last executing test programs: 11.869003684s ago: executing program 0 (id=1089): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/power/pm_test', 0x301400, 0x4e) syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x7a}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x8, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "8a95"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x114}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x7c, 0x2, 0x6, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x204, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0xe, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x0, 0x8, 0x3fe, 0x7d, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc5, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x804e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0xfffffffe, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x5, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x0, 0x3, 0x7ff, 0x12b, 0xb, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x802006, 0x80a2f0, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x9, 0x57, 0x4, 0x3, 0x2, 0x10000, 0x4, 0x5fff, 0x10002, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x0, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d613, 0xa1f, 0xf42, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x10, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r4, 0x4, 0x40800) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x64}]}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xbc}}, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r6, 0x2000009) sendfile(r4, r6, 0x0, 0x7ffff004) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4004ae52, &(0x7f00000000c0)=0x2) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xe0f02, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000400)=0x2) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) ioctl$PPPIOCSMAXCID(r7, 0x40047451, &(0x7f0000000200)=0x98) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYRES8=r7, @ANYRES16=r8, @ANYBLOB="010000000000000000000f0000001c0007800c000400002e0000000000000c0003002d"], 0x30}, 0x1, 0x0, 0x0, 0xc091}, 0x4004014) 11.098233557s ago: executing program 0 (id=1091): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)={0x50, r2, 0x7, 0x0, 0x40000, {}, [@ETHTOOL_A_LINKMODES_OURS={0x1c, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x8, 0x4, '\x00\x00\x00\x00'}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x20}, @ETHTOOL_A_BITSET_MASK={0x8, 0x5, "7180bbda"}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) r3 = add_key(0x0, &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0xfffffffffffffedd, 0xfffffffffffffffa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioprio_set$pid(0x3, 0x0, 0x4007) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x40005, 0x2) keyctl$search(0xa, 0x0, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)={'syz', 0x1}, r3) socket$inet6(0xa, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={0x0, 0x190}}, 0x400c4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) setpriority(0x2, 0x0, 0x6) socket$inet6_sctp(0xa, 0x1, 0x84) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) 10.997458437s ago: executing program 3 (id=1092): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x4000) r1 = socket$kcm(0x29, 0x5, 0x0) sendmmsg$inet(r1, &(0x7f0000001800)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x56}}], 0x2, 0x20008081) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') lseek(r2, 0x1000000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r4, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0xfffffffffffffca0}, 0x42) ioctl$TUNSETNOCSUM(r5, 0xff03, 0x110c230102) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r6 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = dup(r11) syz_ublk_setup_queues(r12, r10, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x2, 0x255, 0x0, r12}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x1, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8280, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x51, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bind$inet(r12, &(0x7f00000000c0)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) r13 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r13, r14, r15, r16, &(0x7f0000000200)={0x2e, 0x56, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x4, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) r17 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r17, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'ip6gretap0\x00', 0x4}, 0x18) setsockopt$IP_VS_SO_SET_STOPDAEMON(r17, 0x0, 0x48c, &(0x7f0000000600)={0x2, 'pimreg\x00', 0x1}, 0x18) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r17}, './file0\x00'}) 9.669113358s ago: executing program 2 (id=1098): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x38, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x10, 0x0, 0x0) unshare(0x8000000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') lseek(r3, 0x400, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x20, 0x0, &(0x7f0000000480)=[@acquire_done={0x40106309, 0x1}, @free_buffer], 0x0, 0x0, 0x0}) r5 = dup3(r4, r1, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder1\x00', 0x1002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f00000002c0)=0x105) write$dsp(0xffffffffffffffff, &(0x7f0000000240)=' ', 0x1) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) bind$packet(r6, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x81, 0x6, @remote}, 0x14) sendmmsg$sock(r6, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}, 0x1000000}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@timestamping], 0x14}}], 0x63, 0x54876) socket$inet6_tcp(0xa, 0x1, 0x0) fsopen(&(0x7f00000000c0)='virtiofs\x00', 0x0) 9.647630299s ago: executing program 3 (id=1100): r0 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0)='b', 0x1, 0xfffffffffffffffe) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x29, 0x10, 0x0, 0x1300) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000240)=@in6={0xa, 0x4e26, 0x7, @dev={0xfe, 0x80, '\x00', 0x33}}, 0x80, 0x0}, 0x20020049) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) io_setup(0x2278, &(0x7f0000000180)=0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x450c02, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0x7, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newchain={0x24, 0x64, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x3, 0x9}, {0x19, 0xb}, {0xffe0, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x850}, 0x4048080) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_BALANCE_CTL(0xffffffffffffffff, 0x40049421, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$XFS_IOC_ERROR_CLEARALL(r7, 0x40085875) clock_nanosleep(0x2, 