a05d2587a4a1799d2239a51e097fadd28b09084148a6209edf2611181c1503c8bb2c5d0bde46d9cb200285ddfa7cb91cd49237ebd57241c3a7bf81da2ac1d95bfcd61faec3d58b52c08ef6c99a65b5a9ce6827705ba1f0d51ae7c84b93abcce96fdfbb2d21a3bc224552d326b65171956cfbd25faa0425bf61647d522b93367a5379c9bd3766ac03b15339e17ea5b0d7173455f6780073a637e8323563f58fe99f8d556a9ba4d8d84fa781ff8eea39bc4f7cb1364bf422bc1e7755cedd3c0c30d6a4930d54adebb81d26b9ba41c1eed62c9ed16a3fb2adc7eeeb2ec6a753878480790a617cacb3a5a590990236d308a2be73b1e1beff9a9b6c22ef627c1453bc6fd2296399821c6f85ed38966d43c9d48dc5000e7fa2c27b6e59dd20109c5cbba36d7532", 0xfdd}], 0x2, 0x0, 0x0, 0x4000000}}], 0x1, 0x4044015) 1.576696548s ago: executing program 2 (id=3036): mkdir(&(0x7f0000000300)='./bus\x00', 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000200)={0x200000000000016a, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_usb_connect$uac1(0x3, 0xa2, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d01014000010203010902900003010380000904000000010100000a24010f00030201020c2402060602040c0032a304090401000001020000090401010101020000072401200404000c2402010201400f0a3b4725090501090000f7090607250183020c0009040200000103000009040201"], 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) close_range(r1, r1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) setsockopt$sock_int(r3, 0x1, 0xa, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000240)='n', 0x1}], 0x1}, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) io_submit(r2, 0x1, &(0x7f0000000100)=[&(0x7f00000002c0)={0x400000, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000200)="05", 0x1}]) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000400)={'ip6tnl0\x00', &(0x7f0000000140)={'syztnl2\x00', 0x0, 0x4, 0x1, 0x0, 0x800, 0x1, @rand_addr=' \x01\x00', @mcast1, 0x700, 0x7, 0xffffffff}}) syz_open_dev$vim2m(&(0x7f0000000040), 0x4, 0x2) r4 = socket$kcm(0x29, 0x2, 0x0) close(r4) r5 = socket$kcm(0x2b, 0x1, 0x0) close(r5) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$sock_attach_bpf(r4, 0x1, 0xd, &(0x7f0000000080), 0x2cb) close(r5) r6 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') fcntl$setstatus(r6, 0x4, 0x40800) syz_io_uring_setup(0x416f, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0x200, 0x1}, &(0x7f0000000100), &(0x7f0000000300)) 1.485169284s ago: executing program 3 (id=3037): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtfilter={0x6c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xe, 0xe}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_flow={{0x9}, {0x3c, 0x2, [@TCA_FLOW_EMATCHES={0x38, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x80, 0x7, 0x8000}, {{0xf2ff, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x1}}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0xfeef, 0x7, 0x7}, {{0x4, 0x1, 0x1}, {0x0, 0x0, 0x0, 0x1}}}}]}]}]}}]}, 0x6c}}, 0x0) (fail_nth: 1) 1.403406024s ago: executing program 0 (id=3038): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) sendmsg$inet6(r1, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1400000000000000010000000c"], 0x30}, 0x4000010) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000200)={{0x2, 0x0, @empty}, {0x0, @dev}, 0x12, {0x2, 0x0, @remote}, 'lo\x00'}) 1.148115275s ago: executing program 0 (id=3039): r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000140)='/proc/asound/card1/oss_mixer\x00', 0xc8403, 0x0) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) (async, rerun: 64) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) (async, rerun: 64) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='numa_maps\x00') preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) (async) write$proc_mixer(r0, &(0x7f0000000380)=[{'IGAIN', @val={' \'', 'Synth Capture Switch'}}, {'LINE2', @void}, {'VIDEO', @void}, {'PHONEIN', @val={' \'', 'Master'}}, {'VIDEO', @val={' \'', 'Master Playback Volume'}}, {'CD', @val={' \'', 'Capture Volume'}}, {'RADIO', @void}], 0xc7) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) (async) r3 = syz_open_dev$evdev(&(0x7f0000000640), 0x0, 0x8840) ioctl$EVIOCGABS20(r3, 0x80184529, 0x0) (async) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_open_dev$sndctrl(&(0x7f00000001c0), 0x7fff, 0x462000) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22102, 0x0) (async, rerun: 64) socket(0x2, 0x80805, 0x0) (rerun: 64) timer_create(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001180)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_IMMEDIATE_DATA={0x18, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}]}}}]}]}], {0x14}}, 0xec}}, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_IRQFD(r6, 0x4020ae76, 0x0) (async) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) r7 = userfaultfd(0x80801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)) (async) r8 = io_uring_setup(0x5197, &(0x7f0000000300)={0x0, 0x417c, 0x40, 0x8001002, 0x3a8}) (async) r9 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) (async) r10 = userfaultfd(0x80801) ioctl$UFFDIO_API(r10, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r10, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f0000000000)="0900bf65653f47f4020004005f081ae36850f6d15c3e681411f7a43c242f5bedaf6bec340dee49474362b24cb800edc500000000000000f900", 0x0, 0x48) ioctl$UFFDIO_WAKE(r10, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffb000/0x1000)=nil, 0x1000}) (async) close_range(r8, 0xffffffffffffffff, 0x0) 1.117865065s ago: executing program 3 (id=3040): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x0, 0x0, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000480)={0x0, 0x0, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0xeeee8000, 0x2000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 6) 979.4173ms ago: executing program 0 (id=3041): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e80)={0x908, 0x1b, 0x1, 0x7fff2, 0x25dfdbff, {0x1}, [@nested={0x8f2, 0xc9, 0x0, 0x1, [@generic="ec2d9d500fcfad90b1b5ebe2ee36e625a5fca8d8", @generic="504bdd7ce9b9b47794663a8b92bc0ddaaa2b3d1032c0a3e187003a4af53109616fb3f389568f8a4fd0a9", @generic="734badadeef0f9a88202805cb06eac9dd0e230c8245154023b1d53de22cbc515dd11f472291dcd352be7415445d4d6590458882d29f433f28689da65ac9be87efa51adc09c48a760d4d5", @generic="417ec092c16c41947135e20883a6f6e87c7825869b0fb6d5669a32f418e0bca9e167458069e53146a780ca2b6962f564d5b384bf937890a9e508d26a218b682dda3e6e5bc167dc3016cbfd322b47b3b9213f7d5a770000621793", @nested={0x80c, 0x85, 0x0, 0x1, [@typed={0x800, 0x14, 0x0, 0x0, @binary="e2551b88edaf7d98e3fe8f7ae1b8ff1a77ca4094e33ec3495f4402385d26ad29891845c0466898347ece52fa3c2b1e326e156a8dbf032b0d10423fedeb1f7d13c82e02e1cf68a6b4b060bf95d30093634d2a0ced57dfc596ea0e0a9f53515d3fc5af1fcfe69ce671ac13c5556b389c44cb3d8b92533500a1dc06ff4720524fa99620a9597bf614552648cbb7e0639414495e9dda1b5ed90bf3486aca77ac470c59ac313cd8a2e661d843ed2fef25b4a5a2f41158f6a0251ed60105e5c06810d343fd1a0d2b768b2eb85fd1ed56c45b330565a683f7d5a72878d86356f5a6001f839f0bc4c2169ff642221001e1da7bd85ed01a9a66a1057f1d66af85573f5d10e01212c4d633e035c1914d23df071f6fdd86df582f3ff686167b2c03c05ac7df4e4a116c04af59bfc7a3e33674b280cc3faa71f8b98cd11f496afbef4b4cfbcbc21fcb566fad3a1132b53fe8c6d20ca863140c7fca881d1d48169b4b278f0d6e0d79681d1f1782a71eeb485595855bbfaf78a2a9257626364156149ca1df844af2ba2e853ad53880fd8d74ace5f0347f72bb71fe5cb6146833481390cdbd758887727b6a1047451b60391c40247b05d03a83a1652e5e2cc1c685dfd5aeea7761663e3cb9b8cb7590cf77c883273e29a294b03faf7e615893b15e56b96aceeae1ce151c7bea91079c4158940d375deb818969d0516c42e1cb5fa41874be513ebf5db2edb823fe1ca559359a2fa64f4168ef4353dd2df8992044daa323d664c6b2e86d2fc56102a917127fa907422eb589462b7a283801e184077b5d0476f10cf881a90c898b68d0c12a5163f062c920cffcb77ff98b180b10f80753048a24a9eefe7f9cf92e4821001bd8917d0427aa85384e0d4c5be360e2eb2023a67b43afe5d7f438e912bdaba504945051c7c011f2605c47ee8866e248c33d7a60cb6304fdad749c4167026ac4c8f3dee6916021c2b3945fd34ad5de30296bd9709281bbcb7f5952880115cfd8d48cda4a0d4a2f439ff1d190efb86c5297cfbfe9d576e8bfc33e09bba593b67fdb7d16361dffe333406cef37d9c39dfbe5ab230bba7f6a452ebaa5a8f452a4ba0e4cd4089a72f7e0b36e0be458481cf3a65f1a5a98b62285660a517f53b926518016c8fae73297cc188ef1279a082b22ef76d59ead434d392851f03d3ed8f824a7177c3edff2ca6bc99c43732b90e7ee28d9d6ba2fc0da00e20f7c552d6b4ecda2452a330ba9948675ddd7cb3824cf387c48db52d7cb06f9d049ba12fbb4a22886cf579758fc0fee8f49ecf276e3ddf40fff849b9ec38cd4122bb2b79cc37714fd02254133d80b6711b9f367ca851fb3db643e05769fce2f3c1cb17eeacd7cfc1b71c06ef5ee406b43210278fe284b112ee9287c29919521fece760b6527386adf0c7ba4d90af55a7a343c6672bafbe9c8ee0ee3f492886aa5bcd7ff7f1fdffd3401ec4787c04fa4c8cf20d40720146b3fee2182f212d45d1ff028c3afced9ec6a6fe24199c159b635a5b9cfe1ac4cd8b0d6d032c8d21466e1340adbb9a2a56c7a84840dfb99c4d7a2f8a25c8020a357c9bf8c3b8f1db1281eb655667147354123c2087d097128ca4435eca94dc68c92a746690197d15c7cf4a5a238cde23ce1b725501e808c544c254a71f214dd39aaa3e3d3ce8965f491989cd2785b47a5074672efe664be92888c92253dd0a7d36f1c5006af65ddc709e7adb322afec853b8c6de1422c2124077e4a680c624bb0681c3f173cb1a4d318607c0b1435a9cd4fa57e3bf03d3b84f57d46bcff71486ffba75a6d4607de07a3ce1776a468dc7ec4dca6d59f4416553cfe048f22d55d5008680e727fc9438bcefe1a5822e9d7f9e8f81a392fcd2255734ef080177c1b2071bb2a58b8b881801cf43f605f63972b2856c60ded31ac0554d3d06ce49f569d8a189e903f8c65def29148a197af24dbb2a49dc827ae86fe6596299aadaf8e3bdca13d1da0342cf68ed495b53f6374180ca96f4050342f9d740be5cc3c40f9042c588dc4fd61cec57d9d1688b0cb0c02e0c21f21b3c054d0be2ddc0ffd084335cde11d2d1fa63fbe759808e752a91e7576b547831259fa633ce6be79ec477e24028368bfb80e331af451385c64c10573363773d76f38c19363614c6f81f8139edd4e2a1ad9b3c90f972030fd59c2e95d6cfecc9ba11e1246185dc27e402988905a281bac4b3e13469158b08379f052596c7a297c676e0aaecff00192564a34e828d2219762c162435441c5fce63eb485ff7e36ce32c2addcfb5131a5d2195e81f41764aa0180b916aa11abd0eb047e54d28c05e618ffdc09a7c2b21ca8b8c3901ba0c620bb3a82e31e56bfed4a7c897aa54c847fb7628de32c348e6596ebaf4dc8e379a1092348957fa916c185dee5667fb1dd9bbf9725a56875407208d16e64cba04f5bb0d1727cef75824281453e855890e99a3790cf0902aa84b2351935b11cbc1e481be3b67758e189f647ce8460dc28d4864045637f403fc32b7042faaf17190b4161d52d522bff33c5cac89d1be4503e107f9746529b29456ecd01965979bd047c017ee51c2dc611e52e2cafc31cc70a5ed96c621ac4dcc1bce5c5a0ba75ab91652e0b41220e4cfb16c80018838ea60d11d49e4657c09afec56e2eadb02c5aeb7cd610ca51ab12c7d50eaf98235e9aec03ee18d6f515afa0cea5485486bce0fe85af5b8aaa08c11ad4057fb1ac8835d9f6eedd90f6320fd7d669659cfa35d0a43c3738e2aad86b95eec82e17d8a48ef066d3b5289d694f15fa60dc7c707e1d411c2825751837b016d8222cad20086968770937d0d713180f30f20f801b2696ad8ace63875ede9860c315aa31425a8cfc6f7c4a812b833eaec53740d2b1b96aecd2e7"}, @typed={0x8, 0x1b, 0x0, 0x0, @fd}]}]}]}, 0x908}, 0x1, 0x0, 0x0, 0x400c801}, 0x8094) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000e00)=ANY=[@ANYBLOB="e400000043000701fefffffffcdbdf25017c000004004580ca00018000005a00252b27272900", @ANYRES64], 0xe4}, 0x1, 0x0, 0x0, 0x50}, 0x4800) 978.994421ms ago: executing program 4 (id=3042): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 705.349318ms ago: executing program 0 (id=3043): r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0xff, 0x2, {0xffffffffffffffff}, {0xee00}, 0xfffffffffffffff0, 0x4}) ioctl$SG_BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000080)={'\x00', 0x9ca, 0x7a, 0x1, 0x6, 0x8, r1}) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000100)) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000140)={0x1b, 0x18000000000, 0x1, 0x2, 0x8b10, 0xffff, 0x4, 0x2800000000000000}, &(0x7f0000000180)={0x401, 0x5, 0x711a7f86, 0x7, 0x4, 0x3c71, 0x3, 0xc07}, &(0x7f00000001c0)={0x7, 0x3, 0x4, 0x8, 0x12c0c0000000000, 0xea, 0x5, 0x3}, &(0x7f0000000240)={r2, r3+60000000}, &(0x7f00000002c0)={&(0x7f0000000280)={[0x1]}, 0x8}) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0xa6f, 0x0, 0x1}]}) r4 = msgget(0x2, 0x5) rt_tgsigqueueinfo(r1, 0xffffffffffffffff, 0x4, &(0x7f0000000340)={0xb, 0xff, 0x2}) r5 = signalfd(r0, &(0x7f00000003c0)={[0x1]}, 0x8) r6 = syz_usbip_server_init(0x4) r7 = signalfd(r6, &(0x7f0000000400)={[0x644]}, 0x8) ioctl$EXT4_IOC_SETFSUUID(r5, 0x4008662c, &(0x7f0000000440)={0x10, 0x0, "20c5d727f7c0c2c724c57bc7c8205e5b"}) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r7, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0xef, "68d6fca3f456bfb54f8ab4b00411a1d651a6a180f0354af2478a5952d010367e27239264fe53da2088cabc8f03aa3ebfe0277275b53d5a20e45567b7a4c3a67c2b2685596285269b158f1358446ad1cbd9d8ba5ab26167def274d929453a8f2404b32cbbbc8e900fe7c31bc183a87a84fbbe21c4f5daeac818119c4f1e375c483e2bc297c497db466dde969c7863393dc3ae5d46dac5c04dda2eaaf2fe3a0e7dcd631bce053af344f17f7cbd4fc89c0cd348d9305ef4444dbb9c15b39f5206e4ad1291c510f78f70b3c044080270940e71de9702ac0dff7e50b89e0bed7395b6e0c003a39cd1626131a2d9fda64e3b"}, &(0x7f0000000580)=0xf7) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r7, 0x84, 0x13, &(0x7f00000005c0)={r8}, &(0x7f0000000600)=0x8) msgctl$IPC_RMID(r4, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000640)=0x2) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r7, 0x84, 0x18, &(0x7f0000000680)={r9, 0x6}, &(0x7f00000006c0)=0x8) ioctl$VIDIOC_G_FBUF(r0, 0x8030560a, &(0x7f00000007c0)={0x2, 0x2d, &(0x7f0000000700)="ef687c993cea621e235a12d951110f0ad8ef3c2dcd82fb1da794e75c1549935935fac22b35d505ac40da8efae3515df6bfead503f751def329132407a39bfdbe37d1bdc9bc86ccef6125cfc65a358bfa73d9dd90cca51e99b838ab06d5d4596d147b6fad2c12b724baaf06693ec0219994885d44a8ed0b87ab4c63fc3746c1b4f5d3438ae04831f7de1047294bf48811d2d0", {0x3, 0x8, 0x49323159, 0x9, 0x5, 0x25, 0x5, 0xfffff6d1}}) sendmsg$NFT_MSG_GETCHAIN(r7, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x2c, 0x4, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) ioctl$I2C_FUNCS(r5, 0x705, &(0x7f0000000900)=0x1) ioctl$KVM_GET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000980)=@attr_set_pmu={0x0, 0x1, 0x1, &(0x7f0000000940)=0x6}) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f00000009c0)=@assoc_value, &(0x7f0000000a00)=0x8) sendmmsg(r5, &(0x7f0000001540)=[{{&(0x7f0000000a40)=@pppol2tpv3in6={0x18, 0x1, {0x0, r7, 0x0, 0x1, 0x4, 0x1, {0xa, 0x4e21, 0x5, @dev={0xfe, 0x80, '\x00', 0x3a}, 0x76c}}}, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000ac0)="84d01e8693d1dbcee23a182e1107383e8f0cbc9e5d2158f6e7864ce14d7a0ed61e00b7c318735a59608fa0ee3864d033ea723df57ca42102855c8550297f1d4b66c854b345f429245aaa92c1be2697491b2859f23b55bea9994d0bef9834f0404a8a50bbe772818a2847", 0x6a}, {&(0x7f0000000b40)="0cb66d613b0a6515ede17b3f0ffcbd0e4318be91f91ca1803b7d400daeb48c143db83302493112501900", 0x2a}], 0x2, &(0x7f0000000bc0)=[{0xc0, 0x10e, 0x6, "7e9d939c8059ef7be25fb7329a44944a4744f5bb0e921e0a4cbe62e22cbc81fc023595944d983fc28b2af0d9922e4a13ea49e3aaa5a2da81049404d864a255d24a3d37c07130cc643f17086f0fa65ddc5e4acbd7d8ba344071fa16878da05a70d9d1cf2ba6f4c8ec4e5daee3438e366cd88c1a0cd5f7cd8d052ef0318b64b756e4f05a602a721a1f2d70d73963caee47b4c6740a109c64768757a421435fba64439b1ae4e395d16c29d2"}, {0x80, 0x88, 0x2ded, "c941f938a11c864a47bb6c1db79a5383ebbd1a5ed297c415c1627a73b2b784c6cab7126af3ea02bf9dae8954cec8c8e4d01bb5cd5d0a5f8d26623a5e6944c655347ff60636195aa760743fd3373aeb2e4e61bb67c1e06dbc4c5192bb1d3d2ddede97dc963f6c8fa26e6d018cd696ac"}, {0xa0, 0x116, 0x0, "164aa01426e02df527fb979b9c42ec75ea72e2b8ec57e87225bf0600362a58462ed6812c4b39878a257fcd2fb5f54e3f907b0ddc8b2ce5b18300f0a579da8b3592a81f45978fd6fe927d26ed601ab523a96c99446d837fb8344d9febb6b5255d5e0cb6138108982081f694dede91dc030a7c08b24c34564a9862da9474836c0bb57e053bf1f9f199a7898b4b1e25f0"}, {0x88, 0x84, 0x80000000, "7c31cd074d6b31a929a1ec74de7745f11e76510368ab1687b7b03cf407e7970b0445f934da7d4ee5134b98706812513484e7d0f5fb1d90db0f715dd9e8418bd80440ae7f2f6c6b2a2c79d9b1764e3461f8e59473c3e62af39a4019a241ac2c4d0be27d6abe9b19af6ba3dcf9491b562407588dadcd"}], 0x268}}, {{&(0x7f0000000e40)=@un=@file={0x1, './file0\x00'}, 0x80, &(0x7f00000011c0)=[{&(0x7f0000000ec0)="2372d3c41acdd8ea2fb66a859dc9c6d89f1e51638c036b22ceb9c91474aab05cd2ae86599bed0e126e05fcf3db0e6fd9ced26aaa6f8768682ddc90113644c55ac583ee9dd8715ce45a8a1fea28ee76978d2b70f62a8a77a7c6ded2f229a968b5bd3ebd7aad63bce3ebf2d2b36643ae13007d6b5399a0dc3428def664d83831c6765c6b890bee078afc4e19596d8b2d32c08551d69a7825d7a8658da6e4eb5c1404108c0f0f555d3866a1fb4fa060de176f4fbb0ee65dad2818908d1f5c374ecc47bcffa5516a967a04c7d51fbfaccc37c9c0ef16e99438830d134a235b5f07267a6af0be515284952baeecebba6cd1388663fe7f8658aa", 0xf7}, {&(0x7f0000000fc0)="e34a6992ec16126aa938530c754858a0e85ce7c0615d320fa02125d6349aca9d73b6d73085e316ccfd30fb689aaa8f5e5c3882753787f37fc0693643892ab93550dbec1c9e85236ee6908b9d7d8f63c4782d5323b9afcda83cdaf5c1e482a3618a55148034a46e0e57bc2fb2149c27930d88e877e8f931ca1a48a6", 0x7b}, {&(0x7f0000001040)="e4db984b8ef17941bb1fc303e26f9f6fb14ecc577f8e5cdb330fa0d80d8ba73cd79c39cf0e93e98c3e7698d3de3299a6cd3d446b38c1ee66910cc3d94365a0", 0x3f}, {&(0x7f0000001080)="3670d20d6b9496758aac08d7f655b2a4dbab454db6dda9cc9afe7a4f022d3c794406ecc7fa376973ea91025d72afc9ff31c0745fc8b33c0222a1fa465a6b2c37", 0x40}, {&(0x7f00000010c0)="ee464f876c764918f6c1bda888ffcb1b5f8e09a7ee7a1a952cf5b7d330a4280b67efcec95c3b19fbd74c82ce2c95584a4bf46b0d0a673d4a9da946d7dc693eb5ec34d2a1a2ea63462f8da580de3ca86899ea42d92642fd009edcc2d05f38f9bb791bdd21a06c57a7cdab14390ee6281fda58d4c3c072e3bf9bd5e256f1a8823399d4bba7b723b636b5a58344e0ce735afdca471425ca338b4bd7cc4b425f039c44e9225e21ad794a6a7001c6f68662bd852a76b7ae6dc35d56da5f84a0306d14a177aca44e86703c00498be96df49cb481206b1201c8234de50b1e33a908b4e377142c3a15", 0xe5}], 0x5, &(0x7f0000001240)=[{0x110, 0x110, 0x0, "babdbb49840a27341b1556a616acd074ccc3c91131f6587ec00d28865391c406b69e427b5ca6c61fda4d35a85c03692bd6c6a693cb842ca7fa7fa95064d5d79fb98eb97324ae335a5a96184ff1b852716fd5fec8b990ce33d4f4c3c823aa8725ba359f2271bcf185e2216329a63b54b0fdad825e960a76e73563b8bc20b91dd74decc2c2922ddb6875b1acc4be59a4be6ea1c0f06e4c59466440b2292af76a20c73a68215af9bfdf5eb895bcbb90f983eeb6fab656d008db3b91c46fb32656f4b6ca9bfba23a2fed1463504b9ae2f22a99850f6b9d7671f301f3922818e4fd9aa876bf972d04523f2d6681b9838e2dc3dc8bd504ab93ec54bd"}, {0xf0, 0x88, 0x8, "ed643194beb09bb525e2457ba73831558e28b6a3ce025859c2ded89b3705d986a35597964f190143995961fd589c2b28ef83339d1bd27e29e0eeaab947d5a360a50e1b8759e474c3af3c2ccf0f082c784a758220e2245ac7d9c4508005ad71f79fc300ea39600ca8f5ad12f1d6ac27ace93b677dae2d6b202e4405c95e57ec279df4c3ff2dbb6607e1c787a9eba0aa27dcbe697a5e36a146040f094d0fcb7809fe3a0cf59f1e41aaf1df172b3dc16a24cb688987645f3df53e24557a3b5d14f9f8b7f4adcbab9ac9bd2b2c4233155736f2a370e543262249796b75"}, {0x68, 0x11, 0x9, "49f39c145cb1b9b942609a75cde2a9d5840e35f514815975d70255088ff76ab9a000cc039ecc2b62b069ea5438cea19685a62217e36770f25fe79e19ec7f910353a289c7d77f4f47db5460f7df55e1213887f6e0"}, {0x80, 