0x0, &(0x7f0000000140)={r8, r9+10000000}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r10, &(0x7f0000000080)=ANY=[], 0xfffffee2) r11 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r11}, &(0x7f0000000480)=0x0) timer_settime(r12, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) io_pgetevents(r2, 0x4, 0x4, &(0x7f0000000080)=[{}, {}, {}, {}], 0x0, 0x0) io_submit(r2, 0x0, &(0x7f0000003400)) io_destroy(r2) r13 = add_key$user(&(0x7f0000002300), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705ae5", 0xc1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000400)={r0, r13, r13}, &(0x7f0000000440)=""/210, 0xd2, &(0x7f00000003c0)={&(0x7f0000000340)={'sha384\x00'}, &(0x7f0000000280)="708803449262ddb5bda92158536f78c390609a10de442b2c85a693afd7d8e5ffc37e1b3aebbdae8dc970f20781e971fc777714aa", 0x34}) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, "370c89", 0x8, 0x2c, 0x0, @dev={0xfe, 0x80, '\x00', 0x24}, @mcast2, {[@hopopts={0x84}]}}}}}, 0x0) 8.443353156s ago: executing program 3 (id=1104): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000075f84c1071042703a461000000010902120001000000000904"], 0x0) r1 = epoll_create1(0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = epoll_create1(0x0) r4 = fcntl$dupfd(r2, 0x0, r3) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000040)={0x20000001}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000000)={0x20000000}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f00000002c0)={0xa0000013}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r5, &(0x7f0000000580)={0xa0002008}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000100)={0x2c, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000100000011"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000000180)={0xc, &(0x7f0000000000)={0x0, 0x9, 0x11, {0x11, 0xf, "ee8af6499c55623ce06d4c8bf3d7b2"}}, &(0x7f0000000040)={0x0, 0x3, 0x47, @string={0x47, 0x3, "64e1380ddd8f2253600e4115f1b03fd4459c6b7926faf82035ffe2a4b4076ff7a905d7ccad195c49964df9cad6fbff28fabe2c194a2854ae8e022967bec506df72b2d21a76"}}}, &(0x7f0000000780)={0x24, &(0x7f0000000500)={0x0, 0x11, 0x9d, "ec2dfd22d39cdc4fcaaf5102a9861d616b683548700c490585b9a3fb55a19941e39f24aa979114eb39446b1672e8e54f3b8d792534d45918fb40a7e029fd9d7c2440d88a4ae89b3cca963cc288cdd95b647e2bc7ccc0c1d7e7d76edd5c21a09905a06927f31efe22175254ca7686fe08d9baf8041fb9d9e268be066099fbe353f14d5280446de5b40cd7691306b47f628bce57ae8bf028c936c994ffc9"}, &(0x7f00000005c0)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000600)={0x0, 0x8, 0x1, 0x80}, &(0x7f0000000640)={0x20, 0x81, 0x3, "e58126"}, &(0x7f0000000680)={0x20, 0x82, 0x2, "1655"}, &(0x7f00000006c0)={0x20, 0x83, 0x3, "30d067"}, &(0x7f0000000700)={0x20, 0x84, 0x4, "a6c8db16"}, &(0x7f0000000740)={0x20, 0x85, 0x3, "fa410c"}}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)={0x34, r7, 0x1, 0x4000, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_COALESCE_TX_MAX_FRAMES={0x8, 0x7, 0xf}]}, 0x34}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000002b80), 0x1, 0x48201) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r8, 0xc2c45513, &(0x7f0000002e00)={{0x9, 0x7, 0x3, 0x2, 'syz0\x00', 0x7b}, 0x0, [0x200, 0x7, 0x4, 0x0, 0x8001d1, 0x7fffffff, 0x5, 0x5, 0xbc0, 0x7, 0x15a, 0x4, 0x5948, 0x3, 0x7, 0x8004ab, 0x9, 0x8000005, 0xb, 0x3, 0x1ff, 0x3ff, 0x2000040, 0x10040002, 0x7, 0x0, 0x2, 0x800, 0x3, 0x4, 0x4, 0x6, 0x2, 0xfff, 0x3ff, 0x1, 0x5, 0x3, 0x5, 0x6, 0x2, 0x78a, 0x8001, 0x200000e, 0x40000e, 0x1, 0x2, 0x4, 0x3, 0x4, 0x6, 0x80000001, 0x400, 0x2, 0x9, 0xfffff647, 0x408, 0x4, 0x4000001, 0xc, 0x408, 0x9, 0x6, 0x8, 0x98, 0xbe, 0x1be, 0xa, 0x7, 0x7fffffff, 0x81, 0x10001, 0x2, 0x80000001, 0x69e, 0xb, 0x7000000, 0x1, 0x8, 0x100009, 0x7, 0x4, 0xfffffffd, 0x8, 0xfffffffd, 0xffff, 0x8, 0x4, 0xffffff70, 0xcc2, 0x10002, 0xff, 0x4, 0xfffffff9, 0xf8a, 0x58a0, 0x9, 0x9, 0x895, 0x9, 0xf858, 0x89, 0xfffffffe, 0xa1a9, 0x8e0b2, 0xb, 0x4, 0x1a, 0x4, 0x3, 0xfffffffa, 0x3, 0x2, 0x1, 0x2ba, 0x8140e74b, 0xe, 0x5, 0x8, 0x2, 0xfff, 0x4, 0x1ff, 0x7, 0x2, 0x7, 0xa, 0x200ff]}) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRESOCT=0x0], 0x50) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r10, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000400)='6', &(0x7f0000000340), 0xca, r9}, 0x38) set_mempolicy(0x4005, &(0x7f0000000080)=0x4, 0x8) 8.206353091s ago: executing program 1 (id=1106): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/power/pm_test', 0x301400, 0x4e) syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x7a}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x8, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "8a95"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x114}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x7c, 0x2, 0x6, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x204, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0xe, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x0, 0x8, 0x3fe, 0x7d, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc5, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x804e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0xfffffffe, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x5, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x0, 0x3, 0x7ff, 0x12b, 0xb, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x802006, 0x80a2f0, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x9, 0x57, 0x4, 0x3, 0x2, 0x10000, 0x4, 0x5fff, 0x10002, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x0, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d613, 0xa1f, 0xf42, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x10, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r4, 0x4, 0x40800) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r6, 0x2000009) sendfile(r4, r6, 0x0, 0x7ffff004) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4004ae52, &(0x7f00000000c0)=0x2) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xe0f02, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000400)=0x2) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) ioctl$PPPIOCSMAXCID(r7, 0x40047451, &(0x7f0000000200)=0x98) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYRES8=r7, @ANYRES16=r8, @ANYBLOB="010000000000000000000f0000001c0007800c000400002e0000000000000c0003002d"], 0x30}, 0x1, 0x0, 0x0, 0xc091}, 0x4004014) 6.795555072s ago: executing program 0 (id=1107): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6}, 0x46, 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) prctl$PR_SET_SECCOMP(0x4f, 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x1) fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r3, 0x101, 0x1) getdents(r3, &(0x7f00000002c0)=""/201, 0xc9) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000007900)={&(0x7f00000001c0)=@newtaction={0x48, 0x30, 0x216822a75a8bdd29, 0x0, 0x0, {}, [{0x34, 0x1, [@m_skbmod={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c00018006000600843b00000c00028008"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socket$netlink(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000), 0x8) socket$packet(0x11, 0x2, 0x300) request_key(&(0x7f0000000000)='asymmetric\x00', 0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0xb4, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newsa={0x104, 0x1a, 0x7, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0x4, 0x0, 0x60000}, {0x3, 0x200000, 0x7, 0xffffffffffffffff}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000005d0d3087d07aa04d85b0102030109021b000f000000000904000001dbcc7a000905", @ANYRES16], 0x0) 6.794852382s ago: executing program 1 (id=1108): r0 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0)='b', 0x1, 0xfffffffffffffffe) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x29, 0x10, 0x0, 0x1300) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000240)=@in6={0xa, 0x4e26, 0x7, @dev={0xfe, 0x80, '\x00', 0x33}}, 0x80, 0x0}, 0x20020049) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) io_setup(0x2278, &(0x7f0000000180)=0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x450c02, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0x7, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newchain={0x24, 0x64, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x3, 0x9}, {0x19, 0xb}, {0xffe0, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x850}, 0x4048080) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_BALANCE_CTL(0xffffffffffffffff, 0x40049421, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$XFS_IOC_ERROR_CLEARALL(r7, 0x40085875) clock_nanosleep(0x2, 0x0, &(0x7f0000000140)={r8, r9+10000000}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r10, &(0x7f0000000080)=ANY=[], 0xfffffee2) r11 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r11}, &(0x7f0000000480)=0x0) timer_settime(r12, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) io_pgetevents(r2, 0x4, 0x4, &(0x7f0000000080)=[{}, {}, {}, {}], 0x0, 0x0) io_submit(r2, 0x0, &(0x7f0000003400)) io_destroy(r2) r13 = add_key$user(&(0x7f0000002300), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705ae5", 0xc1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000400)={r0, r13, r13}, &(0x7f0000000440)=""/210, 0xd2, &(0x7f00000003c0)={&(0x7f0000000340)={'sha384\x00'}, &(0x7f0000000280)="708803449262ddb5bda92158536f78c390609a10de442b2c85a693afd7d8e5ffc37e1b3aebbdae8dc970f20781e971fc777714aa", 0x34}) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, "370c89", 0x8, 0x2c, 0x0, @dev={0xfe, 0x80, '\x00', 0x24}, @mcast2, {[@hopopts={0x84}]}}}}}, 0x0) 6.780904278s ago: executing program 2 (id=1109): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/power/pm_test', 0x301400, 0x4e) syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x7a}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x8, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "8a95"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x10c}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x7c, 0x2, 0x6, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x204, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0xe, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x0, 0x8, 0x3fe, 0x7d, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc5, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x804e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0xfffffffe, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x5, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x0, 0x3, 0x7ff, 0x12b, 0xb, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x802006, 0x80a2f0, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x9, 0x57, 0x4, 0x3, 0x2, 0x10000, 0x4, 0x5fff, 0x10002, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x0, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d613, 0xa1f, 0xf42, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x10, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r4, 0x4, 0x40800) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r6, 0x2000009) sendfile(r4, r6, 0x0, 0x7ffff004) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4004ae52, &(0x7f00000000c0)=0x2) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xe0f02, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000400)=0x2) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) ioctl$PPPIOCSMAXCID(r7, 0x40047451, &(0x7f0000000200)=0x98) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYRES8=r7, @ANYRES16=r8, @ANYBLOB="010000000000000000000f0000001c0007800c000400002e0000000000000c0003002d"], 0x30}, 0x1, 0x0, 0x0, 0xc091}, 0x4004014) 6.378327644s ago: executing program 2 (id=1110): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x2d) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) r2 = syz_open_dev$vim2m(&(0x7f0000000180), 0x8004, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x50) unshare(0x62040200) timer_create(0x6, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) syz_open_dev$admmidi(&(0x7f0000000080), 0x2, 0x242c3) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r3, 0x4018f50b, &(0x7f0000000000)={0x4, 0x3, 0x2}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0}, 0x40) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x62040200) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x31, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x25dfdbfc, {0x2, 0x10, 0x10, 0x0, 0x0, 0x4, 0x0, 0x6, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0xfffffffffffffda3, &(0x7f0000000180)={&(0x7f0000000200)=@delnexthop={0x20, 0x69, 0xb, 0x0, 0x0, {}, [{0x8, 0x1, 0x1}]}, 0x20}}, 0x4000000) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) 5.923099591s ago: executing program 0 (id=1112): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={0xffffffffffffffff, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000280)={0x1, 0x0, [{0x3, 0x5, 0x0, 0x0, @adapter={0x4000000000000005, 0x7fffffffffffffff, 0x8000000000000001, 0x80, 0x5}}]}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x40091}, 0x24004844) socket(0x840000000002, 0x3, 0xff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f00000002c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000000100)={0x4, r5, 0x80000}) ioctl$DMA_BUF_SET_NAME_A(r7, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') r8 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0}) uname(&(0x7f0000000300)=""/7) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) ioctl$vim2m_VIDIOC_STREAMOFF(r8, 0xc0205647, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xb) ioctl$DMA_BUF_IOCTL_SYNC(r7, 0x40086200, &(0x7f0000000540)=0x1) close_range(r5, r6, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x48011) socket$inet6_sctp(0xa, 