0x103, 0x9, "3fbc4f7c86ddc465bee681eaf9079291f486d53a477542572689ccc376fc559cb73bf77b00de8595c54dc9778329951b7eab478992fc877119a874efa3088f018757fc63137d32ae31a024fe80f322206afaac64b76cb69f2762795a1d4c8af1c4d5f44ff138bc627a"}], 0x2e8}}], 0x2, 0x40010) r10 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000015c0), 0x0) signalfd(r10, &(0x7f0000001600)={[0x1000]}, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x3, r1, 0x0, &(0x7f0000001640)) msgrcv(r4, &(0x7f0000001680)={0x0, ""/28}, 0x24, 0x2, 0x0) pselect6(0x40, &(0x7f00000016c0)={0x5, 0xae2, 0x3, 0x100, 0x5, 0xf, 0x401, 0xc}, &(0x7f0000001700)={0x83f, 0x974b, 0x8, 0x3, 0x0, 0x95, 0x1cef, 0x6}, &(0x7f0000001740)={0x7, 0xd3, 0x4, 0x10000, 0xfcd7, 0x8, 0x86d, 0x4}, &(0x7f0000001780)={0x77359400}, &(0x7f0000001800)={&(0x7f00000017c0)={[0x8]}, 0x8}) 588.757328ms ago: executing program 4 (id=3044): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xa4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000002140)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000002040)=[{&(0x7f0000001b00)="c779a881400f168b3cd3b9dcb8505d626656e6b4f5441fb27838fa6f26bfe21f20605b23fffe6978fe6148e25caa0c0f9b6e4434877b8978a5caa4c641dfe5b407dd88d709f6c3aaf2eb6d966f38806c79f63870496f06f6", 0x58}, {&(0x7f0000000540)="6f433f8987fc9e72c982b56a37a1c7b7ab31e2f6b098f57a62f9d8a98a9d4f71997d1cd449c76702", 0x28}, {&(0x7f00000005c0)="8e26189d110469a886116da338167241f58b9e3a3d25fef3424da95dfc37a21add3be660fabda17c87a232ecdbee49495e0b9249d65983123d5a84", 0x3b}, {&(0x7f0000001d00)="45a4cdaed78e8aae62776ab5e19dab8363b642daf5ce06da88ce31cbf434c7758737d1610707c1be62e5680748b3b645a25af50508b344b621146721fc4a9657fd77ad93f48d94a70de115016171efb302adb61ee81ba5e41965e62716beb2de6762170181690f54affcfe", 0x6b}, {&(0x7f0000001dc0)="4423c554c1d89dfdb98e09e6c7cac32762158fa3479da58104548fdcc7ef57389b9f63250592f4cc92cc344e1b3cd46446f8d4481699666b5f9e6e2b8a82c435ed400d40d67f1e3cf3931905f34b74e7cadf145de53d91ecb305560836557a01a67cc87c52ae248f04c2ec28cdcb21d816fccdef1d80efc00616ef86a1ec5a51789f2473ef6bbda9461f1cca", 0x8c}, {&(0x7f0000001e80)="ec1d60ccbe85510cec58bd3786a575b46de8fd547ade80f426f7e4f4278fc924d53d9073acf8247cf722ba4e9c7bfb1ba70b921b3bd3b1e061033204d9629d417ea1d834bc2539294611e3b6e5abf5c3eb10dc92cbaae7e80dd65084164afde069218042d5d2d8e256856c0bd1e7568574b80c4d5e51bf8604a10fe5f3f69a0a794905f74f75f189780c86ace348c270b3a346061d7f669d723871fb66", 0x9d}], 0x6}}], 0x3, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="04", 0x1, 0x10008095, 0x0, 0x0) 207.316534ms ago: executing program 4 (id=3045): r0 = socket(0x10, 0x3, 0x0) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000200)={{0x2, 0x0, @empty=0xfffffdfd}, {0x0, @dev}, 0x12, {0x2, 0x0, @remote}, 'lo\x00'}) 47.409043ms ago: executing program 4 (id=3046): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xa4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000800)="cc5a4dbac0affd0a979c63ea8352d608a51fc8625318716ddf62b7752be4540c4ac7d344c53a3ad28313abc2437b60b03c0e587cafcf9a435bf90c618351f70a828238fdf90bc5d36c7d614b82552649954e0185662defd28f78449f073bad544f586136c5076a6f0f1b6fc9adf80557eb44db1b41824e9ef104c95e999766bbf27d74ad5d8fa63210cde65d384dd3e87c1fedaec3144d1ee66a0eb0750363e346cb930dae6109df6b9955bf8af119b5c9a86622af4ff8b5949fb90f8edbde416d046d61512fe4c453bb601a780e1bbc00dbedc5e50d3cd9bc920810eaefd5f9a171e9d32ab46b42e3e78c60087318bab42e94653cbdd600fba37c5a31d095500e91d02256f101e82447e34733220cdaaabc947f5b815080b5214c94a06fe96450ea42f48006c032b24d9e8d722841b7c7244b1d2cc012fcda1f7472fdbabb673ef862e32b359fad715b3f5cef6ef951abab80a4a0f5f8574395c5820fa25d07a119e23b39a87cb3b763fbfb0493121eec3e05eacbe7835e79e74881d1179013622a2a6421d51c974e6abd48a9882c8fcadbcee369346a9ad948fd5dd8f87496a30a9d888cdbcee8f3592dd69165358c4cd474639fc13300317b7fed115fb9818b20d177a39157101dbd8e23bc9ed32efed96c410a103d35336fb4ee4000bfb3d32b0181ff3d726a7dc6432a336a42b50b2c6877cb63b410d746b35fc721e5992ba47c3a2bc2d3679abe0794d226b7b0c333c3000fee7adaafb6efd57382eb2a86d71acaae52a154", 0x228}, {&(0x7f0000000300)="17e37d3e106d9beae191613d45501cb6a8d8eaeb96ee68b2d800ad34b8c528b97ead9f051e427e309b714d3d12d8d4010c04a27e6c586b3956f0dfc7086e9550bd651b9e019d7b671b231c7a8cbfd52bea572b327362fd4db8e4a162096a0464fd2529fc31f79947d137520a8823ae6f0c068c299db997db4d44cfd7657ea53a691a386f018286b4dbe415596964ab56a9c0d7280e592ad174e737a4e5e4cd560030a7380c37f6629e3da2d24a2b6b5ea407e3f075fbf8174a58b3ffeb4d2a0fc8f94fe18a75bc699e8cea7bf13ba6388dc9a8", 0xd3}], 0x2}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e44efeabe00", 0x7}], 0x1}}, {{0x0, 0x0, &(0x7f0000002040)=[{&(0x7f0000001b00)="c779a881400f168b3cd3b9dcb8505d626656e6b4f5441fb27838fa6f26bfe21f20605b23fffe6978fe6148e25caa0c0f9b6e4434877b8978a5caa4c641dfe5b407dd88d709f6c3aaf2eb6d966f38806c79f63870496f06f64302d7f1292499f44695", 0x62}, {&(0x7f0000000540)="6f433f8987fc9e72c982b56a37a1c7b7ab31e2f6b098f57a62f9d8a98a9d4f71997d1cd449c76702", 0x28}, {&(0x7f00000005c0)="8e26189d110469a886116da338167241f58b9e3a3d25fef3424da95dfc37a21add3be660fabda17c87a232ecdbee49495e0b9249d65983123d5a84", 0x3b}, {&(0x7f0000001d00)="45a4cdaed78e8aae62776ab5e19dab8363b642daf5ce06da88ce31cbf434c7758737d1610707c1be62e5680748b3b645a25af50508b344b621146721fc4a9657fd77ad93f48d94a70de115016171efb302adb61ee81ba5e41965e62716beb2de6762170181690f54affcfe", 0x6b}, {&(0x7f0000001dc0)="4423c554c1d89dfdb98e09e6c7cac32762158fa3479da58104548fdcc7ef57389b9f63250592f4cc92cc344e1b3cd46446f8d4481699666b5f9e6e2b8a82c435ed400d40d67f1e3cf3931905f34b74e7cadf145de53d91ecb305560836557a01a67cc87c52ae248f04c2ec28", 0x6c}, {&(0x7f0000001e80)="ec1d60ccbe85510cec58bd3786a575b46de8fd547ade80f426f7e4f4278fc924d53d9073acf8247cf722ba4e9c7bfb1ba70b921b3bd3b1e061033204d9629d417ea1d834bc2539294611e3b6e5abf5c3eb10dc92cbaae7e80d", 0x59}], 0x6}}], 0x3, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="04", 0x1, 0x10008095, 0x0, 0x0) 0s ago: executing program 3 (id=3047): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0xc001) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000dc0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0}, 0x18) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUCODE(r3, 0xc018480d, &(0x7f0000000000)={0x3, 0x100, 0x2, 0xfffffffd, 0x8, 0x6}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r5}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f00000000c0)=[r5], &(0x7f0000000280), &(0x7f0000000300)=[r6], &(0x7f0000000340)}) r7 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x34, 0x70, 0x9d, 0x40, 0x55f, 0xc230, 0xb6ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf2, 0xa7, 0xcc}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000240)={0x20, 0xe, 0x1, "c5"}, 0x0, 0x0, 0x0, 0x0}) ioctl$HIDIOCGDEVINFO(r3, 0x801c4803, &(0x7f00000006c0)=""/217) kernel console output (not intermixed with test programs): : too many configurations: 9, using maximum allowed: 8 [ 709.523855][T14623] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 709.552021][T14623] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 709.582225][T13308] usb 4-1: USB disconnect, device number 35 [ 709.598346][T14623] usb 1-1: config 0 interface 0 has no altsetting 0 [ 709.624201][T14623] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 709.644002][T14623] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 709.667991][T14623] usb 1-1: config 0 interface 0 has no altsetting 0 [ 709.676226][T14623] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 709.707964][T14623] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 709.723498][T15010] cp2112 0003:10C4:EA90.0021: Error starting transaction: -38 [ 709.732668][ T6444] cp2112 0003:10C4:EA90.0021: error reading lock byte: -71 [ 709.733434][T14623] usb 1-1: config 0 interface 0 has no altsetting 0 [ 709.751548][T15038] input: syz0 as /devices/virtual/input/input37 [ 709.774905][ T6444] usb 2-1: USB disconnect, device number 2 [ 709.799734][T14623] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 709.826300][T14623] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 709.846483][T13309] usb 3-1: USB disconnect, device number 3 [ 709.889725][T14623] usb 1-1: config 0 interface 0 has no altsetting 0 [ 709.919878][T14623] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 709.958123][T14623] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 709.989245][T14623] usb 1-1: config 0 interface 0 has no altsetting 0 [ 710.019472][T15025] batadv_slave_1: left promiscuous mode [ 710.025823][T14623] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 710.048177][T14623] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 710.078126][T14623] usb 1-1: config 0 interface 0 has no altsetting 0 [ 710.088519][T14623] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 710.107972][T14623] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 710.127940][T14623] usb 1-1: config 0 interface 0 has no altsetting 0 [ 710.136224][T14623] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 710.157934][T14623] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 710.177894][T14623] usb 1-1: config 0 interface 0 has no altsetting 0 [ 710.187932][T14623] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 710.197160][T14623] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 710.207141][T14623] usb 1-1: Product: syz [ 710.211541][T14623] usb 1-1: Manufacturer: syz [ 710.216160][T14623] usb 1-1: SerialNumber: syz [ 710.224276][T14623] usb 1-1: config 0 descriptor?? [ 710.239283][T14623] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0 [ 710.466667][T15022] netlink: zone id is out of range [ 710.478783][T15022] netlink: set zone limit has 8 unknown bytes [ 710.516859][T14623] usb 1-1: USB disconnect, device number 122 [ 710.571345][T14623] yurex 1-1:0.0: USB YUREX #0 now disconnected [ 710.588338][ T6444] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 711.243442][T15049] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 711.286289][ T6444] usb 5-1: device descriptor read/64, error -71 [ 711.298677][T15049] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 711.523855][ T30] audit: type=1326 audit(1764706451.654:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15062 comm="syz.0.2768" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4fd2f8f749 code=0x0 [ 711.558002][ T6444] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 711.714520][T15070] syzkaller1: entered promiscuous mode [ 711.728044][T15070] syzkaller1: entered allmulticast mode [ 711.738644][ T6444] usb 5-1: device descriptor read/64, error -71 [ 711.747082][T11846] netdevsim netdevsim1 : unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.821125][T11846] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.834986][T11846] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.845090][T11846] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.860064][ T6444] usb usb5-port1: attempt power cycle [ 712.003003][T15077] batadv_slave_1: entered allmulticast mode [ 712.012192][T15077] netlink: 774 bytes leftover after parsing attributes in process `syz.3.2772'. [ 712.033282][T15076] batadv_slave_1: left allmulticast mode [ 712.158660][T15084] netlink: 'syz.1.2773': attribute type 39 has an invalid length. [ 712.197932][ T6444] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 712.226021][ T6444] usb 5-1: device descriptor read/8, error -71 [ 712.328040][T15088] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2774'. [ 712.367381][T15088] IPv6: sit2: Disabled Multicast RS [ 712.487948][ T6444] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 712.518631][ T6444] usb 5-1: device descriptor read/8, error -71 [ 712.643309][ T6444] usb usb5-port1: unable to enumerate USB device [ 713.058054][ T6444] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 713.254584][ T6444] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 713.276253][ T6444] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 713.298993][ T6444] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 713.322896][ T6444] usb 3-1: config 0 interface 0 has no altsetting 0 [ 713.338827][ T6444] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 713.357557][ T6444] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 713.380808][ T6444] usb 3-1: config 0 interface 0 has no altsetting 0 [ 713.395795][ T6444] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 713.415098][ T6444] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 713.446873][ T6444] usb 3-1: config 0 interface 0 has no altsetting 0 [ 713.465141][ T6444] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 713.483755][ T6444] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 713.507070][ T6444] usb 3-1: config 0 interface 0 has no altsetting 0 [ 713.522982][ T6444] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 713.545259][ T6444] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 713.568459][ T6444] usb 3-1: config 0 interface 0 has no altsetting 0 [ 713.584431][ T6444] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 713.638235][ T6444] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 713.664575][ T6444] usb 3-1: config 0 interface 0 has no altsetting 0 [ 713.685194][ T6444] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 713.705126][ T6444] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 713.735498][ T6444] usb 3-1: config 0 interface 0 has no altsetting 0 [ 713.777411][ T6444] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 713.816945][ T6444] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 713.844934][ T6444] usb 3-1: config 0 interface 0 has no altsetting 0 [ 713.884416][ T6444] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 713.907919][ T6444] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 713.930292][ T6444] usb 3-1: Product: syz [ 713.951343][ T6444] usb 3-1: Manufacturer: syz [ 713.958897][ T6444] usb 3-1: SerialNumber: syz [ 713.991219][ T6444] usb 3-1: config 0 descriptor?? [ 714.038076][ T6444] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 714.098639][ T30] audit: type=1326 audit(1764706454.234:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0eb938f749 code=0x7ffc0000 [ 714.208013][ T30] audit: type=1326 audit(1764706454.234:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=139 compat=0 ip=0x7f0eb938f749 code=0x7ffc0000 [ 714.287621][T15101] netlink: zone id is out of range [ 714.299889][ T30] audit: type=1326 audit(1764706454.234:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0eb938f749 code=0x7ffc0000 [ 714.303618][T15101] netlink: set zone limit has 8 unknown bytes [ 714.324043][ T30] audit: type=1326 audit(1764706454.234:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0eb938f749 code=0x7ffc0000 [ 714.334023][T15112] FAULT_INJECTION: forcing a failure. [ 714.334023][T15112] name failslab, interval 1, probability 0, space 0, times 0 [ 714.368167][ T30] audit: type=1326 audit(1764706454.234:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0eb938f749 code=0x7ffc0000 [ 714.399908][T15112] CPU: 0 UID: 0 PID: 15112 Comm: syz.1.2781 Not tainted syzkaller #0 PREEMPT(full) [ 714.399936][T15112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 714.399948][T15112] Call Trace: [ 714.399957][T15112] [ 714.399966][T15112] dump_stack_lvl+0x189/0x250 [ 714.399993][T15112] ? __pfx____ratelimit+0x10/0x10 [ 714.400022][T15112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 714.400043][T15112] ? __pfx__printk+0x10/0x10 [ 714.400073][T15112] ? __pfx___might_resched+0x10/0x10 [ 714.400091][T15112] ? fs_reclaim_acquire+0x7d/0x100 [ 714.400115][T15112] should_fail_ex+0x414/0x560 [ 714.400145][T15112] should_failslab+0xa8/0x100 [ 714.400167][T15112] __kmalloc_noprof+0xcb/0x7e0 [ 714.400193][T15112] ? tomoyo_encode+0x28b/0x550 [ 714.400224][T15112] tomoyo_encode+0x28b/0x550 [ 714.400254][T15112] tomoyo_realpath_from_path+0x58d/0x5d0 [ 714.400293][T15112] tomoyo_check_open_permission+0x1c1/0x3b0 [ 714.400315][T15112] ? tomoyo_check_open_permission+0x16a/0x3b0 [ 714.400334][T15112] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 714.400405][T15112] security_file_open+0xb1/0x270 [ 714.400424][T15112] do_dentry_open+0x34e/0x1420 [ 714.400463][T15112] vfs_open+0x3b/0x340 [ 714.400482][T15112] ? path_openat+0x33f3/0x3dd0 [ 714.400511][T15112] path_openat+0x340e/0x3dd0 [ 714.400576][T15112] ? __pfx_path_openat+0x10/0x10 [ 714.400624][T15112] do_filp_open+0x1fa/0x410 [ 714.400654][T15112] ? __pfx_do_filp_open+0x10/0x10 [ 714.400706][T15112] ? _raw_spin_unlock+0x28/0x50 [ 714.400732][T15112] ? alloc_fd+0x64c/0x6c0 [ 714.400771][T15112] do_sys_openat2+0x121/0x200 [ 714.400799][T15112] ? __pfx_do_sys_openat2+0x10/0x10 [ 714.400823][T15112] ? ksys_write+0x22a/0x250 [ 714.400853][T15112] ? __pfx_ksys_write+0x10/0x10 [ 714.400884][T15112] __x64_sys_open+0x11e/0x150 [ 714.400931][T15112] do_syscall_64+0xfa/0xf80 [ 714.400961][T15112] ? lockdep_hardirqs_on+0x98/0x140 [ 714.400989][T15112] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 714.401008][T15112] ? clear_bhb_loop+0x60/0xb0 [ 714.401032][T15112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 714.401050][T15112] RIP: 0033:0x7f609a58f749 [ 714.401069][T15112] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 714.401087][T15112] RSP: 002b:00007f609b42a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 714.401109][T15112] RAX: ffffffffffffffda RBX: 00007f609a7e5fa0 RCX: 00007f609a58f749 [ 714.401123][T15112] RDX: 0000000000000100 RSI: 0000000000000800 RDI: 0000200000000000 [ 714.401136][T15112] RBP: 00007f609b42a090 R08: 0000000000000000 R09: 0000000000000000 [ 714.401148][T15112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 714.401160][T15112] R13: 00007f609a7e6038 R14: 00007f609a7e5fa0 R15: 00007f609a90fa28 [ 714.401193][T15112] [ 714.401221][T15112] ERROR: Out of memory at tomoyo_realpath_from_path. [ 714.443576][ T6444] usb 3-1: USB disconnect, device number 4 [ 714.698839][ T30] audit: type=1326 audit(1764706454.234:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0eb9391667 code=0x7ffc0000 [ 714.721388][ T30] audit: type=1326 audit(1764706454.234:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f0eb93915dc code=0x7ffc0000 [ 714.755684][ T30] audit: type=1326 audit(1764706454.234:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f0eb9391514 code=0x7ffc0000 [ 714.785150][ T30] audit: type=1326 audit(1764706454.234:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15107 comm="syz.4.2780" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f0eb9391514 