0x1, 0x84) 5.749688578s ago: executing program 1 (id=1114): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/power/pm_test', 0x301400, 0x4e) syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x7a}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x8, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "8a95"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x114}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x7c, 0x2, 0x6, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x204, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0xe, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x0, 0x8, 0x3fe, 0x7d, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc5, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x804e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0xfffffffe, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x5, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x0, 0x3, 0x7ff, 0x12b, 0xb, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x802006, 0x80a2f0, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x9, 0x57, 0x4, 0x3, 0x2, 0x10000, 0x4, 0x5fff, 0x10002, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x0, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d613, 0xa1f, 0xf42, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x10, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r4, 0x4, 0x40800) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x64}]}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xd0}}, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r6, 0x2000009) sendfile(r4, r6, 0x0, 0x7ffff004) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4004ae52, &(0x7f00000000c0)=0x2) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xe0f02, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000400)=0x2) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) ioctl$PPPIOCSMAXCID(r7, 0x40047451, &(0x7f0000000200)=0x98) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, 0x0, 0x4004014) 5.547690551s ago: executing program 3 (id=1116): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040eb2821c0c"], 0x7) 4.666190819s ago: executing program 3 (id=1117): syz_usb_connect(0x6, 0x36, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x4, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0x9}, ["", "", "", "", "", "", "", ""]}, 0x14}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b405"], 0x0, 0x5}, 0x94) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/block/ram8', 0x80400, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r6, 0x2285, 0x0) writev(r6, &(0x7f0000000000)=[{&(0x7f0000000340)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000400)="aa1d484e0a4e000000008133d576983340cb31a5fc977c2e4891f7c08bfcd111fbdf23ea32db0e8f20d5bc27bd8063", 0x2f}], 0x2) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5393, &(0x7f0000000000)) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4040081}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006e383a10d00701415cec0102030109022400010000000009042300020070400009058a03080004030e09050e03"], 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb40000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000007000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000440005002001000000000000000000000000000000000002320000000a000000fc0100000000000000000000000000000000000004"], 0xfc}}, 0x0) connect$inet(r0, &(0x7f0000000280)={0x2, 0x4, @multicast1}, 0x10) sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) 3.964810501s ago: executing program 1 (id=1119): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x38, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x10, 0x0, 0x0) unshare(0x8000000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') lseek(r3, 0x400, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x20, 0x0, &(0x7f0000000480)=[@acquire_done={0x40106309, 0x1}, @free_buffer], 0x0, 0x0, 0x0}) r5 = dup3(r4, r1, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder1\x00', 0x1002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f00000002c0)=0x105) write$dsp(0xffffffffffffffff, &(0x7f0000000240)=' ', 0x1) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) bind$packet(r6, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x81, 0x6, @remote}, 0x14) sendmmsg$sock(r6, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}, 0x1000000}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@timestamping], 0x14}}], 0x63, 0x54876) socket$inet6_tcp(0xa, 0x1, 0x0) fsopen(&(0x7f00000000c0)='virtiofs\x00', 0x0) 2.700247039s ago: executing program 4 (id=1122): socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000001400010301000000000000002c0000000000000018"], 0x24}}, 0x0) 2.525641792s ago: executing program 4 (id=1123): syz_emit_vhci(&(0x7f0000000000)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x6}, @hci_rp_le_set_cig_params={{0x7f}, {0x7, 0x5}}}}, 0x9) 1.878212269s ago: executing program 4 (id=1124): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6}, 0x46, 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) prctl$PR_SET_SECCOMP(0x4f, 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x1) fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r3, 0x101, 0x1) getdents(r3, &(0x7f00000002c0)=""/201, 0xc9) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000007900)={&(0x7f00000001c0)=@newtaction={0x48, 0x30, 0x216822a75a8bdd29, 0x0, 0x0, {}, [{0x34, 0x1, [@m_skbmod={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c00018006000600843b00000c00028008"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socket$netlink(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000), 0x8) socket$packet(0x11, 0x2, 0x300) request_key(&(0x7f0000000000)='asymmetric\x00', 0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0xb4, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newsa={0x104, 0x1a, 0x7, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0x4, 0x0, 0x60000}, {0x3, 0x200000, 0x7, 0xffffffffffffffff}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000005d0d3087d07aa04d85b0102030109021b000f000000000904000001dbcc7a000905", @ANYRES16], 0x0) 1.873225973s ago: executing program 1 (id=1134): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) removexattr(&(0x7f0000000080)='./file0\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0}, 0x68) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x200000, 0x1000, 0x0, 0x1}, 0x1c) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000000740)="5986c661ebb42bfa6464cb14c75e9cfcd0c87d963c5f79227680b88d91ffce97afa404ce506c636d7edc5e22087a65633b94cdee29d97975aa7905b64cc8a1da29c7b4228fe35f3cf9351e377acfcce4079803e636b37d253db4084bbaa03972917794b87e398d654c7970b8d907ea25c42b466116c0100a456e897e59ef282d4165978c7526052d23a08264e673d53a443022bd4e5fb0d2e8f8", 0x9a}], 0x1, &(0x7f0000000380)}], 0x1, 0x8040010) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000440)={'syztnl0\x00', 0x0, 0x29, 0x2, 0xb7, 0x7f, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x25}, 0x20, 0x700, 0x5, 0x39}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl2\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000002380)=@newtfilter={0x8f8, 0x2c, 0x8, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x10, 0xa}, {0x9, 0x5}, {0x1, 0x3}}, [@filter_kind_options=@f_route={{0xa}, {0x8c8, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0x9c}, @TCA_ROUTE4_POLICE={0x4}, @TCA_ROUTE4_ACT={0x8c, 0x6, [@m_ife={0x88, 0x2, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}}, @TCA_IFE_DMAC={0xa, 0x3, @link_local}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x10001, 0x4, 0x5, 0x400}, 0x1}}, @TCA_IFE_SMAC={0xa, 0x4, @broadcast}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x7, 0x3, 0x1, 0x0, 0x9}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_ROUTE4_IIF={0x8, 0x4, r4}, @TCA_ROUTE4_CLASSID={0x8, 0x1, {0x7, 0x6}}, @TCA_ROUTE4_POLICE={0x814, 0x5, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x4f, 0x3, 0x6, 0x3, 0x8, 0x0, 0x3ff, 0x81, 0x8, 0x77, 0x1f85e7e3, 0x39e, 0x1, 0x2, 0x7, 0xffff00, 0x0, 0x380, 0x4, 0x3, 0xf9, 0x0, 0x8, 0x4, 0x400, 0x1, 0x8, 0x1, 0x9, 0x32b3, 0x10000, 0x2521, 0x10001, 0x3, 0xc, 0x1, 0x10001, 0x101, 0x7, 0x1, 0x4, 0x3, 0x80000000, 0x8, 0x7, 0x8, 0x7fff, 0x800, 0x0, 0x6, 0xa0, 0x6, 0xffff0001, 0xb, 0x4, 0xffff8001, 0x2, 0x3, 0x18, 0xd, 0x2, 0x5, 0xd8f, 0x0, 0x4, 0xfffffffb, 0x10001, 0x27b1, 0x3, 0x2e0, 0x8, 0x8, 0x2, 0x81, 0x7, 0x5af0668a, 0x100, 0xfffffffd, 0xb, 0x3ff, 0x9, 0x0, 0x6, 0x10000, 0x5, 0xfff, 0x0, 0x1, 0x8, 0xe, 0x427d, 0x2, 0x3ff, 0x6, 0x0, 0x1, 0x7c966d50, 0x2, 0x1, 0x8, 0x86d4, 0x8, 0x2, 0xd5, 0x0, 0x2, 0x1, 0x9, 0x7, 0x80, 0x0, 0x3, 0x9, 0x0, 0x54, 0x7, 0x8, 0xf8, 0x2, 0x2275, 0x7643, 0x7fffffff, 0x8, 0x79, 0x9, 0x9, 0xd170, 0x9, 0x7a71bb03, 0x0, 0xfffffffd, 0x10, 0x259674e7, 0x7, 0x7, 0xb10, 0x8, 0x8, 0x2, 0x4, 0x11, 0x6, 0x5, 0x100, 0x6a, 0x6, 0x9, 0x0, 0x80, 0x5, 0x1, 0x9, 0x8, 0x9, 0x1000, 0x6, 0x5, 0x6, 0xd, 0x9, 0x1, 0x2, 0xd, 0x3, 0x8, 0x0, 0x80000001, 0x800, 0x5, 0x3, 0x3, 0x6, 0x0, 0x81, 0xcd7b, 0x9, 0xf, 0x2, 0x7, 0x1, 0xc566, 0x6, 0x9, 0x327, 0xf17, 0x7, 0x8000, 0x4, 0xda, 0x4, 0x0, 0x8, 0x9, 0x3, 0x10001, 0xb422, 0x2, 0xffff, 0x3, 0x4, 0x66e8, 0x8000, 0xfffff1bd, 0x3, 0x8, 0x9, 0xad, 0x8000, 0x3800000, 0x6, 0x10001, 0x77d, 0x4, 0xf154, 0xd29, 0x7, 0x9, 0x81, 0x6, 0x8000, 0x6, 0x2, 0x1, 0x4, 0x2b, 0x6a, 0x200, 0x10000, 0x3, 0xdb, 0x6, 0x40, 0xd, 0x7c2, 0xff, 0x1000, 0x6, 0x0, 0x3, 0x3, 0x3, 0x4, 0x3, 0x2bc, 0x3, 0xe9, 0xf781, 0x2668, 0x5, 0x81, 0x6, 0x4, 0x9, 0xf, 0x8]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x10001, 0x2, 0x2, 0x5, 0x3, 0x9, 0x7, 0x200, 0x0, 0x0, 0x2444, 0x1ff, 0x7ff, 0x6, 0x40, 0x46, 0xffffffff, 0x2, 0x7ab, 0x987, 0xff, 0x5, 0x9, 0x8, 0xf, 0x5, 0x8, 0x5, 0x2, 0x2, 0x9, 0x400, 0xb, 0x1, 0x4, 0x10001, 0x7, 0xffffffff, 0x6, 0x4, 0xbe3, 0x8001, 0x6, 0x42, 0x9, 0xffff0001, 0x4, 0x800, 0x2, 0x77, 0x9, 0x2, 0x1, 0x8, 0x77d, 0xf, 0x5b, 0x4, 0x5, 0x1, 0x2, 0x1, 0x1, 0x9, 0x8, 0x0, 0x6, 0x7d0d, 0x0, 0x78e, 0x5, 0x515c, 0x5, 0xe, 0xfffffffe, 0x5, 0xc6ab, 0x80000000, 0x0, 0x3, 0x2, 0x101, 0x80, 0xfffffff8, 0xc4, 0xc83156e9, 0x3, 0xfffff175, 0x3, 0x6, 0x400, 0x6, 0x836, 0x0, 0x5, 0xfffffff3, 0x4, 0x9, 0x7483, 0x8, 0x6, 0x2, 0x1ff, 0x3, 0x5, 0x8, 0x2, 0x4, 0x10001, 0xf, 0x3, 0x2, 0x0, 0x6, 0x9, 0x100, 0x6, 0x9, 0x3, 0x5393, 0x76102963, 0x4, 0x4, 0x9d7, 0x6, 0x800, 0x10001, 0x9, 0x6, 0x4, 0x3, 0x200, 0x3, 0x6, 0xf86, 0x3, 0x1, 0x5, 0x347, 0x4, 0x7fff, 0x5, 0x81, 0x800, 0x6, 0x1, 0x5, 0x9, 0x2, 0x7, 0x7f, 0x3, 0x2, 0x1ff, 0x800, 0x7, 0x10, 0x5, 0x8001, 0x28, 0xf, 0x738, 0x9, 0x8001, 0x9, 0xfffffff8, 0xfffffff8, 0x5, 0x9, 0x3, 0x5, 0xea, 0x4, 0x0, 0x401, 0x5, 0x9, 0x1f10b8ed, 0x1, 0x4, 0xc, 0x10, 0x5, 0xeb0f, 0x8, 0x8ba, 0x1, 0x10, 0x9, 0x4, 0x6, 0x8, 0x3, 0x4, 0x50, 0x2, 0x4, 0xf6, 0x54, 0x6, 0xfffffc00, 0x81, 0x5, 0x8, 0x9, 0x6, 0x1800, 0xa, 0x1, 0x7, 0xcb, 0xe, 0xd, 0x200, 0x2, 0x1e, 0x40, 0x2d, 0x5, 0x80000000, 0xffff, 0x3, 0x7fffffff, 0xb, 0x8, 0xa9e, 0x5, 0x8, 0x81, 0x8, 0xcaa, 0x9, 0x9, 0x8, 0x86dd, 0x0, 0x3, 0x5, 0x1, 0x6, 0xb, 0xfffffe23, 0x4, 0x0, 0x5, 0xfffffffb, 0x7, 0x8, 0x7, 0x3c, 0x6, 0x40, 0xb, 0x401, 0x9, 0x3]}]}, @TCA_ROUTE4_IIF={0x8}]}}]}, 0x8f8}}, 0x800) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) listen(r0, 0x5) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8000) sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x5c, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x2c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xa2}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xec}]}, 0x5c}}, 0x48000) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x10, 0x110, 0x1, "12"}, {0xc, 0x110, 0xe}], 0x1c}, 0x4000) close(r0) 1.872262632s ago: executing program 0 (id=1125): r0 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0)='b', 0x1, 0xfffffffffffffffe) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x29, 0x10, 0x0, 0x1300) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000240)=@in6={0xa, 0x4e26, 0x7, @dev={0xfe, 0x80, '\x00', 0x33}}, 0x80, 0x0}, 0x20020049) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) io_setup(0x2278, &(0x7f0000000180)=0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x450c02, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0x7, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newchain={0x24, 0x64, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x3, 0x9}, {0x19, 0xb}, {0xffe0, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x850}, 0x4048080) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_BALANCE_CTL(0xffffffffffffffff, 0x40049421, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$XFS_IOC_ERROR_CLEARALL(r7, 0x40085875) clock_nanosleep(0x2, 0x0, &(0x7f0000000140)={r8, r9+10000000}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) write$binfmt_aout(r10, &(0x7f0000000080)=ANY=[], 0xfffffee2) r11 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r11}, &(0x7f0000000480)=0x0) timer_settime(r12, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) io_pgetevents(r2, 0x4, 0x4, &(0x7f0000000080)=[{}, {}, {}, {}], 0x0, 0x0) io_submit(r2, 0x0, &(0x7f0000003400)) io_destroy(r2) r13 = add_key$user(&(0x7f0000002300), &(0x7f0000002340)={'syz', 0x3}, &(0x7f0000000100)="370c099069effa43de3e1404db09b4ce1ef77bde4b371532dd16447c1b13403656c86711f6e750026f23029a50d44299c7bf5c78dc5efae2d041016160e8bef7b30c05e298aa9572540dd950307987eef2115e1bcf512bea3410ca5a9e9f827e4b13490dbbd4fc5a45e0738b959acafd2c12863045265bcbc2c9426ac3f614746b436fe86a72dc642dd67d970604a69b4f22cd0076beedc18056ab4bea4c825b69a7a77adcd5488684872b1bb9eb84586549e11b080468668e8fd0e52ce0705ae5", 