code=0x7ffc0000 [ 714.823968][ T6444] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 715.455933][T15148] vlan2: entered promiscuous mode [ 715.462467][T15148] geneve1: entered promiscuous mode [ 715.468497][T15148] vlan2: entered allmulticast mode [ 715.473892][T15148] geneve1: entered allmulticast mode [ 715.566358][T15150] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2795'. [ 716.041177][T12536] syz_tun (unregistering): left allmulticast mode [ 716.054979][T12536] syz_tun (unregistering): left promiscuous mode [ 716.073798][T12536] bridge0: port 3(syz_tun) entered disabled state [ 716.086768][ T5843] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 716.099032][T15163] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 716.108148][T15163] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 716.121570][T15163] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 716.129630][T15163] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 716.173093][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 716.180706][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 716.188671][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 716.200305][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 716.214780][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 716.241284][T15161] macvlan0: entered allmulticast mode [ 716.258938][T15161] veth1_vlan: entered allmulticast mode [ 716.306154][T15161] team0: Port device macvlan0 added [ 716.330846][T15164] pimreg: tun_chr_ioctl cmd 1074812117 [ 716.542842][T15167] A link change request failed with some changes committed already. Interface veth1_to_batadv may have been left with an inconsistent configuration, please check. [ 716.768070][ T5955] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 716.917930][ T5955] usb 1-1: Using ep0 maxpacket: 32 [ 716.934248][ T5955] usb 1-1: unable to get BOS descriptor or descriptor too short [ 716.950708][ T5955] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 716.962252][ T5955] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 716.979254][ T5955] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 716.991974][ T5955] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 717.003530][ T5955] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.011906][ T5955] usb 1-1: Product: syz [ 717.016233][ T5955] usb 1-1: Manufacturer: syz [ 717.021192][ T5955] usb 1-1: SerialNumber: syz [ 717.048080][ T5926] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 717.186466][T15165] chnl_net:caif_netlink_parms(): no params data found [ 717.231486][ T5926] usb 2-1: config 0 has an invalid interface number: 238 but max is 0 [ 717.238174][T15169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 717.248964][ T5926] usb 2-1: config 0 has no interface number 0 [ 717.264384][ T5926] usb 2-1: config 0 interface 238 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 717.278454][T15169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 717.291539][ T6112] veth0_to_bridge: left allmulticast mode [ 717.298064][ T5926] usb 2-1: config 0 interface 238 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 717.298889][ T6112] veth0_to_bridge: left promiscuous mode [ 717.317419][ T6112] bridge0: port 4(veth0_to_bridge) entered disabled state [ 717.326199][ T5926] usb 2-1: config 0 interface 238 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 717.342056][ T6112] bridge_slave_1: left allmulticast mode [ 717.349747][T15169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 717.361585][ T5926] usb 2-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=76.6a [ 717.364159][ T6112] bridge_slave_1: left promiscuous mode [ 717.373111][T15169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 717.387414][ T5926] usb 2-1: New USB device strings: Mfr=7, Product=2, SerialNumber=3 [ 717.391673][ T6112] bridge0: port 2(bridge_slave_1) entered disabled state [ 717.395891][ T5926] usb 2-1: Product: syz [ 717.407710][ T5926] usb 2-1: Manufacturer: syz [ 717.413950][T15169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 717.426237][T15169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 717.437368][ T5926] usb 2-1: SerialNumber: syz [ 717.459996][ T5926] usb 2-1: config 0 descriptor?? [ 717.466664][ T6112] bridge_slave_0: left allmulticast mode [ 717.489438][ T6112] bridge_slave_0: left promiscuous mode [ 717.494798][ T5926] ni6501 2-1:0.238: driver 'ni6501' failed to auto-configure device. [ 717.514799][ T6112] bridge0: port 1(bridge_slave_0) entered disabled state [ 717.549955][ T5955] usb 1-1: 0:2 : does not exist [ 717.647566][ T5955] usb 1-1: USB disconnect, device number 123 [ 717.671040][T15198] netlink: 'syz.3.2805': attribute type 1 has an invalid length. [ 717.714561][T13310] usb 2-1: USB disconnect, device number 3 [ 717.742733][ T5853] udevd[5853]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 718.008339][T13305] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 718.018047][ T5955] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 718.186646][T13305] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 718.197783][ T5955] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 718.216085][T13305] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 718.231259][ T5955] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 718.246719][ T5955] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 718.263664][T15163] Bluetooth: hci1: command tx timeout [ 718.280514][T13305] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 718.302275][ T6112] bridge0 (unregistering): left promiscuous mode [ 718.311565][ T5955] usb 1-1: config 0 interface 0 has no altsetting 0 [ 718.311637][ T6112] team0: Port device bridge0 removed [ 718.329722][T13305] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.337783][T13305] usb 4-1: Product: syz [ 718.368757][T13305] usb 4-1: Manufacturer: syz [ 718.374918][ T5955] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 718.393378][ T5955] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 718.404448][T13305] usb 4-1: SerialNumber: syz [ 718.433726][ T6112] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 718.466033][ T5955] usb 1-1: config 0 interface 0 has no altsetting 0 [ 718.486301][ T5955] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 718.505154][ T5955] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 718.517085][ T5955] usb 1-1: config 0 interface 0 has no altsetting 0 [ 718.545156][ T5955] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 718.566632][ T5955] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 718.579428][ T5955] usb 1-1: config 0 interface 0 has no altsetting 0 [ 718.588685][ T5955] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 718.597761][ T5955] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 718.609735][ T5955] usb 1-1: config 0 interface 0 has no altsetting 0 [ 718.617777][ T5955] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 718.627381][ T5955] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 718.648562][ T5955] usb 1-1: config 0 interface 0 has no altsetting 0 [ 718.679818][ T5955] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 718.689398][ T5955] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 718.736371][ T5955] usb 1-1: config 0 interface 0 has no altsetting 0 [ 718.762855][ T5955] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 718.783168][ T5955] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 718.785982][T15224] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 718.794442][ T5955] usb 1-1: config 0 interface 0 has no altsetting 0 [ 718.813618][ T5955] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 718.823103][ T5955] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 718.831860][ T5955] usb 1-1: Product: syz [ 718.836145][ T5955] usb 1-1: Manufacturer: syz [ 718.841031][ T5955] usb 1-1: SerialNumber: syz [ 718.880163][ T5955] usb 1-1: config 0 descriptor?? [ 718.909896][T13310] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 718.910562][ T6112] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 718.923389][ T5955] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0 [ 718.939337][ T6112] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 718.950842][ T6112] bond0 (unregistering): Released all slaves [ 718.990393][ T6112] bond1 (unregistering): Released all slaves [ 719.068074][T13310] usb 3-1: Using ep0 maxpacket: 16 [ 719.082825][T13310] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 719.118505][ T5926] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 719.121634][T13310] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 719.158061][T15195] netlink: zone id is out of range [ 719.164025][T15195] netlink: set zone limit has 8 unknown bytes [ 719.172478][T13310] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 719.172655][ T5844] usb 1-1: USB disconnect, device number 124 [ 719.182476][T13310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 719.196474][T13310] usb 3-1: Product: syz [ 719.205616][T13310] usb 3-1: Manufacturer: syz [ 719.221574][T13310] usb 3-1: SerialNumber: syz [ 719.238931][ T5844] yurex 1-1:0.0: USB YUREX #0 now disconnected [ 719.282779][ T5926] usb 2-1: config 0 has an invalid interface number: 11 but max is 0 [ 719.311745][ T5926] usb 2-1: config 0 has no interface number 0 [ 719.332858][ T5926] usb 2-1: config 0 interface 11 has no altsetting 0 [ 719.341556][ T5926] usb 2-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 719.351100][ T5926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 719.379294][ T5926] usb 2-1: config 0 descriptor?? [ 719.398927][ T5926] keyspan 2-1:0.11: Keyspan 2 port adapter converter detected [ 719.409230][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 87 [ 719.417413][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 7 [ 719.430458][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 81 [ 719.440295][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 82 [ 719.448394][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 1 [ 719.449473][ T6112] bond2 (unregistering): (slave veth3): Releasing active interface [ 719.456372][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 2 [ 719.473186][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 85 [ 719.482836][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 5 [ 719.483988][ T6112] bond2 (unregistering): Released all slaves [ 719.505339][ T5926] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 719.532594][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 83 [ 719.552929][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 84 [ 719.568726][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 3 [ 719.578917][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 4 [ 719.595128][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 86 [ 719.609603][ T5926] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 6 [ 719.627765][ T5926] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 719.637807][T13310] usb 3-1: 0:2 : does not exist [ 719.711484][T13310] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 719.754093][ T6112] tipc: Disabling bearer [ 719.773523][ T6112] tipc: Left network mode [ 719.780234][T13310] usb 3-1: USB disconnect, device number 5 [ 719.893121][ T6392] udevd[6392]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 719.981980][T15165] bridge0: port 1(bridge_slave_0) entered blocking state [ 719.989593][T15165] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.996979][T15165] bridge_slave_0: entered allmulticast mode [ 720.007631][T15165] bridge_slave_0: entered promiscuous mode [ 720.025607][T15165] bridge0: port 2(bridge_slave_1) entered blocking state [ 720.033548][T15165] bridge0: port 2(bridge_slave_1) entered disabled state [ 720.041051][T15165] bridge_slave_1: entered allmulticast mode [ 720.049611][T15165] bridge_slave_1: entered promiscuous mode [ 720.115463][T15165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 720.145072][T13305] cdc_ncm 4-1:1.0: bind() failure [ 720.179889][T13305] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 720.197177][T13305] cdc_ncm 4-1:1.1: bind() failure [ 720.223757][T15165] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 720.236092][T13305] usb 4-1: USB disconnect, device number 36 [ 720.329570][T15163] Bluetooth: hci1: command tx timeout [ 720.381705][T15165] team0: Port device team_slave_0 added [ 720.391832][T15165] team0: Port device team_slave_1 added [ 720.453958][T15165] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 720.468931][T15165] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 720.525429][T15165] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 720.573048][ T6112] dummy0: left promiscuous mode [ 720.588344][T13305] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 720.623800][ T6112] hsr_slave_0: left promiscuous mode [ 720.634550][ T6112] hsr_slave_1: left promiscuous mode [ 720.749420][T13305] usb 4-1: Using ep0 maxpacket: 16 [ 720.769555][T13305] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 720.780822][T13305] usb 4-1: config 0 has no interface number 0 [ 720.806232][T13305] usb 4-1: too many endpoints for config 0 interface 1 altsetting 86: 119, using maximum allowed: 30 [ 720.819598][T13305] usb 4-1: config 0 interface 1 altsetting 86 has 0 endpoint descriptors, different from the interface descriptor's value: 119 [ 720.863549][T13305] usb 4-1: config 0 interface 1 has no altsetting 0 [ 720.874511][T13305] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 720.902702][T15250] FAULT_INJECTION: forcing a failure. [ 720.902702][T15250] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 720.905720][T13305] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.930701][T15250] CPU: 0 UID: 0 PID: 15250 Comm: syz.2.2817 Not tainted syzkaller #0 PREEMPT(full) [ 720.930731][T15250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 720.930745][T15250] Call Trace: [ 720.930754][T15250] [ 720.930764][T15250] dump_stack_lvl+0x189/0x250 [ 720.930792][T15250] ? __pfx____ratelimit+0x10/0x10 [ 720.930823][T15250] ? __pfx_dump_stack_lvl+0x10/0x10 [ 720.930845][T15250] ? __pfx__printk+0x10/0x10 [ 720.930872][T15250] ? __might_fault+0xb0/0x130 [ 720.930915][T15250] should_fail_ex+0x414/0x560 [ 720.930948][T15250] _copy_from_user+0x2d/0xb0 [ 720.930972][T15250] video_usercopy+0x349/0x13f0 [ 720.931004][T15250] ? __pfx___video_do_ioctl+0x10/0x10 [ 720.931024][T15250] ? __pfx_video_usercopy+0x10/0x10 [ 720.931062][T15250] ? __fget_files+0x3a0/0x420 [ 720.931091][T15250] v4l2_ioctl+0x18d/0x1e0 [ 720.931121][T15250] ? __pfx_v4l2_ioctl+0x10/0x10 [ 720.931151][T15250] __se_sys_ioctl+0xfc/0x170 [ 720.931183][T15250] do_syscall_64+0xfa/0xf80 [ 720.931201][T15250] ? lockdep_hardirqs_on+0x98/0x140 [ 720.931230][T15250] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.931251][T15250] ? clear_bhb_loop+0x60/0xb0 [ 720.931276][T15250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.931297][T15250] RIP: 0033:0x7fb7ac18f749 [ 720.931317][T15250] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 720.931336][T15250] RSP: 002b:00007fb7acf7b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 720.931361][T15250] RAX: ffffffffffffffda RBX: 00007fb7ac3e5fa0 RCX: 00007fb7ac18f749 [ 720.931377][T15250] RDX: 0000200000000080 RSI: 00000000c058565d RDI: 0000000000000003 [ 720.931391][T15250] RBP: 00007fb7acf7b090 R08: 0000000000000000 R09: 0000000000000000 [ 720.931405][T15250] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 720.931418][T15250] R13: 00007fb7ac3e6038 R14: 00007fb7ac3e5fa0 R15: 00007fb7ac50fa28 [ 720.931452][T15250] [ 720.946233][T13305] usb 4-1: Product: syz [ 721.195514][T13305] usb 4-1: Manufacturer: syz [ 721.206075][T13305] usb 4-1: SerialNumber: syz [ 721.231403][T13305] usb 4-1: config 0 descriptor?? [ 721.482085][T13305] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 721.664894][ T5926] usb 2-1: USB disconnect, device number 4 [ 721.681321][ T5926] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 721.711385][ T5926] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 721.744434][ T5926] keyspan 2-1:0.11: device disconnected [ 721.874357][T15275] fuse: Bad value for 'user_id' [ 721.879828][T15275] fuse: Bad value for 'user_id' [ 722.025912][ T6112] team_slave_1 (unregistering): left promiscuous mode [ 722.033998][ T6112] team0 (unregistering): Port device team_slave_1 removed [ 722.058035][ T5844] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 722.091937][ T6112] team_slave_0 (unregistering): left promiscuous mode [ 722.100442][ T6112] team0 (unregistering): Port device team_slave_0 removed [ 722.128678][T13305] gspca_spca1528: reg_w err -71 [ 722.148469][T13305] spca1528 4-1:0.1: probe with driver spca1528 failed with error -71 [ 722.161413][T13305] usb 4-1: USB disconnect, device number 37 [ 722.239593][ T5844] usb 3-1: Using ep0 maxpacket: 16 [ 722.247718][ T5844] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 722.263045][ T5844] usb 3-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 722.272630][ T5844] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 722.293715][ T5844] usb 3-1: config 0 descriptor?? [ 722.422456][T15163] Bluetooth: hci1: command tx timeout [ 722.522945][T15273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 722.534120][T15273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 722.774358][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.790362][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.797426][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.806049][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.814412][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.821880][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.829208][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.836355][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.850372][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.865473][T15165] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 722.874019][ T5844] sony 0003:054C:0268.0022: unknown main item tag 0x0 [ 722.887098][T15165] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 722.928413][T15165] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 722.941803][ T5844] sony 0003:054C:0268.0022: hiddev0,hidraw0: USB HID v80.09 Device [HID 054c:0268] on usb-dummy_hcd.2-1/input0 [ 722.968054][ T5844] sony 0003:054C:0268.0022: failed to claim input [ 722.989282][ T5926] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 