0xc1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000400)={r0, r13, r13}, &(0x7f0000000440)=""/210, 0xd2, &(0x7f00000003c0)={&(0x7f0000000340)={'sha384\x00'}, &(0x7f0000000280)="708803449262ddb5bda92158536f78c390609a10de442b2c85a693afd7d8e5ffc37e1b3aebbdae8dc970f20781e971fc777714aa", 0x34}) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, "370c89", 0x8, 0x2c, 0x0, @dev={0xfe, 0x80, '\x00', 0x24}, @mcast2, {[@hopopts={0x84}]}}}}}, 0x0) 1.871509228s ago: executing program 2 (id=1126): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYRESDEC=r1], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000000)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac1414"], 0x254}}, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) r3 = shmget$private(0x0, 0x4000, 0x2, &(0x7f0000ffc000/0x4000)=nil) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x4000009f}]}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x8000) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24040084) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f00000008c0)={'gre0\x00', &(0x7f0000000800)={'gre0\x00', 0x0, 0x738, 0x20, 0x1, 0xe5, {{0x5, 0x4, 0x1, 0x4, 0x14, 0x65, 0x0, 0x2, 0x4, 0x0, @multicast1, @remote}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000a00)={'ip6_vti0\x00', &(0x7f0000000980)={'syztnl1\x00', 0x0, 0x4, 0x7, 0xda, 0x40, 0x18, @ipv4={'\x00', '\xff\xff', @multicast1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x40, 0x1, 0x7, 0x8}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000b00)={'syztnl1\x00', &(0x7f0000000a40)={'gretap0\x00', 0x0, 0x80, 0x1, 0xe52, 0x40000, {{0x25, 0x4, 0x2, 0x27, 0x94, 0x66, 0x0, 0x5, 0x2b, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, {[@ssrr={0x89, 0x27, 0x8c, [@broadcast, @multicast2, @multicast1, @multicast1, @broadcast, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @private=0xa010102]}, @cipso={0x86, 0x4c, 0x3, [{0x5, 0xa, "73abe7c74c24f093"}, {0x2, 0x11, "6c15d0665063c6cb2bef7df3a91c2c"}, {0x0, 0xf, "64a63abab920d175012fa49a83"}, {0x5, 0x10, "7c4425f17dfa62ebfaaa6de602d6"}, {0x5, 0xc, "44fb0c65714ce9addfbf"}]}, @generic={0x83, 0xd, "036abdc6d8f8b62278fc8c"}]}}}}}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000b80)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001440)={&(0x7f0000001d80)={0x880, 0x0, 0x800, 0x70bd2d, 0x25dfdbfe, {}, [{{0x8}, {0x198}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xb17}}}]}}, {{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'activebackup\x00'}}}]}}, {{0x8}, {0x1b8, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xfdfffffb}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x4c, 0x1, @queue_id={{{}, {}, {0x0, 0x4, 0x7}}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0x1f8, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x6, 0x8, 0x0, 0x2}, {0x16, 0x80, 0x7, 0x1}, {0x0, 0xf7, 0x10, 0x80000001}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @lb_tx_method={{}, {}, {0x0, 0x4, 'hash\x00'}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x5f6}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}}}]}}, {{0x8, 0x1, r10}, {0x130, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r11}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @user_linkup={{}, {0x0, 0x6, r10}}}]}}, {{0x8, 0x1, r12}, {0xfffffffffffffd57, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{}, {}, {0x0, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r13}}}]}}]}, 0x880}, 0x1, 0x0, 0x0, 0x4011}, 0x4000) r14 = shmat(r3, &(0x7f0000ffc000/0x2000)=nil, 0x4000) shmdt(r14) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000008000000000700000aa0000000060a0b0400000000000000000200000074000480700001800a0001006d617463680000006000028008000240000000000c0001007068797364657600460003007e6b92c43235dc7e977221f83c3f179e65020800000087cd67b6d9983b1bddafbdf6a37da5ed332cd2ee94b31d2ec330ce34cc676c0783a4bcc1e966554b0470580400000900010073797a30000000000900020073797a32"], 0xc8}, 0x1, 0x0, 0x0, 0x4008011}, 0x4000800) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000000)={0xc, 0x0, @qam={0x5, 0x3, 0x14}}) socket$nl_route(0x10, 0x3, 0x0) 1.603647235s ago: executing program 2 (id=1127): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000040)=@ethtool_cmd={0xa, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x8, 0x0, 0x87, 0x0, 0x80000, 0x0, 0x1, 0x1, 0x0, 0x80000045, [0x2, 0x6]}}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000340), 0x106, 0x1}}, 0x20) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0xc) close(0xffffffffffffffff) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/vlan/vlan0\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8923, &(0x7f0000000000)={'vlan0\x00', @local}) mmap(&(0x7f000014f000/0x4000)=nil, 0x4000, 0x3000000, 0x4000010, r6, 0x94eb000) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000680)={r8, 0x1ff, 0x0, 0x12000, 0x3, [0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x3], [0x0, 0x1001000, 0x800001, 0x4], [0x0, 0x401, 0xfffffffffefffffc, 0x9]}) ioctl$DRM_IOCTL_MODE_ADDFB2(0xffffffffffffffff, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x0, [r9, 0x0, 0x0, r10], [0x2b8]}) ioctl$DRM_IOCTL_MODE_ADDFB2(0xffffffffffffffff, 0xc06864b8, &(0x7f0000000000)={0x0, 0x2000, 0x80, 0x32315e4e, 0x3, [r10], [0x2160, 0x7], [], [0x400000000000001, 0x2000000000, 0x0, 0x1]}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c000180050001"], 0xbc}}, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x38, 0x9, 0x6, 0x5, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}]}]}, 0x38}}, 0x0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}}, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a5c000000060a010400000000000000000a0000040900010073797a31000000000900020073797a3200000000300004802c0001800a0001006d6174636800c9211c0002800800024000000002080003000000000008000100736574"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) socket(0x400000000010, 0x3, 0x0) 1.392534453s ago: executing program 3 (id=1128): syz_usb_connect(0x3, 0x63, &(0x7f0000000740)={{0x12, 0x1, 0x310, 0x78, 0xe8, 0x72, 0x20, 0x1f71, 0x3306, 0x2ac0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x51, 0x2, 0x3, 0x1, 0x80, 0x5, "", [{{0x9, 0x4, 0xdf, 0x0, 0x0, 0x46, 0x35, 0x34, 0xf}}, {{0x9, 0x4, 0x19, 0x6, 0x5, 0xfb, 0xdc, 0x42, 0x0, [], [{{0x9, 0x5, 0x80, 0x10, 0x200, 0x6, 0x6, 0x4, [@generic={0x9, 0x4, "df9b52d017dc73"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x200, 0xaf, 0x2, 0x83}}, {{0x9, 0x5, 0x8b, 0x0, 0x20, 0x1, 0x8, 0x8}}, {{0x9, 0x5, 0x8, 0x0, 0x200, 0x8, 0x1b, 0x6}}, {{0x9, 0x5, 0xe, 0x1, 0x200, 0x3, 0x9, 0x40}}]}}]}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) 1.101124352s ago: executing program 4 (id=1129): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/power/pm_test', 