723.019131][ T5844] usb 3-1: USB disconnect, device number 6 [ 723.126082][T15285] fido_id[15285]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 723.169840][ T5926] usb 2-1: device descriptor read/64, error -71 [ 723.320108][T15165] hsr_slave_0: entered promiscuous mode [ 723.335219][T15165] hsr_slave_1: entered promiscuous mode [ 723.428440][ T5926] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 723.668061][ T5926] usb 2-1: device descriptor read/64, error -71 [ 723.789308][ T5926] usb usb2-port1: attempt power cycle [ 724.094713][ T5844] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 724.158149][ T5926] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 724.229737][ T5926] usb 2-1: device descriptor read/8, error -71 [ 724.301840][ T5844] usb 3-1: config 5 has an invalid interface number: 123 but max is 0 [ 724.333152][T15318] loop9: detected capacity change from 0 to 7 [ 724.338201][ T5844] usb 3-1: config 5 has no interface number 0 [ 724.341782][T15318] Dev loop9: unable to read RDB block 7 [ 724.345404][ T5844] usb 3-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 724.352399][T15318] loop9: unable to read partition table [ 724.364717][ T5844] usb 3-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid maxpacket 14129, setting to 64 [ 724.384269][T15318] loop9: partition table beyond EOD, truncated [ 724.404615][ T5844] usb 3-1: config 5 interface 123 has no altsetting 0 [ 724.411985][T15318] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 724.419152][ T5844] usb 3-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 724.431208][ T5844] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.439579][ T5844] usb 3-1: Product: syz [ 724.444020][ T5844] usb 3-1: Manufacturer: syz [ 724.449135][ T5844] usb 3-1: SerialNumber: syz [ 724.461079][T15300] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 724.463814][T13310] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 724.488343][ T5926] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 724.498967][T15163] Bluetooth: hci1: command tx timeout [ 724.541480][ T5926] usb 2-1: device descriptor read/8, error -71 [ 724.613466][T15165] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 724.626536][T15165] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 724.638116][T13310] usb 4-1: Using ep0 maxpacket: 16 [ 724.644197][T13310] usb 4-1: no configurations [ 724.658501][T13310] usb 4-1: can't read configurations, error -22 [ 724.669276][T15165] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 724.680385][ T5926] usb usb2-port1: unable to enumerate USB device [ 724.696537][T15165] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 724.754159][ T5844] comedi comedi5: driver 'ni6501' has successfully auto-configured 'ni6501'. [ 724.788019][ T5844] usb 3-1: USB disconnect, device number 7 [ 724.808683][T13310] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 724.917806][T15165] 8021q: adding VLAN 0 to HW filter on device bond0 [ 724.944459][T15165] 8021q: adding VLAN 0 to HW filter on device team0 [ 724.960966][ T3855] bridge0: port 1(bridge_slave_0) entered blocking state [ 724.968189][ T3855] bridge0: port 1(bridge_slave_0) entered forwarding state [ 724.978819][T13310] usb 4-1: Using ep0 maxpacket: 16 [ 724.984954][T13310] usb 4-1: no configurations [ 724.990275][T13310] usb 4-1: can't read configurations, error -22 [ 725.008108][ T6444] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 725.019079][ T1159] bridge0: port 2(bridge_slave_1) entered blocking state [ 725.026309][ T1159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 725.034775][T13310] usb usb4-port1: attempt power cycle [ 725.156264][T15165] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 725.192019][ T6444] usb 1-1: config 0 has an invalid interface number: 168 but max is 0 [ 725.212149][ T6444] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 725.213490][T15165] veth0_vlan: entered promiscuous mode [ 725.229314][ T6444] usb 1-1: config 0 has no interface number 0 [ 725.235610][ T6444] usb 1-1: config 0 interface 168 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 725.256597][T15165] veth1_vlan: entered promiscuous mode [ 725.257737][ T6444] usb 1-1: config 0 interface 168 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 725.298047][ T6444] usb 1-1: config 0 interface 168 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 16 [ 725.310730][T15165] veth0_macvtap: entered promiscuous mode [ 725.324597][T15165] veth1_macvtap: entered promiscuous mode [ 725.331001][ T6444] usb 1-1: New USB device found, idVendor=0959, idProduct=2bd0, bcdDevice=48.98 [ 725.349027][ T6444] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 725.361253][T15165] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 725.361614][ T6444] usb 1-1: config 0 descriptor?? [ 725.378319][T13310] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 725.398522][ T6444] HFC-S_USB 1-1:0.168: probe with driver HFC-S_USB failed with error -5 [ 725.406204][T15165] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 725.421005][T13310] usb 4-1: Using ep0 maxpacket: 16 [ 725.432376][T13310] usb 4-1: no configurations [ 725.437040][T13310] usb 4-1: can't read configurations, error -22 [ 725.460639][T11846] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.470752][T11846] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.490618][T11846] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.513423][T11846] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.588562][T13310] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 725.641214][T13310] usb 4-1: Using ep0 maxpacket: 16 [ 725.649599][T13310] usb 4-1: no configurations [ 725.657338][T13310] usb 4-1: can't read configurations, error -22 [ 725.659117][ T5844] usb 1-1: USB disconnect, device number 125 [ 725.675913][T13310] usb usb4-port1: unable to enumerate USB device [ 725.752868][ T6112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 725.777465][ T6112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 725.835090][ T192] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 725.855340][ T192] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 726.328798][ T5926] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 726.488299][ T5844] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 726.513433][ T5926] usb 3-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 726.528618][ T5926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 726.539484][ T5926] usb 3-1: config 0 descriptor?? [ 726.549602][ T5926] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 726.556878][ T5926] dvb_usb_af9015 3-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 726.637950][ T5844] usb 2-1: device descriptor read/64, error -71 [ 726.907969][ T5844] usb 2-1: new low-speed USB device number 10 using dummy_hcd [ 727.162730][ T5844] usb 2-1: device descriptor read/64, error -71 [ 727.301148][ T5844] usb usb2-port1: attempt power cycle [ 727.647996][ T5844] usb 2-1: new low-speed USB device number 11 using dummy_hcd [ 727.688840][ T5844] usb 2-1: device descriptor read/8, error -71 [ 727.937970][ T5844] usb 2-1: new low-speed USB device number 12 using dummy_hcd [ 727.958847][ T5844] usb 2-1: device descriptor read/8, error -71 [ 728.071746][ T5844] usb usb2-port1: unable to enumerate USB device [ 728.688050][ T5926] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 728.728400][T13305] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 728.817989][ T5926] usb 5-1: device descriptor read/64, error -71 [ 728.858591][T13305] usb 4-1: device descriptor read/64, error -71 [ 729.072750][T13310] usb 3-1: USB disconnect, device number 8 [ 729.078969][ T5926] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 729.124670][T13305] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 729.229246][ T5926] usb 5-1: device descriptor read/64, error -71 [ 729.309866][T13305] usb 4-1: device descriptor read/64, error -71 [ 729.359545][ T5926] usb usb5-port1: attempt power cycle [ 729.468985][T13305] usb usb4-port1: attempt power cycle [ 729.717963][ T5926] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 729.765736][ T5926] usb 5-1: device descriptor read/8, error -71 [ 729.837955][T13305] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 729.861225][T13305] usb 4-1: device descriptor read/8, error -71 [ 729.975474][T15444] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2852'. [ 730.017957][ T5926] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 730.095213][ T5926] usb 5-1: device descriptor read/8, error -71 [ 730.104085][T13305] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 730.152906][T13305] usb 4-1: device descriptor read/8, error -71 [ 730.222262][ T5926] usb usb5-port1: unable to enumerate USB device [ 730.243807][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 730.243830][ T30] audit: type=1326 audit(1764706470.374:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.279742][T13305] usb usb4-port1: unable to enumerate USB device [ 730.295096][ T30] audit: type=1326 audit(1764706470.374:436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.348014][ T30] audit: type=1326 audit(1764706470.404:437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.432885][ T30] audit: type=1326 audit(1764706470.404:438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.484832][ T30] audit: type=1326 audit(1764706470.414:439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.529877][ T30] audit: type=1326 audit(1764706470.414:440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.577598][ T30] audit: type=1326 audit(1764706470.414:441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.608999][ T30] audit: type=1326 audit(1764706470.414:442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.658823][ T30] audit: type=1326 audit(1764706470.414:443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=125 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.703713][ T30] audit: type=1326 audit(1764706470.414:444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15445 comm="syz.1.2853" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f609a58f749 code=0x7ffc0000 [ 730.760978][T15451] [U]  [ 730.764394][T15451] [U] K{‘ [ 730.778158][T15451] [U] ÄT Ž1ÊÀŠªFÌÇÄFËŠÎ`GÊJǘÜGÖƯ¹¬¡—ÞÈOÕÑ/ÜMCÇ [ 730.796398][T15451] [U] TžØ–/,~ˆÄœ­‹JÕßÊ}8ÎÊÞ'O1Ü"™7-΂JQœK—¤WºÏQÉ5C%"¬H12–¦Y“„‰ž€ÊXÍ`ˆ‚Íȼ`+³Û(·Â¿!(ÉÛÉZ'ÀTXLN»I®GÅJ– °ÜÝ­·PÅ~÷7Í!‘ÕÒ"بÎ ¾ª(È5ˆOBܤ‡ÍƒJÖ [ 730.838209][T15451] [U] ±K\&—}6£6œXÎHX ¥Ôµ„ÌÞ.`¸A“$Û40|϶¿9°ØÞ¨„¯À ÏU‚Ò4ÔÄ®VBZÃÐ}ÌWÔM”TºŽÍQŸÝΦR’ 4”ß [ 730.889834][T15451] [U] ".H6ØÞ"ÖKÇ[›‰¤ŒJÁ4ÇØIN¨™[Z(•„C|TË]Z{Â3ŸC=»¨XÎԞ˅Î4¿W‰)\T‘XJØSH{Q;̹¢…ÖTÔÇ+‹¦÷GÍÈß®D„.Ë‚³>Yž÷ÉWUH„FN—ŽÇHL]SÔ2ŠÇÙ\G%ŠO¼&Z)µК'¨PUL‚_<à ¢Ø°‰Ò®ÔÅ`Ò±TÔÁÞœÐËÞ;_Ô"(‘U{7Jœ¿2X ‘/€'ÝÙCÑÌÕIº©ÀÏH¿CÕ³žV¦=‘AIÇ%W¼ESž RšŸJŠÎœƒÚ”GÂ÷RÁ¹Í¡HI˜¢œAÏÌ6-ÚDÚV¨Á I"ØÅNƨ ÞÚASC~4Áª¹8CØ*­OO5/ßœJš~º§¡W—VK+¬®‰Œ3ÈÇY)Ž¹M°¸ÆV¶ÌYQƽ€DTR¯OTPEM%F×ÊEJÍA5ÆÔT_-X~ ^AAÛ‚Ò˜½QÖÅ [ 730.997954][T15451] [U] +W‰G?]£Ó'A: »Ú)ÕÏÓ™“' B>T¢ ¡F/™÷<'ÈUÓ'–¼H§IÉ.+]EŸ.½-É¿ß¿Ò%÷È>2`¶^Uß8F.Š6¤Å3ÓØ+ËA¾Â««„°G3ÓPÂÓ6:^0ÀTÉÈV÷'EÕT¼€ÛÂYC‰N¾ÞRÏ©ÞNÈPJ× ;ÆZ†ÊÔÑÛ‘8!¯È\Ù…¸AØÊ–2Á£$е™Â­WI.ÍÇ#ŠÈ/BAI¼Ä`ÐÁ4J’ÔDÎY@ÓZ„ÜGW÷5Ë¿BÄ µÙœ NÓY"VI2ÛÌ [ 731.068339][T15451] [U] ÔT¦_K5¸T¬YJÐÞÎ9ÐÕCÊ$BRŸLÚNUL ¶Ü9WÈÝÍ|žGÅ"ʃÆ%ÇÚ¶ÊCªØ°¶ºQÎÙ ŸÇ3‹ÆQ¯ÔN^HP*½Ü$ µ.Î7YÓ±œ2³ [ 731.119925][T15451] [U] ½?©ß HÜÄ*ÙÁ”Î3Í7Üɾ^#Q"0~‡ ‚Ð(ÉOÏX LŒB£,'VÎÓ=‹ÝËCÌS«…’G‚S¶Þ0•Ö‚‹Ù`˜›žÙ‡Ÿ†=1(÷ξ™÷P#Ò2DO*Ƀ [ 731.164348][T15451] [U] ©S¹“Gžµ²¶“˜GUÐÔD-{¸™Â|&“®ŸŸÑ2µ›LÞC_©œ!`¨ÍOZÖ¥¢B¶³%>ÊRѶÖWχݎSSÂH"£YA4£O.šYÙÛÄ„RTÔ¶ŒBÚ[+/<>—¡{Q¢Ú×_²ÕLX8ÊU„ÇØÎ{ÐZ³ÍØ)ßÒ7?ËRR;ßC¿R HײڣÁ»¨È1Å>)©Mă‰ÏT§²Ú(ÌÇAÏ„}9·Ú¥ÃJ*MÑœ¥Ä¡«'L¹£Q ÌDWŸÒظ=ؽ|Q¬ ÏÆ™W;5ÆÙŽª!ÑDB¸X`ɧÖ/÷ÂE`ƦM¢XÎÂ"Ä\ [ 731.301736][T15462] FAULT_INJECTION: forcing a failure. [ 731.301736][T15462] name failslab, interval 1, probability 0, space 0, times 0 [ 731.333546][T15462] CPU: 1 UID: 0 PID: 15462 Comm: syz.2.2860 Not tainted syzkaller #0 PREEMPT(full) [ 731.333576][T15462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 731.333589][T15462] Call Trace: [ 731.333598][T15462] [ 731.333608][T15462] dump_stack_lvl+0x189/0x250 [ 731.333637][T15462] ? __pfx____ratelimit+0x10/0x10 [ 731.333677][T15462] ? __pfx_dump_stack_lvl+0x10/0x10 [ 731.333700][T15462] ? __pfx__printk+0x10/0x10 [ 731.333745][T15462] should_fail_ex+0x414/0x560 [ 731.333777][T15462] should_failslab+0xa8/0x100 [ 731.333803][T15462] __kmalloc_cache_noprof+0x6f/0x6e0 [ 731.333832][T15462] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 731.333861][T15462] ? sctp_add_bind_addr+0x8c/0x370 [ 731.333897][T15462] sctp_add_bind_addr+0x8c/0x370 [ 731.333931][T15462] sctp_copy_local_addr_list+0x30b/0x4e0 [ 731.333964][T15462] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 731.333998][T15462] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 731.334030][T15462] ? sctp_v6_is_any+0x64/0x80 [ 731.334061][T15462] ? sctp_copy_one_addr+0x93/0x360 [ 731.334095][T15462] sctp_bind_addr_copy+0xb3/0x3c0 [ 731.334124][T15462] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 731.334154][T15462] sctp_connect_new_asoc+0x2e0/0x690 [ 731.334181][T15462] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 731.334200][T15462] ? __local_bh_enable_ip+0x12d/0x1c0 [ 731.334239][T15462] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 731.334261][T15462] ? security_sctp_bind_connect+0x7e/0x2e0 [ 731.334297][T15462] sctp_sendmsg+0x155c/0x2810 [ 731.334332][T15462] ? __pfx_sctp_sendmsg+0x10/0x10 [ 731.334351][T15462] ? aa_sk_perm+0x160/0x920 [ 731.334377][T15462] ? aa_sk_perm+0x7f0/0x920 [ 731.334405][T15462] ? __pfx_aa_sk_perm+0x10/0x10 [ 731.334432][T15462] ? sock_rps_record_flow+0x19/0x410 [ 731.334467][T15462] ? inet_sendmsg+0x2f4/0x370 [ 731.334500][T15462] __sock_sendmsg+0x19c/0x270 [ 731.334529][T15462] __sys_sendto+0x3bd/0x520 [ 731.334560][T15462] ? __pfx___sys_sendto+0x10/0x10 [ 731.334585][T15462] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 731.334621][T15462] ? __fget_files+0x3a0/0x420 [ 731.334659][T15462] ? ksys_write+0x22a/0x250 [ 731.334698][T15462] ? __pfx_ksys_write+0x10/0x10 [ 731.334733][T15462] __x64_sys_sendto+0xde/0x100 [ 731.334765][T15462] do_syscall_64+0xfa/0xf80 [ 731.334783][T15462] ? lockdep_hardirqs_on+0x98/0x140 [ 731.334813][T15462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 731.334834][T15462] ? clear_bhb_loop+0x60/0xb0 [ 731.334861][T15462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 731.334881][T15462] RIP: 0033:0x7fb7ac18f749 [ 731.334900][T15462] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 731.334918][T15462] RSP: 002b:00007fb7acf7b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 731.334941][T15462] RAX: ffffffffffffffda RBX: 00007fb7ac3e5fa0 RCX: 00007fb7ac18f749 [ 731.334957][T15462] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000003 [ 731.334970][T15462] RBP: 00007fb7acf7b090 R08: 0000200000000280 R09: 000000000000001c [ 731.334984][T15462] R10: 00000000240408d4 R11: 0000000000000246 R12: 0000000000000002 [ 731.334998][T15462] R13: 00007fb7ac3e6038 R14: 00007fb7ac3e5fa0 R15: 00007fb7ac50fa28 [ 731.335035][T15462] [ 731.340160][T15451] [U] {;Ž Õ¥ÂÙ˜_ˆO2«Ñ)ÎO®›.2ÐW2ʲ¨ÐYÙÃÃX_ HPϱœSªD­¦Ø:]‚{Ë©ÔÝÆȽ [ 731.691450][ T5926] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 731.756265][T15451] [U] I,Ç>ÇÓ¤ ÎÙ51Ñ÷^1ÒN4¯OǶÞ'0Ý?Ö’IÙ9W.Ï_.¶WŠA¼ŠVˆ±`)ÑZ¬ÏÆC6GIÓ¹²A»¬XL[¢›½¡FÜ*ÀÑO‰W)+‡Ç'\NÆ[K@ÑËÄÜ2ÇǬ–®¡P"^`Á‰Í Ø¿ [ 731.772434][T15451] [U] 22½“Æ©ÐÛ©X?0;3U± [ 731.777675][T15451] [U] ÞœÕÆÓSOBX 8”Wˆ4Á‘(Ð~/§¿ÍKÇUžÃÔ–OQËE+·G®-YµGY_•>V¢ÜÈË—3.HÁÓ™]Í„²2‘”)™DË, ‘Ä ÞD~×D©£¡+ÃW; A\˜FPÉÞȘ|$ºØ)KØI³ÉÐÉ¿KÑYT^RÍÜÙÇ™µ“ËA=±#–Üœ ÝÍ¿ËAE©TÅ1·Îݯ4K¯.E"RÚS|ПÀSÖ’Á:•Ù>P ™…RÐ"Z‰Ú­ÛÚÉ#P!˜KY"›}ÃÆF¿N84ܳƒÅHÞ±£O•ÈS¿™Ì«%DLWÙMÆ²Ç [ 731.807583][T15451] [U] [ª['XN€'²÷ Á¿Ü,MR¦«/žšœÂ1D=!DŽX91BÙWÇ»R—LF…ƒÆK̤ZÕÊ# `Ì‘ LØ›§Ëœ»×B~ÅMÒÔÖ [ 731.820863][T15451] [U] ™LÖ>ÑD+ˆD¯§—®Ì"5ŽÊH3<ª¨ÅIR=F^”FNÕÓÜÀ‰¿Û­VÛ÷œDÁOIOÚ:UÖ>ÖY [ 731.829893][T15451] [U] 'B—6VÝ20³Ä·Çž¥·×ŒÏ"T8Ñ{9ÆFW]ÔÊÄÌ© [ 731.863469][T15451] [U] Ù72Þ‰ÏÂÃUÞC6™ÎÜÔÏ„I]8Cª£TÛ¨QSKYÞÎIÒÀ¹ ¿|V'ÛTV/ÙÅG•$[ 9KH`Ú"Ü‘ÚÕ}€Ñ[^=ˆÚ0Á]½Ã%ÆÌ‚T“Šž¹ØFÌ_VÖ4C¸ÒÅ [ 731.901162][ T5926] usb 1-1: config 0 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 731.919125][T15451] [U] ¹ EC [ 731.922735][T15451] [U] —”|‚ÊÌ<ÄÎ:^Ü3$7NK~Ø-™@÷¦?Ÿ–/MTL·Û¾©IˆWȬ@G~TØ{ÊÜP¿+Æ$ªJP|µ ŽÇIÛRIÓPMÐ Õ·YÓ Ú”8ÌTÉÐÞVžÙßÆË,ÎLÂ,Õ [ 731.941542][ T5926] usb 1-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 731.958379][T13310] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 731.968254][ T5926] usb 1-1: config 0 interface 0 has no altsetting 0 [ 731.975002][ T5926] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 731.989500][T15451] [U] ˆKÌÚÛÕ‰)0ÄÄÝ~ܳʪÁIP'ÍFÓÒœZÚÞR¬™ß @BÓ]Â5ÝÊ{­©Ê¼Ô'À8ÅÆ¥F‡¹UTQUDÇ©¤K;7ͪ0C[„ÃY–¼ÈYC¦¶»Ø°Mª™LÒ8’T…ÍšÎ5³ÝÝRX™¶ÐWÍ X¤²ÓOQHVI'8œ¥Î…Lµ [ 732.010099][ T5926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.027047][ T5926] usb 1-1: config 0 descriptor?? [ 732.052328][T15471] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2864'. [ 732.121670][T13310] usb 3-1: Using ep0 maxpacket: 32 [ 732.130562][T13310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 732.169828][T13310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 732.195572][T13310] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 732.210114][T13310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.237422][T13310] usb 3-1: config 0 descriptor?? [ 732.274224][T15477] bond9: Unable to set peer notification delay as MII monitoring is disabled [ 732.290989][T15477] bond9 (unregistering): Released all slaves [ 732.678466][T13310] savu 0003:1E7D:2D5A.0023: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 732.790378][ T5926] usbhid 1-1:0.0: can't add hid device: -71 [ 732.833607][ T5926] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 732.873727][ T5926] usb 1-1: USB disconnect, device number 126 [ 732.951260][T15464] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 733.010640][T15464] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 733.098069][T13310] usb 3-1: USB disconnect, device number 9 [ 733.228306][T15497] netlink: 'syz.1.2872': attribute type 12 has an invalid length. [ 733.248042][T15497] netlink: 'syz.1.2872': attribute type 29 has an invalid length. [ 733.272208][T15497] netlink: 148 bytes leftover after parsing attributes in process `syz.1.2872'. [ 733.414564][T15504] syzkaller1: entered promiscuous mode [ 733.447965][T15504] syzkaller1: entered allmulticast mode [ 734.157928][ T5926] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 734.318504][ T5926] usb 4-1: Using ep0 maxpacket: 16 [ 734.334263][ T5926] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 734.372377][ T5926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 734.400384][ T5926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 734.437038][ T5926] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 734.450306][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 734.466029][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 734.478258][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 734.489467][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 734.497471][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 734.497734][ T5926] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 734.591438][ T5926] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 734.656852][ T5926] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 734.698577][ T5926] usb 4-1: Manufacturer: syz [ 734.717221][ T5926] usb 4-1: config 0 descriptor?? [ 735.129003][ T5926] rc_core: IR keymap rc-hauppauge not found [ 735.154623][ T5926] Registered IR keymap rc-empty [ 735.163013][T15518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 735.212679][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.223087][T15518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 735.248005][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.289546][ T5926] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 735.333043][ T5926] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input38 [ 735.403788][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.450350][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.488002][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.515767][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.568134][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.608204][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.624070][T15537] binder_alloc: 15536: binder_alloc_buf size 1024 failed, no address space [ 735.648174][T15537] binder_alloc: allocated: 12280 (num: 1 largest: 12280), free: 8 (num: 1 largest: 8) [ 735.653717][T15524] chnl_net:caif_netlink_parms(): no params data found [ 735.658409][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.696011][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.748767][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.808262][ T5926] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 735.824345][T15545] xt_hashlimit: size too large, truncated to 1048576 [ 735.856354][ T5926] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 735.868069][T15545] xt_hashlimit: max too large, truncated to 1048576 [ 735.900855][ T5926] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 736.072102][T15550] syzkaller1: entered promiscuous mode [ 736.079519][T15550] syzkaller1: entered allmulticast mode [ 736.167686][T15524] bridge0: port 1(bridge_slave_0) entered blocking state [ 736.188178][T15524] bridge0: port 1(bridge_slave_0) entered disabled state [ 736.195721][T15524] bridge_slave_0: entered allmulticast mode [ 736.207738][T15524] bridge_slave_0: entered promiscuous mode [ 736.226670][T13310] usb 4-1: USB disconnect, device number 46 [ 736.279068][T15524] bridge0: port 2(bridge_slave_1) entered blocking state [ 736.286509][T15524] bridge0: port 2(bridge_slave_1) entered disabled state [ 736.316485][T15524] bridge_slave_1: entered allmulticast mode [ 736.340124][T15524] bridge_slave_1: entered promiscuous mode [ 736.481785][T15524] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 736.518660][T15524] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 736.528013][ T5926] usb 1-1: new full-speed USB device number 127 using dummy_hcd [ 736.566029][T15571] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2894'. [ 736.578008][T15163] Bluetooth: hci3: command tx timeout [ 736.702270][T15524] team0: Port device team_slave_0 added [ 736.714554][ T5926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 736.753520][T15524] team0: Port device team_slave_1 added [ 736.762530][ T5926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 736.788505][T15575] netlink: 112 bytes leftover after parsing attributes in process `syz.3.2898'. [ 736.813184][ T5926] usb 1-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 736.843375][ T5926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 736.863564][T15575] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2898'. [ 736.876848][ T5926] usb 1-1: config 0 descriptor?? [ 736.946324][T15524] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 736.974527][T15524] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 737.073673][T15524] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 737.140937][T15524] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 737.176345][T15524] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 737.277411][T15524] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 737.341146][ T5926] isku 0003:1E7D:319C.0024: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.0-1/input0 [ 737.379358][ T5955] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 737.548431][ T5955] usb 4-1: Using ep0 maxpacket: 32 [ 737.561437][ T5955] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 737.585575][ T5955] usb 4-1: config 0 has no interface number 0 [ 737.610620][ T5955] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 737.642630][T15524] hsr_slave_0: entered promiscuous mode [ 737.672777][T15524] hsr_slave_1: entered promiscuous mode [ 737.673184][ T5955] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 737.708073][ T5955] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 737.708992][T15524] debugfs: 'hsr0' already exists in 'hsr' [ 737.726420][ T5955] usb 4-1: Product: syz [ 737.746675][ T5955] usb 4-1: Manufacturer: syz [ 737.762577][ T5955] usb 4-1: SerialNumber: syz [ 737.777732][T15524] Cannot create hsr debugfs directory [ 737.784881][ T5926] usb 1-1: USB disconnect, device number 127 [ 737.788148][ T5955] usb 4-1: config 0 descriptor?? [ 737.885571][ T5955] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 737.925720][ T5955] em28xx 4-1:0.132: Video interface 132 found: [ 738.319149][ T5955] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 738.535516][T15586] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 738.608018][T13310] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 738.619815][T15587] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 738.659074][T15163] Bluetooth: hci3: command tx timeout [ 738.760829][T13310] usb 5-1: Using ep0 maxpacket: 32 [ 738.774283][T13310] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 738.782803][T13310] usb 5-1: config 0 has no interface number 0 [ 738.789653][T13310] usb 5-1: config 0 interface 184 has no altsetting 0 [ 738.802369][T13310] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 738.811860][T13310] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 738.820257][T13310] usb 5-1: Product: syz [ 738.825437][T13310] usb 5-1: Manufacturer: syz [ 738.835840][T13310] usb 5-1: SerialNumber: syz [ 738.858782][T13310] usb 5-1: config 0 descriptor?? [ 738.874808][T13310] smsc75xx v1.0.0 [ 738.927496][T15524] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 738.958556][T15524] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 738.974902][T15524] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 738.990302][T15524] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 739.088437][T13305] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 739.225587][T15524] 8021q: adding VLAN 0 to HW filter on device bond0 [ 739.259613][T15524] 8021q: adding VLAN 0 to HW filter on device team0 [ 739.268449][T13305] usb 3-1: Using ep0 maxpacket: 32 [ 739.290930][ T3855] bridge0: port 1(bridge_slave_0) entered blocking state [ 739.291452][T13305] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 739.298323][ T3855] bridge0: port 1(bridge_slave_0) entered forwarding state [ 739.307469][T13305] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.331000][T13305] usb 3-1: Product: syz [ 739.332422][ T5983] bridge0: port 2(bridge_slave_1) entered blocking state [ 739.335254][T13305] usb 3-1: Manufacturer: syz [ 739.342474][ T5983] bridge0: port 2(bridge_slave_1) entered forwarding state [ 739.347800][T13305] usb 3-1: SerialNumber: syz [ 739.395036][T13305] usb 3-1: config 0 descriptor?? [ 739.426052][T13305] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 739.449457][ T5955] em28xx 4-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 739.470400][T15577] em28xx 4-1:0.132: failed to trigger read from i2c address 0x0 (error=-5) [ 739.489061][ T5955] em28xx 4-1:0.132: board has no eeprom [ 739.551897][T15600] syzkaller1: entered promiscuous mode [ 739.557585][T15600] syzkaller1: entered allmulticast mode [ 739.569432][T15524] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 739.576663][T13310] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 739.592338][ T5955] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 739.601025][T13310] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 739.613344][ T5955] em28xx 4-1:0.132: analog set to bulk mode. [ 739.620184][T13310] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 739.630747][ T6444] em28xx 4-1:0.132: Registering V4L2 extension [ 739.661137][ T5955] usb 4-1: USB disconnect, device number 47 [ 739.670082][T13310] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 739.692352][ T5955] em28xx 4-1:0.132: Disconnecting em28xx [ 739.739100][T13310] usb 5-1: USB disconnect, device number 22 [ 739.835329][T15524] veth0_vlan: entered promiscuous mode [ 739.855953][T15524] veth1_vlan: entered promiscuous mode [ 739.965469][T15524] veth0_macvtap: entered promiscuous mode [ 739.976944][T15524] veth1_macvtap: entered promiscuous mode [ 740.003809][ T6444] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 740.017685][T15524] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 740.026765][ T6444] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 740.048019][ T6444] em28xx 4-1:0.132: No AC97 audio processor [ 740.062909][T15524] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 740.093041][ T6444] usb 4-1: Decoder not found [ 740.129769][ T6444] em28xx 4-1:0.132: failed to create media graph [ 740.130658][T11846] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.136527][ T6444] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 740.201872][T11846] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.234973][T11846] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.237902][ T6444] em28xx 4-1:0.132: Remote control support is not available for this card. [ 740.265623][T15611] FAULT_INJECTION: forcing a failure. [ 740.265623][T15611] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 740.280619][T13305] gspca_ov534_9: reg_w failed -71 [ 740.308007][ T5955] em28xx 4-1:0.132: Closing input extension [ 740.313720][T11846] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 740.338145][T15611] CPU: 1 UID: 0 PID: 15611 Comm: syz.3.2907 Not tainted syzkaller #0 PREEMPT(full) [ 740.338175][T15611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 740.338189][T15611] Call Trace: [ 740.338197][T15611] [ 740.338207][T15611] dump_stack_lvl+0x189/0x250 [ 740.338234][T15611] ? __pfx____ratelimit+0x10/0x10 [ 740.338263][T15611] ? __pfx_dump_stack_lvl+0x10/0x10 [ 740.338284][T15611] ? __pfx__printk+0x10/0x10 [ 740.338322][T15611] should_fail_ex+0x414/0x560 [ 740.338352][T15611] _copy_to_user+0x31/0xb0 [ 740.338372][T15611] simple_read_from_buffer+0xe1/0x170 [ 740.338399][T15611] proc_fail_nth_read+0x1b3/0x220 [ 740.338433][T15611] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 740.338466][T15611] ? rw_verify_area+0x2a6/0x4d0 [ 740.338493][T15611] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 740.338522][T15611] vfs_read+0x200/0xa30 [ 740.338564][T15611] ? fdget_pos+0x247/0x320 [ 740.338591][T15611] ? __pfx___mutex_lock+0x10/0x10 [ 740.338613][T15611] ? __pfx_vfs_read+0x10/0x10 [ 740.338643][T15611] ? __fget_files+0x2a/0x420 [ 740.338670][T15611] ? __fget_files+0x3a0/0x420 [ 740.338691][T15611] ? __fget_files+0x2a/0x420 [ 740.338723][T15611] ksys_read+0x145/0x250 [ 740.338762][T15611] ? __pfx_ksys_read+0x10/0x10 [ 740.338795][T15611] ? do_syscall_64+0xbe/0xf80 [ 740.338818][T15611] do_syscall_64+0xfa/0xf80 [ 740.338835][T15611] ? lockdep_hardirqs_on+0x98/0x140 [ 740.338863][T15611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.338883][T15611] ? clear_bhb_loop+0x60/0xb0 [ 740.338909][T15611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.338928][T15611] RIP: 0033:0x7f7d9378e15c [ 740.338946][T15611] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 740.338963][T15611] RSP: 002b:00007f7d945aa030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 740.338986][T15611] RAX: ffffffffffffffda RBX: 00007f7d939e5fa0 RCX: 00007f7d9378e15c [ 740.339001][T15611] RDX: 000000000000000f RSI: 00007f7d945aa0a0 RDI: 0000000000000004 [ 740.339015][T15611] RBP: 00007f7d945aa090 R08: 0000000000000000 R09: 0000000000000000 [ 740.339028][T15611] R10: ffffffffff600000 R11: 0000000000000246 R12: 0000000000000001 [ 740.339042][T15611] R13: 00007f7d939e6038 R14: 00007f7d939e5fa0 R15: 00007f7d93b0fa28 [ 740.339064][T15611] ? 0xffffffffff600000 [ 740.339094][T15611] [ 740.580862][ C1] vkms_vblank_simulate: vblank timer overrun [ 740.599084][ T5955] em28xx 4-1:0.132: Freeing device [ 740.664928][T15617] FAULT_INJECTION: forcing a failure. [ 740.664928][T15617] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 740.683081][T15617] CPU: 1 UID: 0 PID: 15617 Comm: syz.4.2908 Not tainted syzkaller #0 PREEMPT(full) [ 740.683108][T15617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 740.683120][T15617] Call Trace: [ 740.683128][T15617] [ 740.683136][T15617] dump_stack_lvl+0x189/0x250 [ 740.683161][T15617] ? __pfx____ratelimit+0x10/0x10 [ 740.683186][T15617] ? __pfx_dump_stack_lvl+0x10/0x10 [ 740.683203][T15617] ? __pfx__printk+0x10/0x10 [ 740.683229][T15617] ? __might_fault+0xb0/0x130 [ 740.683267][T15617] should_fail_ex+0x414/0x560 [ 740.683295][T15617] _copy_from_iter+0x1de/0x1790 [ 740.683330][T15617] ? rcu_is_watching+0x15/0xb0 [ 740.683356][T15617] ? __pfx__copy_from_iter+0x10/0x10 [ 740.683383][T15617] ? __build_skb_around+0x22d/0x3c0 [ 740.683411][T15617] ? netlink_sendmsg+0x642/0xb30 [ 740.683435][T15617] ? skb_put+0x11b/0x210 [ 740.683462][T15617] netlink_sendmsg+0x6b2/0xb30 [ 740.683497][T15617] ? __pfx_netlink_sendmsg+0x10/0x10 [ 740.683527][T15617] ? aa_sock_msg_perm+0xf1/0x1b0 [ 740.683560][T15617] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 740.683578][T15617] ? __pfx_netlink_sendmsg+0x10/0x10 [ 740.683605][T15617] __sock_sendmsg+0x21c/0x270 [ 740.683629][T15617] __sys_sendto+0x3bd/0x520 [ 740.683655][T15617] ? __pfx___sys_sendto+0x10/0x10 [ 740.683676][T15617] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 740.683707][T15617] ? __fget_files+0x3a0/0x420 [ 740.683737][T15617] ? ksys_write+0x22a/0x250 [ 740.683766][T15617] ? __pfx_ksys_write+0x10/0x10 [ 740.683794][T15617] __x64_sys_sendto+0xde/0x100 [ 740.683821][T15617] do_syscall_64+0xfa/0xf80 [ 740.683836][T15617] ? lockdep_hardirqs_on+0x98/0x140 [ 740.683862][T15617] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.683881][T15617] ? clear_bhb_loop+0x60/0xb0 [ 740.683902][T15617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.683918][T15617] RIP: 0033:0x7f8f5f98f749 [ 740.683936][T15617] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 740.683952][T15617] RSP: 002b:00007f8f60896038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 740.683973][T15617] RAX: ffffffffffffffda RBX: 00007f8f5fbe5fa0 RCX: 00007f8f5f98f749 [ 740.683986][T15617] RDX: 0000000000000002 RSI: 0000200000000740 RDI: 0000000000000004 [ 740.683998][T15617] RBP: 00007f8f60896090 R08: 0000000000000000 R09: 0000000000000000 [ 740.684010][T15617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.684022][T15617] R13: 00007f8f5fbe6038 R14: 00007f8f5fbe5fa0 R15: 00007f8f5fd0fa28 [ 740.684053][T15617] [ 740.938654][ C1] vkms_vblank_simulate: vblank timer overrun [ 741.043422][T15163] Bluetooth: hci3: command tx timeout [ 741.167660][T15623] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 741.298276][T13305] gspca_ov534_9: Unknown sensor 0000 [ 741.298389][T13305] ov534_9 3-1:0.0: probe with driver ov534_9 failed with error -22 [ 741.341219][T13305] usb 3-1: USB disconnect, device number 10 [ 741.475901][ T30] kauditd_printk_skb: 40 callbacks suppressed [ 741.475922][ T30] audit: type=1326 audit(1764706481.604:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.513008][T15629] loop5: detected capacity change from 0 to 7 [ 741.523583][ T5983] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 741.558971][ T5983] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 741.604987][T15629] Dev loop5: unable to read RDB block 7 [ 741.622770][ T30] audit: type=1326 audit(1764706481.644:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.675795][T15629] loop5: unable to read partition table [ 741.728889][T15629] loop5: partition table beyond EOD, truncated [ 741.775840][T15629] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 741.785171][ T30] audit: type=1326 audit(1764706481.644:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.785227][ T30] audit: type=1326 audit(1764706481.644:488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.785274][ T30] audit: type=1326 audit(1764706481.644:489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.785331][ T30] audit: type=1326 audit(1764706481.644:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=67 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.785379][ T30] audit: type=1326 audit(1764706481.644:491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.785427][ T30] audit: type=1326 audit(1764706481.644:492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.785474][ T30] audit: type=1326 audit(1764706481.644:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 741.937126][T15640] netlink: 'syz.4.2913': attribute type 10 has an invalid length. [ 741.971572][T15640] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2913'. [ 741.999796][T15635] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2913'. [ 742.071812][ T3855] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.088122][ T3855] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.159867][T15640] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 742.204248][T15640] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 742.224236][T15640] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 