0x301400, 0x4e) syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x7a}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x8, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "8a95"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x114}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x7c, 0x2, 0x6, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x204, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0xe, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x0, 0x8, 0x3fe, 0x7d, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc5, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x804e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0xfffffffe, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x5, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x0, 0x3, 0x7ff, 0x12b, 0xb, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x802006, 0x80a2f0, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x9, 0x57, 0x4, 0x3, 0x2, 0x10000, 0x4, 0x5fff, 0x10002, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x0, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d613, 0xa1f, 0xf42, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x10, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r4, 0x4, 0x40800) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x64}]}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xd0}}, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r6, 0x2000009) sendfile(r4, r6, 0x0, 0x7ffff004) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4004ae52, &(0x7f00000000c0)=0x2) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xe0f02, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000400)=0x2) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) ioctl$PPPIOCSMAXCID(r7, 0x40047451, &(0x7f0000000200)=0x98) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, 0x0, 0x4004014) 682.504291ms ago: executing program 2 (id=1130): syz_usb_connect$uac2(0x3, 0x8b, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000300000020532b2300400001020301090279000301fb4004080b02010103200109040000000101200009240108000c1900e508240a00040b060308240a0901030602090401000001022000090401010101022000090501090002080706082501800f07000009040200000102200009040201", @ANYRES32], &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) 356.989325ms ago: executing program 4 (id=1131): madvise(0xffffffffffffffff, 0x0, 0x4) 142.077673ms ago: executing program 4 (id=1132): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000140)=@usbdevfs_driver={0x0, 0x8, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/power/pm_test', 0x301400, 0x4e) syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x7a}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x8, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "8a95"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x10c}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x7c, 0x2, 0x6, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x204, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0xe, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x0, 0x8, 0x3fe, 0x7d, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc5, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x804e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0xfffffffe, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x5, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x0, 0x3, 0x7ff, 0x12b, 0xb, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x802006, 0x80a2f0, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x9, 0x57, 0x4, 0x3, 0x2, 0x10000, 0x4, 0x5fff, 0x10002, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x0, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d613, 0xa1f, 0xf42, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0x10, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r4, 0x4, 0x40800) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r6, 0x2000009) sendfile(r4, r6, 0x0, 0x7ffff004) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4004ae52, &(0x7f00000000c0)=0x2) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xe0f02, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000400)=0x2) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) ioctl$PPPIOCSMAXCID(r7, 0x40047451, &(0x7f0000000200)=0x98) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)=ANY=[@ANYRES8=r7, @ANYRES16=r8, @ANYBLOB="010000000000000000000f0000001c0007800c000400002e0000000000000c0003002d"], 0x30}, 0x1, 0x0, 0x0, 0xc091}, 0x4004014) 24.536241ms ago: executing program 1 (id=1133): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@ldst={0x7, 0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f00000000c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x2}, 0x94) 0s ago: executing program 0 (id=1135): r0 = userfaultfd(0x80801) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f00000000c0)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000040)={@host}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r1, 0x7ab, &(0x7f0000000440)={&(0x7f0000000540)={{@local, 0x7}, {@local, 0x86}, 0x400, "d49e0b1f09a3e05cb898141464441748655937bb34d22f02362479246bb6372d891a3b5dafa58a6abc5a678d6874fc8fb5f8a529c6e30103484f2667c174fb6cda19ea0a9301bc3238eb816e9c3882f243bcd4bd7115b26dacf5923f060498d471cb4f789562fcda119739dd1a5b0e4e1a4a64dbd7b398bd4e7a247d81f968f2e945f293fc3860bf11f0424193fce743067d27f0ac187b44b128a4999547f73d8c35d3c2bd8b51bbc9a31123f773be89e109cc71b8ec29a539083c0cba15b08933865e3e154c28b3c4e2ebe360ac44f942a703b9a3a37fbbefe9ae0de04a32336a6eba07b2fb6ad426d56e17291bb1a9d1fcdaa939378bab6dd2eac37b369ef163c9e0fc8039352c24d8147fcc2e2559b47066abd21a3a5f83f239a2227d17d4ca90f60ed9acc243ed38818e3883a985106b54dc157b67022525a74e8f9cb99852760359278d5d22294a70433ba4cec5147fbb09b1d0008ba76257f1c5af6b8d6bf3bcfd5a468a566a4e98fe5f264f2663b72cb421c90d8b7883ddfb5749b27a3e146f9d8538706fea61b07c6e064446337439b9d5a5dc82f6c63c57d6ba0e709b7c1b15fa8367f8e6df2cf59b0b30740ef47c5cccffce5911569591ce4ab62275964cd147e87a30cc6e71f7e40e161997cdbadcfbfb6c54e0289ac137508b7b5339414e4ab7afcc420148e37d49b664cc07c8178a3b50f566c5bdd3aa9217ef909805972bd63ee1d729b282cd866c183744b20da3227f9d43843236b571c8d3237408c266e08d0699ebd30e0820362664ab323b15d3ae9896d6120aae6ef9085f53a2b39cc31238b031476c86e6b16d7703fcbacc7269ce8622eab1cfdf82a364209ec4ac912db924bb76bc35ddf8d0e7a3aff0d08a48c07be47303b59653d9409f14dc59ac33cae5e010466f54d86772e43e3680863bb9bf10c971f16a731e601d7fcdbb91d7146e7834d89059ad522d70398c2bacf113ed791e32f933dfa23f5d6d11bfc9d9e0f04a34b0eddd99d16cd9712485e0a5c9aaf1ebf3f14d00005f8960b6145cbb7d4522692ebe1f9491f87a29ed67c5fb60f5e69bde2a758742999fc986a2dbf6199977e9b446691bf9f95d0abd84557c77ea13356c977d0f098ab9fec85acbd6447f2e6893e2fa6a0a7b272dab66e69b7def48f8b3583a53a0941fb3e4367fa8d56e05ee3b265f17ca0439fcdcea276f7f0a9bf4c2a324d7143658007cf4019e8da69ba1b7dff4383714cbcb71dfe6f1b1ac5d5e99394cb2c360ddb1889d92cd36f8fc72ac865f1c6445957b2a57c1af59ef8d2e9fe328ec2bde763d65c4dea965042f540515bf2f879d1b26309ebc1d7f76c569fa88fbe61845e96e93d3b6025b6285777e59495943596c128fdacc545263ce458bf99f57d7e5dc77f65cf650902b5b6d5af9359334759843365bf0dfb244817a40e8cc9030"}, 