742.268070][ T30] audit: type=1326 audit(1764706481.644:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15628 comm="syz.4.2913" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8f5f98f749 code=0x7ffc0000 [ 742.498277][T13305] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 742.516912][T15646] ipt_REJECT: ECHOREPLY no longer supported. [ 742.668527][T13305] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 742.707098][T13305] usb 4-1: config 0 interface 0 has no altsetting 0 [ 742.715819][T15656] FAULT_INJECTION: forcing a failure. [ 742.715819][T15656] name failslab, interval 1, probability 0, space 0, times 0 [ 742.738394][T15656] CPU: 1 UID: 0 PID: 15656 Comm: syz.4.2921 Not tainted syzkaller #0 PREEMPT(full) [ 742.738425][T15656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 742.738438][T15656] Call Trace: [ 742.738452][T15656] [ 742.738462][T15656] dump_stack_lvl+0x189/0x250 [ 742.738491][T15656] ? __pfx____ratelimit+0x10/0x10 [ 742.738522][T15656] ? __pfx_dump_stack_lvl+0x10/0x10 [ 742.738544][T15656] ? __pfx__printk+0x10/0x10 [ 742.738589][T15656] should_fail_ex+0x414/0x560 [ 742.738632][T15656] should_failslab+0xa8/0x100 [ 742.738656][T15656] __kmalloc_cache_noprof+0x6f/0x6e0 [ 742.738686][T15656] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 742.738714][T15656] ? sctp_v6_cmp_addr+0x15/0xd0 [ 742.738740][T15656] ? sctp_add_bind_addr+0x8c/0x370 [ 742.738765][T15656] ? sctp_add_bind_addr+0xb0/0x370 [ 742.738799][T15656] sctp_add_bind_addr+0x8c/0x370 [ 742.738833][T15656] sctp_copy_local_addr_list+0x30b/0x4e0 [ 742.738866][T15656] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 742.738895][T15656] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 742.738919][T15656] ? sctp_association_new+0x1894/0x25c0 [ 742.738945][T15656] ? sctp_v4_is_any+0x35/0x60 [ 742.738972][T15656] ? sctp_copy_one_addr+0x93/0x360 [ 742.739005][T15656] sctp_bind_addr_copy+0xb3/0x3c0 [ 742.739035][T15656] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 742.739066][T15656] sctp_connect_new_asoc+0x2e0/0x690 [ 742.739093][T15656] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 742.739116][T15656] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 742.739138][T15656] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 742.739157][T15656] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 742.739179][T15656] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 742.739201][T15656] ? security_sctp_bind_connect+0x7e/0x2e0 [ 742.739234][T15656] sctp_sendmsg+0x155c/0x2810 [ 742.739290][T15656] ? __pfx_sctp_sendmsg+0x10/0x10 [ 742.739309][T15656] ? aa_sk_perm+0x160/0x920 [ 742.739334][T15656] ? aa_sk_perm+0x7f0/0x920 [ 742.739362][T15656] ? __pfx_aa_sk_perm+0x10/0x10 [ 742.739388][T15656] ? sock_rps_record_flow+0x19/0x410 [ 742.739421][T15656] ? inet_sendmsg+0x2f4/0x370 [ 742.739447][T15656] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 742.739471][T15656] __sock_sendmsg+0x19c/0x270 [ 742.739501][T15656] __sys_sendto+0x3bd/0x520 [ 742.739532][T15656] ? __pfx___sys_sendto+0x10/0x10 [ 742.739556][T15656] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 742.739601][T15656] ? __fget_files+0x3a0/0x420 [ 742.739639][T15656] ? ksys_write+0x22a/0x250 [ 742.739672][T15656] ? __pfx_ksys_write+0x10/0x10 [ 742.739706][T15656] __x64_sys_sendto+0xde/0x100 [ 742.739738][T15656] do_syscall_64+0xfa/0xf80 [ 742.739756][T15656] ? lockdep_hardirqs_on+0x98/0x140 [ 742.739786][T15656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.739807][T15656] ? clear_bhb_loop+0x60/0xb0 [ 742.739834][T15656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.739854][T15656] RIP: 0033:0x7f8f5f98f749 [ 742.739874][T15656] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 742.739892][T15656] RSP: 002b:00007f8f60896038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 742.739916][T15656] RAX: ffffffffffffffda RBX: 00007f8f5fbe5fa0 RCX: 00007f8f5f98f749 [ 742.739932][T15656] RDX: 0000000000000001 RSI: 00002000000004c0 RDI: 0000000000000003 [ 742.739946][T15656] RBP: 00007f8f60896090 R08: 0000200000000140 R09: 000000000000001c [ 742.739959][T15656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 742.739973][T15656] R13: 00007f8f5fbe6038 R14: 00007f8f5fbe5fa0 R15: 00007f8f5fd0fa28 [ 742.740009][T15656] [ 743.128669][T15163] Bluetooth: hci3: command tx timeout [ 743.350996][T13305] usb 4-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=b1.f9 [ 743.360144][T13305] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.369164][T13305] usb 4-1: Product: syz [ 743.373371][T13305] usb 4-1: Manufacturer: syz [ 743.378160][T13305] usb 4-1: SerialNumber: syz [ 743.383271][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 743.392945][T13305] usb 4-1: config 0 descriptor?? [ 743.412426][T13305] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 743.420343][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 743.429182][T13305] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 743.429507][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 743.439577][T13305] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 743.447307][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 743.454475][T13305] usb 4-1: media controller created [ 743.463312][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 743.531312][T15658] fuse: Invalid rootmode [ 743.546470][T13305] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 743.839340][ T5955] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 743.928125][T13305] DVB: Unable to find symbol tda10046_attach() [ 743.954545][T13305] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 743.965255][T13305] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 743.993374][T15671] netlink: 'syz.3.2917': attribute type 5 has an invalid length. [ 744.008020][ T5955] usb 3-1: device descriptor read/64, error -71 [ 744.052887][T15671] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2917'. [ 744.276204][ T5955] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 744.447569][T15663] chnl_net:caif_netlink_parms(): no params data found [ 744.608273][ T5955] usb 3-1: device descriptor read/64, error -71 [ 744.717609][T13305] dvb_usb_m920x 4-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 744.740285][ T5955] usb usb3-port1: attempt power cycle [ 744.790955][T13305] usb 4-1: USB disconnect, device number 48 [ 744.892123][ T5992] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.050184][T15689] bridge0: port 1(veth0_to_bridge) entered blocking state [ 745.067741][T15689] bridge0: port 1(veth0_to_bridge) entered disabled state [ 745.091244][T15689] veth0_to_bridge: entered allmulticast mode [ 745.109143][T15689] veth0_to_bridge: entered promiscuous mode [ 745.119105][ T5955] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 745.171411][ T5955] usb 3-1: device descriptor read/8, error -71 [ 745.222761][ T5992] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.304113][T15663] bridge0: port 1(bridge_slave_0) entered blocking state [ 745.321026][T15663] bridge0: port 1(bridge_slave_0) entered disabled state [ 745.336853][T15663] bridge_slave_0: entered allmulticast mode [ 745.362620][T15663] bridge_slave_0: entered promiscuous mode [ 745.399836][T15663] bridge0: port 2(bridge_slave_1) entered blocking state [ 745.429700][T15663] bridge0: port 2(bridge_slave_1) entered disabled state [ 745.449453][ T5955] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 745.469532][T15663] bridge_slave_1: entered allmulticast mode [ 745.508143][T15663] bridge_slave_1: entered promiscuous mode [ 745.534376][ T5955] usb 3-1: device descriptor read/8, error -71 [ 745.538369][ T52] Bluetooth: hci5: command tx timeout [ 745.630828][ T5992] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.698599][ T5955] usb usb3-port1: unable to enumerate USB device [ 745.909756][T15707] üÿÿÿ: entered promiscuous mode [ 745.930279][T15663] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 746.042489][ T5992] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 746.100882][T15663] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 746.322881][T15723] netlink: zone id is out of range [ 746.328785][T15723] netlink: zone id is out of range [ 746.335069][T15723] netlink: zone id is out of range [ 746.346386][T15723] netlink: zone id is out of range [ 746.351691][T15723] netlink: zone id is out of range [ 746.356855][T15723] netlink: zone id is out of range [ 746.362118][T15723] netlink: zone id is out of range [ 746.367270][T15723] netlink: zone id is out of range [ 746.372495][T15723] netlink: set zone limit has 8 unknown bytes [ 747.132886][T15663] team0: Port device team_slave_0 added [ 747.347516][T15663] team0: Port device team_slave_1 added [ 747.455382][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.462759][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.521168][T15746] netlink: 312 bytes leftover after parsing attributes in process `syz.1.2953'. [ 747.608044][ T52] Bluetooth: hci5: command tx timeout [ 747.649134][T15663] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 747.656144][T15663] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 747.715829][T15663] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 747.781505][T15663] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 747.845575][T15663] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 747.900097][T15663] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 747.940978][T15764] fuse: Invalid rootmode [ 748.200000][T14622] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 748.302317][T15663] hsr_slave_0: entered promiscuous mode [ 748.329309][T15663] hsr_slave_1: entered promiscuous mode [ 748.342505][T15663] debugfs: 'hsr0' already exists in 'hsr' [ 748.348563][T14622] usb 3-1: device descriptor read/64, error -71 [ 748.381016][T15663] Cannot create hsr debugfs directory [ 748.608637][T14622] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 748.625609][T15784] FAULT_INJECTION: forcing a failure. [ 748.625609][T15784] name failslab, interval 1, probability 0, space 0, times 0 [ 748.638917][T15784] CPU: 0 UID: 0 PID: 15784 Comm: syz.1.2965 Not tainted syzkaller #0 PREEMPT(full) [ 748.638947][T15784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 748.638960][T15784] Call Trace: [ 748.638970][T15784] [ 748.638979][T15784] dump_stack_lvl+0x189/0x250 [ 748.639009][T15784] ? __pfx____ratelimit+0x10/0x10 [ 748.639039][T15784] ? __pfx_dump_stack_lvl+0x10/0x10 [ 748.639062][T15784] ? __pfx__printk+0x10/0x10 [ 748.639094][T15784] ? __pfx___might_resched+0x10/0x10 [ 748.639114][T15784] ? fs_reclaim_acquire+0x7d/0x100 [ 748.639138][T15784] should_fail_ex+0x414/0x560 [ 748.639169][T15784] should_failslab+0xa8/0x100 [ 748.639192][T15784] kmem_cache_alloc_node_noprof+0x77/0x700 [ 748.639235][T15784] ? __alloc_skb+0x112/0x2d0 [ 748.639264][T15784] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 748.639291][T15784] __alloc_skb+0x112/0x2d0 [ 748.639323][T15784] pfkey_sendmsg+0x1dd/0x1090 [ 748.639349][T15784] ? do_syscall_64+0xfa/0xf80 [ 748.639366][T15784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.639393][T15784] ? __pfx___might_resched+0x10/0x10 [ 748.639422][T15784] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 748.639451][T15784] ? aa_sk_perm+0x160/0x920 [ 748.639476][T15784] ? aa_sk_perm+0x7f0/0x920 [ 748.639505][T15784] ? __pfx_aa_sk_perm+0x10/0x10 [ 748.639534][T15784] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 748.639568][T15784] ? aa_sock_msg_perm+0xf1/0x1b0 [ 748.639595][T15784] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 748.639617][T15784] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 748.639644][T15784] __sock_sendmsg+0x21c/0x270 [ 748.639673][T15784] ____sys_sendmsg+0x505/0x820 [ 748.639710][T15784] ? __pfx_____sys_sendmsg+0x10/0x10 [ 748.639750][T15784] ? import_iovec+0x74/0xa0 [ 748.639776][T15784] ___sys_sendmsg+0x21f/0x2a0 [ 748.639809][T15784] ? __pfx____sys_sendmsg+0x10/0x10 [ 748.639847][T15784] ? rcu_read_lock_any_held+0xb3/0x120 [ 748.639900][T15784] ? __fget_files+0x2a/0x420 [ 748.639923][T15784] ? __fget_files+0x3a0/0x420 [ 748.639963][T15784] __x64_sys_sendmsg+0x19b/0x260 [ 748.639996][T15784] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 748.640038][T15784] ? __pfx_ksys_write+0x10/0x10 [ 748.640072][T15784] ? do_syscall_64+0xbe/0xf80 [ 748.640096][T15784] do_syscall_64+0xfa/0xf80 [ 748.640117][T15784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.640136][T15784] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 748.640155][T15784] ? clear_bhb_loop+0x60/0xb0 [ 748.640181][T15784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.640202][T15784] RIP: 0033:0x7fc1ff18f749 [ 748.640221][T15784] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 748.640239][T15784] RSP: 002b:00007fc20004a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 748.640263][T15784] RAX: ffffffffffffffda RBX: 00007fc1ff3e5fa0 RCX: 00007fc1ff18f749 [ 748.640279][T15784] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 748.640292][T15784] RBP: 00007fc20004a090 R08: 0000000000000000 R09: 0000000000000000 [ 748.640306][T15784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 748.640319][T15784] R13: 00007fc1ff3e6038 R14: 00007fc1ff3e5fa0 R15: 00007fc1ff50fa28 [ 748.640354][T15784] [ 749.017972][T14622] usb 3-1: device descriptor read/64, error -71 [ 749.128672][T14622] usb usb3-port1: attempt power cycle [ 749.208253][ T5992] team0: left allmulticast mode [ 749.231960][ T5992] team_slave_0: left allmulticast mode [ 749.275340][ T5992] team_slave_1: left allmulticast mode [ 749.288076][ T5992] team0: left promiscuous mode [ 749.316766][ T5992] team_slave_0: left promiscuous mode [ 749.344079][ T5992] team_slave_1: left promiscuous mode [ 749.365210][ T5992] bridge0: port 2(team0) entered disabled state [ 749.379025][T15790] fuse: Invalid rootmode [ 749.398798][ T5992] veth0_to_bridge: left allmulticast mode [ 749.404547][ T5992] veth0_to_bridge: left promiscuous mode [ 749.458137][ T5992] bridge0: port 1(veth0_to_bridge) entered disabled state [ 749.478116][T14622] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 749.498767][T14622] usb 3-1: device descriptor read/8, error -71 [ 749.668037][T14621] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 749.698658][ T52] Bluetooth: hci5: command tx timeout [ 749.738051][T14622] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 749.791806][T14622] usb 3-1: device descriptor read/8, error -71 [ 749.828008][T14621] usb 2-1: device descriptor read/64, error -71 [ 749.908651][T14622] usb usb3-port1: unable to enumerate USB device [ 750.069526][T14621] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 750.207983][T14621] usb 2-1: device descriptor read/64, error -71 [ 750.257700][ T5992] team0: Port device bridge1 removed [ 750.321445][T14621] usb usb2-port1: attempt power cycle [ 750.566126][ T5992] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 750.584209][ T5992] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 750.596337][ T5992] bond0 (unregistering): Released all slaves [ 750.668005][T14621] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 750.706058][T14621] usb 2-1: device descriptor read/8, error -71 [ 750.874081][ T5992] bond1 (unregistering): (slave veth3): Releasing active interface [ 750.882834][ T5992] batadv1: entered promiscuous mode [ 750.897207][ T5992] bond1 (unregistering): (slave batadv1): Releasing active interface [ 750.910334][ T5992] bond1 (unregistering): Released all slaves [ 750.960724][T14621] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 750.991199][T14621] usb 2-1: device descriptor read/8, error -71 [ 751.104166][T14621] usb usb2-port1: unable to enumerate USB device [ 751.116204][ T5992] bond2 (unregistering): (slave veth5): Releasing active interface [ 751.128914][ T5992] bond2 (unregistering): (slave veth7): Releasing active interface [ 751.140347][ T5992] bond2 (unregistering): Released all slaves [ 751.350181][ T5992] tipc: Left network mode [ 751.545297][T15809] netlink: zone id is out of range [ 751.564219][T15809] netlink: zone id is out of range [ 751.579035][T15809] netlink: zone id is out of range [ 751.600794][T15809] netlink: zone id is out of range [ 751.611007][T15809] netlink: zone id is out of range [ 751.618757][T15809] netlink: zone id is out of range [ 751.645960][T15809] netlink: zone id is out of range [ 751.654120][T15809] netlink: zone id is out of range [ 751.670146][T15809] netlink: set zone limit has 8 unknown bytes [ 751.773181][ T52] Bluetooth: hci5: command tx timeout [ 751.916355][T15822] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2974'. [ 752.153386][ T5992] hsr_slave_0: left promiscuous mode [ 752.183420][ T5992] hsr_slave_1: left promiscuous mode [ 752.662635][T15836] fuse: Invalid rootmode [ 752.947976][T13305] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 753.128005][T13305] usb 2-1: device descriptor read/64, error -71 [ 753.378439][T13305] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 753.548075][T13305] usb 2-1: device descriptor read/64, error -71 [ 753.587994][ T6468] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 753.658436][T13305] usb usb2-port1: attempt power cycle [ 753.728197][ T6468] usb 3-1: device descriptor read/64, error -71 [ 754.008065][T13305] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 754.016926][ T6468] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 754.038741][T13305] usb 2-1: device descriptor read/8, error -71 [ 754.172474][ T6468] usb 3-1: device descriptor read/64, error -71 [ 754.247998][ T5955] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 754.308257][ T6468] usb usb3-port1: attempt power cycle [ 754.318157][T13305] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 754.349019][T13305] usb 2-1: device descriptor read/8, error -71 [ 754.443647][ T5955] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 754.471675][ T5955] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 754.483011][T13305] usb usb2-port1: unable to enumerate USB device [ 754.553733][ T5955] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 754.595215][ T5955] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 754.658287][ T5955] usb 4-1: Product: syz [ 754.662545][ T5955] usb 4-1: Manufacturer: syz [ 754.678934][ T6468] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 754.690534][ T5955] usb 4-1: SerialNumber: syz [ 754.735646][ T6468] usb 3-1: device descriptor read/8, error -71 [ 754.749042][ T5955] cdc_mbim 4-1:1.0: skipping garbage [ 754.897372][T15854] netlink: zone id is out of range [ 754.965164][T15846] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 755.018069][ T6468] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 755.069580][ T6468] usb 3-1: device descriptor read/8, error -71 [ 755.091415][ T5992] team0 (unregistering): Port device team_slave_1 removed [ 755.160949][ T5992] team0 (unregistering): Port device team_slave_0 removed [ 755.178745][ T6468] usb usb3-port1: unable to enumerate USB device [ 755.609630][T15846] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 755.619746][ T5955] cdc_mbim 4-1:1.0: dwNtbInMaxSize=159 is too small. Using 2048 [ 755.627480][ T5955] cdc_mbim 4-1:1.0: setting rx_max = 2048 [ 755.679938][ T6468] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 755.852203][ T6468] usb 5-1: Using ep0 maxpacket: 16 [ 755.873268][ T6468] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 755.898062][ T6468] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 755.926617][ T6468] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 755.983698][ T6468] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 756.017896][ T6468] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.035609][ T5955] cdc_mbim 4-1:1.0: setting tx_max = 48 [ 756.046195][ T6468] usb 5-1: Product: syz [ 756.062259][ T6468] usb 5-1: Manufacturer: syz [ 756.067608][ T6468] usb 5-1: SerialNumber: syz [ 756.097248][ T5955] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 756.195406][ T5955] wwan wwan0: port wwan0mbim0 attached [ 756.309665][ T5955] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, c2:b5:08:12:ff:f2 [ 756.410851][ T5955] usb 4-1: USB disconnect, device number 49 [ 756.460019][ T5955] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 756.463096][ T5992] IPVS: stop unused estimator thread 0... [ 756.512474][T15863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 756.534480][T15863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 756.624945][ T6468] usb 5-1: 0:2 : does not exist [ 756.642592][ T5955] wwan wwan0: port wwan0mbim0 disconnected [ 756.656569][ T6468] usb 5-1: 1:0: cannot get min/max values for control 4 (id 1) [ 756.773744][ T6468] usb 5-1: USB disconnect, device number 23 [ 756.827001][T15663] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 756.886465][ T5853] udevd[5853]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 756.954913][T15663] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 757.049774][T15663] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 757.075023][T15663] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 757.261714][T13305] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 757.392706][T15898] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 757.458011][T13305] usb 4-1: Using ep0 maxpacket: 32 [ 757.470535][T13305] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 757.516482][T13305] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 757.535034][T13305] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 757.578391][T13305] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 757.608695][T13305] usb 4-1: config 0 descriptor?? [ 757.754885][T15663] 8021q: adding VLAN 0 to HW filter on device bond0 [ 757.882424][T15663] 8021q: adding VLAN 0 to HW filter on device team0 [ 757.936609][T11846] bridge0: port 1(bridge_slave_0) entered blocking state [ 757.943991][T11846] bridge0: port 1(bridge_slave_0) entered forwarding state [ 758.002576][T11846] bridge0: port 2(bridge_slave_1) entered blocking state [ 758.009879][T11846] bridge0: port 2(bridge_slave_1) entered forwarding state [ 758.087379][T13305] savu 0003:1E7D:2D5A.0025: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 758.293956][T15883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 758.337613][T15663] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 758.457303][T15883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 758.493503][T13305] usb 4-1: USB disconnect, device number 50 [ 758.731499][T15663] veth0_vlan: entered promiscuous mode [ 758.752473][T15663] veth1_vlan: entered promiscuous mode [ 758.811126][T15663] veth0_macvtap: entered promiscuous mode [ 758.847643][T15663] veth1_macvtap: entered promiscuous mode [ 758.952353][T15663] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 758.988719][T15663] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 759.015812][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.029808][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.053809][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.116819][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.277262][ T3855] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 759.315060][ T3855] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 759.449879][ T5983] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 759.480985][ T5983] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 761.214596][T14618] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 761.278034][T14619] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 761.368917][T13307] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 761.388352][T14618] usb 5-1: Using ep0 maxpacket: 32 [ 761.403674][T14618] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 761.432336][T14618] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 761.445233][T14618] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 761.455805][T14619] usb 2-1: Using ep0 maxpacket: 16 [ 761.462598][T14618] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.473696][T14619] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 761.487276][T14618] usb 5-1: config 0 descriptor?? [ 761.496339][T14619] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 761.515366][T14619] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 761.534969][T14619] usb 2-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 761.555144][T13307] usb 1-1: New USB device found, idVendor=0c72, idProduct=0012, bcdDevice=22.96 [ 761.567940][T14619] usb 2-1: config 7 interface 0 has no altsetting 0 [ 761.574675][T13307] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.584697][T14619] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 761.595409][T13307] usb 1-1: Product: syz [ 761.600151][T14619] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.608858][T13307] usb 1-1: Manufacturer: syz [ 761.613601][T13307] usb 1-1: SerialNumber: syz [ 761.650922][T13307] usb 1-1: config 0 descriptor?? [ 761.688723][T14621] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 761.873448][T14621] usb 4-1: New USB device found, idVendor=1645, idProduct=0008, bcdDevice=cf.36 [ 761.898094][T13307] peak_usb 1-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 761.918055][T14621] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.930441][T13307] peak_usb 1-1:0.0: unable to read PCAN-USB FD firmware info (err -71) [ 761.958481][T14621] usb 4-1: config 0 descriptor?? [ 761.990101][T14618] savu 0003:1E7D:2D5A.0026: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.4-1/input0 [ 762.059886][T13307] peak_usb 1-1:0.0: probe with driver peak_usb failed with error -71 [ 762.079548][T14619] usbhid 2-1:7.0: can't add hid device: -71 [ 762.085741][T14619] usbhid 2-1:7.0: probe with driver usbhid failed with error -71 [ 762.108701][T13307] usb 1-1: USB disconnect, device number 2 [ 762.138229][T14619] usb 2-1: USB disconnect, device number 21 [ 762.220563][T15966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.235065][T14621] kaweth 4-1:0.0: Firmware present in device. [ 762.277108][T15966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.303890][T14615] usb 5-1: USB disconnect, device number 24 [ 762.390807][T14621] kaweth 4-1:0.0: Statistics collection: 0 [ 762.406918][T14621] kaweth 4-1:0.0: Multicast filter limit: 0 [ 762.427206][T14621] kaweth 4-1:0.0: MTU: 0 [ 762.432192][T14621] kaweth 4-1:0.0: Read MAC address 00:00:00:00:00:00 [ 762.659852][T15980] kvm: user requested TSC rate below hardware speed [ 762.690181][T15980] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2182154216 (4364308432 ns) > initial count (507749598 ns). Using initial count to start timer. [ 763.093708][T14621] kaweth 4-1:0.0: probe with driver kaweth failed with error -5 [ 763.154533][T14621] usb 4-1: USB disconnect, device number 51 [ 763.277987][T13305] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 763.444622][T13305] usb 2-1: config index 0 descriptor too short (expected 10126, got 142) [ 763.467493][T13305] usb 2-1: config 60 has too many interfaces: 165, using maximum allowed: 32 [ 763.514624][T13305] usb 2-1: config 60 has an invalid descriptor of length 0, skipping remainder of the config [ 763.556005][T13305] usb 2-1: config 60 has 0 interfaces, different from the descriptor's value: 165 [ 763.601546][T13305] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 763.668408][T13305] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.696730][T13305] usb 2-1: Product: syz [ 763.708057][T13305] usb 2-1: Manufacturer: syz [ 763.712811][T13305] usb 2-1: SerialNumber: syz [ 763.948094][T14621] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 764.194150][T14621] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 764.252915][T14621] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 764.284621][T14621] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.319309][T14615] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 764.342507][T14621] usb 1-1: Product: syz [ 764.346770][T14621] usb 1-1: Manufacturer: syz [ 764.386703][T14621] usb 1-1: SerialNumber: syz [ 764.421273][T14621] usb 1-1: config 0 descriptor?? [ 764.548311][T13305] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 764.597977][T14622] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 764.717796][T13305] usb 4-1: config 0 has an invalid interface number: 190 but max is 0 [ 764.744010][T13305] usb 4-1: config 0 has no interface number 0 [ 764.778057][T14622] usb 5-1: Using ep0 maxpacket: 8 [ 764.785354][T13305] usb 4-1: New USB device found, idVendor=05ac, idProduct=0253, bcdDevice=71.eb [ 764.802053][T13305] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.809658][T14622] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 764.815453][T13305] usb 4-1: Product: syz [ 764.826362][T13305] usb 4-1: Manufacturer: syz [ 764.876178][T14622] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 764.885617][T13305] usb 4-1: SerialNumber: syz [ 764.919944][T14622] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 764.943035][T14622] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 764.955866][T13305] usb 4-1: config 0 descriptor?? [ 764.985269][T14622] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 765.010787][T14622] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 765.043583][T13305] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.190/input/input39 [ 765.237120][T16036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 765.268793][T16036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 765.308453][T14622] usb 5-1: GET_CAPABILITIES returned 0 [ 765.326002][ T5192] bcm5974 4-1:0.190: could not read from device [ 765.363773][T14622] usbtmc 5-1:16.0: can't read capabilities [ 765.379936][ T5192] bcm5974 4-1:0.190: could not read from device [ 765.398504][T13305] usb 4-1: USB disconnect, device number 52 [ 765.571228][T14622] usb 5-1: USB disconnect, device number 25 [ 765.766901][T13305] usb 2-1: USB disconnect, device number 22 [ 766.063605][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 766.063625][ T30] audit: type=1326 audit(1764706506.194:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16037 comm="syz.1.3023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc1ff18f749 code=0x7ffc0000 [ 766.093695][T16038] FAULT_INJECTION: forcing a failure. [ 766.093695][T16038] name failslab, interval 1, probability 0, space 0, times 0 [ 766.139614][T16038] CPU: 1 UID: 0 PID: 16038 Comm: syz.1.3023 Not tainted syzkaller #0 PREEMPT(full) [ 766.139647][T16038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 766.139659][T16038] Call Trace: [ 766.139668][T16038] [ 766.139678][T16038] dump_stack_lvl+0x189/0x250 [ 766.139708][T16038] ? __pfx____ratelimit+0x10/0x10 [ 766.139738][T16038] ? __pfx_dump_stack_lvl+0x10/0x10 [ 766.139760][T16038] ? __pfx__printk+0x10/0x10 [ 766.139783][T16038] ? vsnprintf+0x386/0xee0 [ 766.139809][T16038] ? __pfx_snprintf+0x10/0x10 [ 766.139839][T16038] should_fail_ex+0x414/0x560 [ 766.139869][T16038] should_failslab+0xa8/0x100 [ 766.139893][T16038] __kmalloc_noprof+0xcb/0x7e0 [ 766.139921][T16038] ? aa_label_asxprint+0x70/0x130 [ 766.139947][T16038] aa_label_asxprint+0x70/0x130 [ 766.139969][T16038] apparmor_lsmprop_to_secctx+0x9d/0x170 [ 766.139998][T16038] audit_log_subj_ctx+0xfa/0x510 [ 766.140028][T16038] ? __pfx_audit_log_subj_ctx+0x10/0x10 [ 766.140064][T16038] ? apparmor_current_getlsmprop_subj+0xdd/0x180 [ 766.140105][T16038] audit_log_task_context+0x8c/0xd0 [ 766.140132][T16038] ? __pfx_audit_log_task_context+0x10/0x10 [ 766.140161][T16038] ? audit_log_start+0x7f4/0xa20 [ 766.140194][T16038] audit_log_task+0x190/0x3c0 [ 766.140218][T16038] ? get_pid_task+0x20/0x1f0 [ 766.140243][T16038] ? __pfx_audit_log_task+0x10/0x10 [ 766.140269][T16038] ? __pfx___cant_migrate+0x10/0x10 [ 766.140298][T16038] audit_seccomp+0x86/0x190 [ 766.140327][T16038] __seccomp_filter+0xce4/0x1e10 [ 766.140362][T16038] ? ksys_write+0x1cb/0x250 [ 766.140389][T16038] ? __pfx___seccomp_filter+0x10/0x10 [ 766.140414][T16038] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 766.140427][T16038] ? __pfx_vfs_write+0x10/0x10 [ 766.140446][T16038] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 766.140460][T16038] ? __fget_files+0x3a0/0x420 [ 766.140491][T16038] ? ksys_write+0x22a/0x250 [ 766.140524][T16038] ? __secure_computing+0xe2/0x2a0 [ 766.140551][T16038] syscall_trace_enter+0xaa/0x160 [ 766.140580][T16038] do_syscall_64+0xd3/0xf80 [ 766.140591][T16038] ? lockdep_hardirqs_on+0x98/0x140 [ 766.140608][T16038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.140621][T16038] ? clear_bhb_loop+0x60/0xb0 [ 766.140641][T16038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.140662][T16038] RIP: 0033:0x7fc1ff18f749 [ 766.140682][T16038] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 766.140700][T16038] RSP: 002b:00007fc20004a038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f3 [ 766.140723][T16038] RAX: ffffffffffffffda RBX: 00007fc1ff3e5fa0 RCX: 00007fc1ff18f749 [ 766.140735][T16038] RDX: 000000000000009a RSI: 0000200000000140 RDI: 0000000000000003 [ 766.140743][T16038] RBP: 00007fc20004a090 R08: 0000000000000000 R09: 0000000000000000 [ 766.140752][T16038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 766.140759][T16038] R13: 00007fc1ff3e6038 R14: 00007fc1ff3e5fa0 R15: 00007fc1ff50fa28 [ 766.140779][T16038] [ 766.140789][T16038] audit: error in audit_log_subj_ctx [ 766.386827][ C1] vkms_vblank_simulate: vblank timer overrun [ 766.468232][ T30] audit: type=1326 audit(1764706506.224:500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16037 comm="syz.1.3023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc1ff18df90 code=0x7ffc0000 [ 766.490598][ C1] vkms_vblank_simulate: vblank timer overrun [ 766.512477][ T30] audit: type=1326 audit(1764706506.224:501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16037 comm="syz.1.3023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fc1ff18e1ff code=0x7ffc0000 [ 766.922520][ T30] audit: type=1326 audit(1764706506.224:502): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=16037 comm="syz.1.3023" exe="/root/syz-executor" sig=0 arch=c000003e syscall=243 compat=0 ip=0x7fc1ff18f749 code=0x7ffc0000 [ 767.148210][T14622] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 767.338474][T14622] usb 4-1: Using ep0 maxpacket: 32 [ 767.349797][T14622] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 767.375913][T14621] usb 1-1: USB disconnect, device number 3 [ 767.415339][T14622] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 767.474523][T14622] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 767.517071][T16052] net_ratelimit: 8 callbacks suppressed [ 767.517094][T16052] netlink: zone id is out of range [ 767.523964][T14622] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 767.551617][T16052] netlink: zone id is out of range [ 767.564338][T16052] netlink: zone id is out of range [ 767.586614][T16052] netlink: zone id is out of range [ 767.605230][T16052] netlink: zone id is out of range [ 767.609461][T14622] usb 4-1: config 0 descriptor?? [ 767.628044][T16052] netlink: zone id is out of range [ 767.649831][T16052] netlink: zone id is out of range [ 767.668610][T16052] netlink: zone id is out of range [ 767.686851][T16052] netlink: set zone limit has 8 unknown bytes [ 767.982778][T16064] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3032'. [ 768.225025][T14622] savu 0003:1E7D:2D5A.0027: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 768.386627][T16041] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 768.405021][T16041] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 768.435397][T14622] usb 4-1: USB disconnect, device number 53 [ 769.048492][T16091] netlink: 256 bytes leftover after parsing attributes in process `syz.4.3034'. [ 769.058385][T16091] unsupported nlmsg_type 40 [ 769.111319][T16091] syz_tun: entered allmulticast mode [ 769.160663][T16096] FAULT_INJECTION: forcing a failure. [ 769.160663][T16096] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 769.187882][T16096] CPU: 0 UID: 0 PID: 16096 Comm: syz.3.3037 Not tainted syzkaller #0 PREEMPT(full) [ 769.187913][T16096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 769.187925][T16096] Call Trace: [ 769.187935][T16096] [ 769.187945][T16096] dump_stack_lvl+0x189/0x250 [ 769.187971][T16096] ? __pfx____ratelimit+0x10/0x10 [ 769.188001][T16096] ? __pfx_dump_stack_lvl+0x10/0x10 [ 769.188023][T16096] ? __pfx__printk+0x10/0x10 [ 769.188049][T16096] ? __might_fault+0xb0/0x130 [ 769.188074][T16096] should_fail_ex+0x414/0x560 [ 769.188094][T16096] _copy_from_user+0x2d/0xb0 [ 769.188107][T16096] ___sys_sendmsg+0x158/0x2a0 [ 769.188130][T16096] ? __pfx____sys_sendmsg+0x10/0x10 [ 769.188151][T16096] ? rcu_read_lock_any_held+0xb3/0x120 [ 769.188182][T16096] ? __fget_files+0x2a/0x420 [ 769.188195][T16096] ? __fget_files+0x3a0/0x420 [ 769.188215][T16096] __x64_sys_sendmsg+0x19b/0x260 [ 769.188234][T16096] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 769.188258][T16096] ? __pfx_ksys_write+0x10/0x10 [ 769.188277][T16096] ? do_syscall_64+0xbe/0xf80 [ 769.188291][T16096] do_syscall_64+0xfa/0xf80 [ 769.188301][T16096] ? lockdep_hardirqs_on+0x98/0x140 [ 769.188318][T16096] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.188331][T16096] ? clear_bhb_loop+0x60/0xb0 [ 769.188345][T16096] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.188357][T16096] RIP: 0033:0x7f7d9378f749 [ 769.188378][T16096] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 769.188389][T16096] RSP: 002b:00007f7d945aa038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 769.188404][T16096] RAX: ffffffffffffffda RBX: 00007f7d939e5fa0 RCX: 00007f7d9378f749 [ 769.188414][T16096] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 769.188422][T16096] RBP: 00007f7d945aa090 R08: 0000000000000000 R09: 0000000000000000 [ 769.188430][T16096] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 769.188437][T16096] R13: 00007f7d939e6038 R14: 00007f7d939e5fa0 R15: 00007f7d93b0fa28 [ 769.188456][T16096] [ 769.403672][ C0] vkms_vblank_simulate: vblank timer overrun [ 769.468541][T16087] syz_tun: left allmulticast mode [ 769.557943][T14622] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 769.646520][T16104] FAULT_INJECTION: forcing a failure. [ 769.646520][T16104] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 769.669680][T16107] netlink: zone id is out of range [ 769.721315][T14622] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 769.731166][T14622] usb 3-1: config 1 has an invalid descriptor of length 252, skipping remainder of the config [ 769.734401][T16104] CPU: 1 UID: 0 PID: 16104 Comm: syz.3.3040 Not tainted syzkaller #0 PREEMPT(full) [ 769.734427][T16104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 769.734440][T16104] Call Trace: [ 769.734448][T16104] [ 769.734457][T16104] dump_stack_lvl+0x189/0x250 [ 769.734485][T16104] ? __pfx____ratelimit+0x10/0x10 [ 769.734512][T16104] ? __pfx_dump_stack_lvl+0x10/0x10 [ 769.734533][T16104] ? __pfx__printk+0x10/0x10 [ 769.734571][T16104] should_fail_ex+0x414/0x560 [ 769.734601][T16104] __kvm_read_guest_page+0x18d/0x240 [ 769.734628][T16104] kvm_fetch_guest_virt+0x12b/0x170 [ 769.734649][T16104] ? __pfx_kvm_fetch_guest_virt+0x10/0x10 [ 769.734668][T16104] __do_insn_fetch_bytes+0x2fc/0x6d0 [ 769.734699][T16104] ? __pfx___do_insn_fetch_bytes+0x10/0x10 [ 769.734727][T16104] ? kvm_mmu_max_mapping_level+0x84d/0xb30 [ 769.734755][T16104] ? x86_decode_insn+0x1276/0x53d0 [ 769.734783][T16104] x86_decode_insn+0x386/0x53d0 [ 769.734804][T16104] ? kvm_is_mmio_pfn+0x169/0x730 [ 769.734858][T16104] ? __pfx_x86_decode_insn+0x10/0x10 [ 769.734881][T16104] ? kvm_tdp_mmu_map+0x2f8/0x1cf0 [ 769.734914][T16104] ? __asan_memset+0x22/0x50 [ 769.734941][T16104] ? init_decode_cache+0x78/0x90 [ 769.734965][T16104] ? init_emulate_ctxt+0x4d6/0x660 [ 769.734989][T16104] ? __pfx_init_emulate_ctxt+0x10/0x10 [ 769.735014][T16104] ? trace_rcu_utilization+0x47/0x1c0 [ 769.735040][T16104] x86_emulate_instruction+0x61b/0x1f90 [ 769.735079][T16104] ? _raw_read_unlock+0x28/0x50 [ 769.735105][T16104] ? __pfx_x86_emulate_instruction+0x10/0x10 [ 769.735124][T16104] ? __get_current_cr3_fast+0x90/0x150 [ 769.735148][T16104] ? clear_bhb_loop+0x60/0xb0 [ 769.735166][T16104] ? clear_bhb_loop+0x60/0xb0 [ 769.735185][T16104] ? vmx_vcpu_run+0xe72/0x2b20 [ 769.735211][T16104] ? __vmx_complete_interrupts+0xe7/0x690 [ 769.735251][T16104] handle_ud+0x142/0x590 [ 769.735274][T16104] ? __pfx_handle_ud+0x10/0x10 [ 769.735290][T16104] ? vmx_handle_exit_irqoff+0x5a6/0x910 [ 769.735324][T16104] ? __pfx_current_save_fsgs+0x10/0x10 [ 769.735359][T16104] ? __pfx_handle_exception_nmi+0x10/0x10 [ 769.735379][T16104] vmx_handle_exit+0x10a4/0x18c0 [ 769.735408][T16104] ? vcpu_run+0x35db/0x6f80 [ 769.735451][T16104] vcpu_run+0x4335/0x6f80 [ 769.735489][T16104] ? vcpu_run+0x35db/0x6f80 [ 769.735568][T16104] ? __pfx_vcpu_run+0x10/0x10 [ 769.735599][T16104] ? kvm_arch_vcpu_ioctl_run+0x285/0x1c90 [ 769.735630][T16104] ? rcu_is_watching+0x15/0xb0 [ 769.735654][T16104] kvm_arch_vcpu_ioctl_run+0x1148/0x1c90 [ 769.735694][T16104] ? kvm_arch_vcpu_ioctl_run+0x285/0x1c90 [ 769.735717][T16104] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 769.735743][T16104] ? rcu_is_watching+0x15/0xb0 [ 769.735762][T16104] ? trace_contention_end+0x39/0x100 [ 769.735785][T16104] ? __mutex_lock+0x335/0x1350 [ 769.735812][T16104] ? kasan_quarantine_put+0xdd/0x220 [ 769.735838][T16104] ? lockdep_hardirqs_on+0x98/0x140 [ 769.735864][T16104] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 769.735890][T16104] ? __pfx___mutex_lock+0x10/0x10 [ 769.735909][T16104] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 769.735934][T16104] ? do_vfs_ioctl+0xbe8/0x1430 [ 769.735958][T16104] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 769.735978][T16104] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 769.736008][T16104] kvm_vcpu_ioctl+0x95c/0xe90 [ 769.736036][T16104] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 769.736058][T16104] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 769.736096][T16104] ? __fget_files+0x2a/0x420 [ 769.736121][T16104] ? __fget_files+0x3a0/0x420 [ 769.736140][T16104] ? __fget_files+0x2a/0x420 [ 769.736165][T16104] ? bpf_lsm_file_ioctl+0x9/0x20 [ 769.736187][T16104] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 769.736208][T16104] __se_sys_ioctl+0xfc/0x170 [ 769.736237][T16104] do_syscall_64+0xfa/0xf80 [ 769.736253][T16104] ? lockdep_hardirqs_on+0x98/0x140 [ 769.736279][T16104] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.736297][T16104] ? clear_bhb_loop+0x60/0xb0 [ 769.736328][T16104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.736346][T16104] RIP: 0033:0x7f7d9378f749 [ 769.736364][T16104] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 769.736380][T16104] RSP: 002b:00007f7d945aa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 769.736402][T16104] RAX: ffffffffffffffda RBX: 00007f7d939e5fa0 RCX: 00007f7d9378f749 [ 769.736416][T16104] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 769.736428][T16104] RBP: 00007f7d945aa090 R08: 0000000000000000 R09: 0000000000000000 [ 769.736440][T16104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 769.736451][T16104] R13: 00007f7d939e6038 R14: 00007f7d939e5fa0 R15: 00007f7d93b0fa28 [ 769.736484][T16104] [ 770.235952][T14622] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 770.245009][T14622] usb 3-1: config 1 has no interface number 1 [ 770.251220][T14622] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 770.277070][T14622] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 770.289801][T14622] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 770.302765][T14622] usb 3-1: Product: syz [ 770.302891][T16115] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 770.313586][T16115] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 770.335838][T14622] usb 3-1: Manufacturer: syz [ 770.345486][T14622] usb 3-1: SerialNumber: syz [ 770.374327][T16115] vhci_hcd vhci_hcd.0: Device attached [ 770.394166][T16117] vhci_hcd: connection closed [ 770.398712][T11612] vhci_hcd: stop threads [ 770.419749][T11612] vhci_hcd: release socket [ 770.424232][T11612] vhci_hcd: disconnect device [ 770.717457][T13184] [ 770.719830][T13184] ============================================ [ 770.725981][T13184] WARNING: possible recursive locking detected [ 770.732134][T13184] syzkaller #0 Not tainted [ 770.736647][T13184] -------------------------------------------- [ 770.742886][T13184] kworker/u8:13/13184 is trying to acquire lock: [ 770.749204][T13184] ffffe8ffffd70e50 (&pd_list->lock){+...}-{3:3}, at: padata_do_serial+0x707/0xb80 [ 770.758424][T13184] [ 770.758424][T13184] but task is already holding lock: [ 770.765888][T13184] ffffe8ffffdb7028 (&pd_list->lock){+...}-{3:3}, at: padata_do_serial+0x590/0xb80 [ 770.775182][T13184] [ 770.775182][T13184] other info that might help us debug this: [ 770.783326][T13184] Possible unsafe locking scenario: [ 770.783326][T13184] [ 770.790877][T13184] CPU0 [ 770.794152][T13184] ---- [ 770.797435][T13184] lock(&pd_list->lock); [ 770.801765][T13184] lock(&pd_list->lock); [ 770.806107][T13184] [ 770.806107][T13184] *** DEADLOCK *** [ 770.806107][T13184] [ 770.814331][T13184] May be due to missing lock nesting notation [ 770.814331][T13184] [ 770.822646][T13184] 3 locks held by kworker/u8:13/13184: [ 770.828100][T13184] #0: ffff888142e90948 ((wq_completion)pencrypt_parallel){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 770.840122][T13184] #1: ffffc9000cf67b80 ((work_completion)(&pw->pw_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 770.851950][T13184] #2: ffffe8ffffdb7028 (&pd_list->lock){+...}-{3:3}, at: padata_do_serial+0x590/0xb80 [ 770.861618][T13184] [ 770.861618][T13184] stack backtrace: [ 770.867502][T13184] CPU: 0 UID: 0 PID: 13184 Comm: kworker/u8:13 Not tainted syzkaller #0 PREEMPT(full) [ 770.867518][T13184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 770.867528][T13184] Workqueue: pencrypt_parallel padata_parallel_worker [ 770.867547][T13184] Call Trace: [ 770.867555][T13184] [ 770.867561][T13184] dump_stack_lvl+0x189/0x250 [ 770.867576][T13184] ? __pfx_dump_stack_lvl+0x10/0x10 [ 770.867589][T13184] ? __pfx__printk+0x10/0x10 [ 770.867604][T13184] ? print_lock_name+0xde/0x100 [ 770.867619][T13184] print_deadlock_bug+0x279/0x290 [ 770.867633][T13184] __lock_acquire+0x2540/0x2cf0 [ 770.867653][T13184] ? queue_work_on+0x1ed/0x270 [ 770.867664][T13184] ? queue_work_on+0x1f7/0x270 [ 770.867676][T13184] ? padata_do_serial+0x707/0xb80 [ 770.867690][T13184] lock_acquire+0x117/0x340 [ 770.867705][T13184] ? padata_do_serial+0x707/0xb80 [ 770.867723][T13184] _raw_spin_lock+0x2e/0x40 [ 770.867739][T13184] ? padata_do_serial+0x707/0xb80 [ 770.867753][T13184] padata_do_serial+0x707/0xb80 [ 770.867770][T13184] ? padata_parallel_worker+0x44/0x1d0 [ 770.867784][T13184] padata_parallel_worker+0x75/0x1d0 [ 770.867798][T13184] ? process_scheduled_works+0x9ef/0x1770 [ 770.867823][T13184] process_scheduled_works+0xad1/0x1770 [ 770.867860][T13184] ? __pfx_process_scheduled_works+0x10/0x10 [ 770.867889][T13184] worker_thread+0x8a0/0xda0 [ 770.867904][T13184] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 770.867928][T13184] ? __kthread_parkme+0x7b/0x200 [ 770.867945][T13184] kthread+0x711/0x8a0 [ 770.867963][T13184] ? __pfx_worker_thread+0x10/0x10 [ 770.867977][T13184] ? __pfx_kthread+0x10/0x10 [ 770.867994][T13184] ? _raw_spin_unlock_irq+0x23/0x50 [ 770.868015][T13184] ? lockdep_hardirqs_on+0x98/0x140 [ 770.868036][T13184] ? __pfx_kthread+0x10/0x10 [ 770.868053][T13184] ret_from_fork+0x52d/0xa60 [ 770.868075][T13184] ? __pfx_ret_from_fork+0x10/0x10 [ 770.868099][T13184] ? __switch_to_asm+0x39/0x70 [ 770.868116][T13184] ? __switch_to_asm+0x33/0x70 [ 770.868139][T13184] ? __pfx_kthread+0x10/0x10 [ 770.868156][T13184] ret_from_fork_asm+0x1a/0x30 [ 770.868179][T13184] [ 771.073035][ C0] vkms_vblank_simulate: vblank timer overrun SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 771.307901][ T5955] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 772.017219][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 772.053412][T14622] usb 3-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 772.063349][T14622] usb 3-1: MIDIStreaming interface descriptor not found [ 772.157446][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 772.170002][T14622] usb 3-1: USB disconnect, device number 24 [ 772.219213][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 772.350766][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 772.504797][ T12] bridge_slave_1: left allmulticast mode [ 772.511548][ T12] bridge_slave_1: left promiscuous mode [ 772.517525][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.528792][ T12] bridge_slave_0: left allmulticast mode [ 772.538066][ T12] bridge_slave_0: left promiscuous mode [ 772.543850][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.934248][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 772.944298][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 772.954766][ T12] bond0 (unregistering): Released all slaves [ 773.191403][ T12] hsr_slave_0: left promiscuous mode [ 773.197357][ T12] hsr_slave_1: left promiscuous mode [ 773.205199][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 773.215906][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 773.224352][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 773.232456][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 773.244375][ T12] veth1_macvtap: left promiscuous mode [ 773.250593][ T12] veth0_macvtap: left promiscuous mode [ 773.256184][ T12] veth1_vlan: left promiscuous mode [ 773.262237][ T12] veth0_vlan: left promiscuous mode [ 773.366092][ T12] team0 (unregistering): Port device team_slave_1 removed [ 773.396712][ T12] team0 (unregistering): Port device team_slave_0 removed [ 773.766047][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.812704][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.877574][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.941138][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.059443][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.115570][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.177157][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.245971][ T12] bond0: (slave netdevsim0): Releasing backup interface [ 774.257193][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.369738][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.398831][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.499161][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.550006][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.687562][ T12] bridge_slave_1: left allmulticast mode [ 774.693592][ T12] bridge_slave_1: left promiscuous mode [ 774.701532][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 774.710259][ T12] bridge_slave_0: left allmulticast mode [ 774.715925][ T12] bridge_slave_0: left promiscuous mode [ 774.721887][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 774.731277][ T12] bridge_slave_1: left allmulticast mode [ 774.736942][ T12] bridge_slave_1: left promiscuous mode [ 774.742837][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 774.752288][ T12] bridge_slave_0: left allmulticast mode [ 774.757985][ T12] bridge_slave_0: left promiscuous mode [ 774.763761][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 774.774104][ T12] bridge_slave_1: left allmulticast mode [ 774.780178][ T12] bridge_slave_1: left promiscuous mode [ 774.785805][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 774.794211][ T12] bridge_slave_0: left allmulticast mode [ 774.799932][ T12] bridge_slave_0: left promiscuous mode [ 774.805897][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 774.932863][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 774.943364][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 774.953018][ T12] bond0 (unregistering): Released all slaves [ 775.213601][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 775.224902][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 775.234372][ T12] bond0 (unregistering): Released all slaves [ 775.246287][ T12] bond1 (unregistering): (slave veth3): Releasing active interface [ 775.254710][ T12] batadv1: entered promiscuous mode [ 775.261477][ T12] bond1 (unregistering): (slave batadv1): Releasing active interface [ 775.270674][ T12] bond1 (unregistering): Released all slaves [ 775.280062][ T12] bond2 (unregistering): Released all slaves [ 775.290863][ T12] bond3 (unregistering): (slave lo): Releasing backup interface [ 775.303498][ T12] bond3 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 775.316118][ T12] bond3 (unregistering): Released all slaves [ 775.425066][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 775.434934][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 775.445061][ T12] bond0 (unregistering): Released all slaves [ 776.081583][ T12] hsr_slave_0: left promiscuous mode [ 776.087764][ T12] hsr_slave_1: left promiscuous mode [ 776.095496][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 776.103038][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 776.113284][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 776.120818][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 776.131756][ T12] dummy0: left promiscuous mode [ 776.137287][ T12] team0: left promiscuous mode [ 776.147972][ T12] team_slave_0: left promiscuous mode [ 776.158215][ T12] team_slave_1: left promiscuous mode [ 776.163669][ T12] batadv0: left promiscuous mode [ 776.168829][ T12] batadv2: left promiscuous mode [ 776.183288][ T12] hsr_slave_0: left promiscuous mode [ 776.189139][ T12] hsr_slave_1: left promiscuous mode [ 776.197004][ T12] hsr_slave_0: left promiscuous mode [ 776.202922][ T12] hsr_slave_1: left promiscuous mode [ 776.208815][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 776.216268][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 776.224080][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 776.231929][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 776.245176][ T12] veth1_macvtap: left promiscuous mode [ 776.250981][ T12] veth0_macvtap: left promiscuous mode [ 776.256608][ T12] veth1_vlan: left promiscuous mode [ 776.262277][ T12] veth0_vlan: left promiscuous mode [ 776.268595][ T12] veth1_macvtap: left promiscuous mode [ 776.274162][ T12] veth0_macvtap: left promiscuous mode [ 776.280556][ T12] veth1_macvtap: left promiscuous mode [ 776.286032][ T12] veth0_macvtap: left promiscuous mode [ 776.291713][ T12] veth1_vlan: left promiscuous mode [ 776.296966][ T12] veth0_vlan: left promiscuous mode [ 776.515917][ T12] team0 (unregistering): Port device team_slave_1 removed [ 776.543339][ T12] team0 (unregistering): Port device team_slave_0 removed [ 776.626450][ T12] team0 (unregistering): Port device batadv2 removed [ 776.641301][ T12] team0 (unregistering): Port device batadv0 removed [ 776.650670][ T12] pim6reg (unregistering): left allmulticast mode [ 776.761732][ T12] team0 (unregistering): Port device team_slave_1 removed [ 776.791618][ T12] team0 (unregistering): Port device team_slave_0 removed [ 777.114797][ T12] team0 (unregistering): Port device team_slave_1 removed [ 777.141482][ T12] team0 (unregistering): Port device team_slave_0 removed [ 778.057419][ T12] IPVS: stop unused estimator thread 0...