0x418, 0xd8d}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x5c, r4, 0x1, 0x170bf2a, 0x25dfdbff, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_RX_USECS_IRQ={0x8, 0x4, 0x8}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_RX={0x5, 0x19, 0x1}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_LOW={0x8, 0xf, 0x4}, @ETHTOOL_A_COALESCE_RX_USECS={0x8, 0x2, 0x3}, @ETHTOOL_A_COALESCE_TX_USECS_LOW={0x8, 0x10, 0xd}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES={0x8, 0x3, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4920}, 0x44860) r5 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000000)=0x20) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {r2}}, './file0\x00'}) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000140)=0x1000000, 0x4) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x3000002, 0x11, r5, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000000)=0x4000) r7 = socket(0x10, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x5c, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x3}, {0xffff, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x1d, 0x407, 0x2, 0x0, 0x3, 0x4}}, {0x4}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1d4}, 0x8840) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r6, 0x0, 0x2a, &(0x7f0000000480)={0x3, {{0x2, 0x4e20, @rand_addr=0x64010100}}}, 0x84) setsockopt$inet_MCAST_MSFILTER(r9, 0x0, 0x30, &(0x7f0000000340)=ANY=[@ANYBLOB="0300000002004e26e00000020000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000790100000000000000537d844dfd887aa515caa1b6494958a0a66aa5e6e2c90376d8ea1eaf93b852de8107ea4a12589ef2eaf9e0fded9e1804923ef5e076834f"], 0x90) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) fcntl$F_SET_FILE_RW_HINT(r7, 0x40e, &(0x7f00000000c0)=0x5) r10 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r10, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x800, 0x0, 'queue1\x00', 0xff}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r10, 0x40bc5311, &(0x7f0000000280)={0xf, 0x1, 'client0\x00', 0x5, "2a7877f206e11434", "4d1958bd873e8d6a7276617d37ac8b5b5be949fa7760e0ea08a52e1fc1671a00", 0x2}) write$sndseq(r10, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r10, 0x4040534e, &(0x7f0000000180)={0x353, @time={0x9, 0x4}}) kernel console output (not intermixed with test programs): ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fff0ec code=0x7ffc0000 [ 383.675076][ T32] audit: type=1326 audit(1790256415.067:1102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9180 comm="syz.2.745" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf6fff0ec code=0x7ffc0000 [ 383.699162][ T32] audit: type=1326 audit(1790256415.087:1103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9180 comm="syz.2.745" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fff0ec code=0x7ffc0000 [ 383.727245][ T32] audit: type=1326 audit(1790256415.117:1104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9180 comm="syz.2.745" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fff0ec code=0x7ffc0000 [ 383.733340][ T32] audit: type=1326 audit(1790256415.117:1105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9180 comm="syz.2.745" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=275 compat=1 ip=0xf6fff0ec code=0x7ffc0000 [ 384.553439][ T5672] usb 5-1: 0:1 : does not exist [ 384.668364][ T9192] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.746'. [ 384.668562][ T9192] openvswitch: netlink: Message has 512 unknown bytes. [ 384.767004][ T5672] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 384.791534][ T5672] usb 5-1: USB disconnect, device number 33 [ 384.865787][ T6936] udevd[6936]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 386.935540][ T9217] netlink: 52 bytes leftover after parsing attributes in process `syz.2.761'. [ 386.984157][ T1234] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 387.134505][ T1234] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 387.140022][ T1234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.140045][ T1234] usb 4-1: Product: syz [ 387.140061][ T1234] usb 4-1: Manufacturer: syz [ 387.140071][ T1234] usb 4-1: SerialNumber: syz [ 387.303926][ T1218] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 387.455779][ T1218] usb 5-1: New USB device found, idVendor=13d8, idProduct=0020, bcdDevice=f7.31 [ 387.458039][ T1218] usb 5-1: config 128 interface 0 has no altsetting 0 [ 387.458078][ T1218] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.063479][ T9221] hub 1-0:1.0: USB hub found [ 388.068182][ T9221] hub 1-0:1.0: 1 port detected [ 388.473849][ T5706] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 388.625624][ T5706] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 388.643030][ T5706] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.643056][ T5706] usb 2-1: Product: syz [ 388.643070][ T5706] usb 2-1: Manufacturer: syz [ 388.643084][ T5706] usb 2-1: SerialNumber: syz [ 388.783472][ T1234] rtl8150 4-1:1.0: couldn't reset the device [ 388.801956][ T1234] rtl8150 4-1:1.0: probe with driver rtl8150 failed with error -5 [ 388.856029][ T1234] usb 4-1: USB disconnect, device number 32 [ 389.160920][ T5706] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 43 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 389.373871][ T1234] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 389.518656][ T9233] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 389.519021][ T9233] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 389.535418][ T1234] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 389.539852][ T1234] usb 4-1: config 0 has no interfaces? [ 389.568145][ T1234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.568172][ T1234] usb 4-1: Product: syz [ 389.568187][ T1234] usb 4-1: Manufacturer: syz [ 389.568228][ T1234] usb 4-1: SerialNumber: syz [ 389.618206][ T1234] usb 4-1: config 0 descriptor?? [ 389.682048][ T9238] sg_write: data in/out 19942/28615 bytes for SCSI command 0x32-- guessing data in; [ 389.682048][ T9238] program syz.0.757 not setting count and/or reply_len properly [ 389.843209][ T1218] usb 5-1: string descriptor 0 read error: -71 [ 389.896369][ T1218] usb 5-1: selecting invalid altsetting 3 [ 389.896395][ T1218] comedi comedi5: could not set alternate setting 3 in high speed [ 389.896411][ T1218] usbduxsigma 5-1:128.0: driver 'usbduxsigma' failed to auto-configure device. [ 389.918487][ T1218] usbduxsigma 5-1:128.0: probe with driver usbduxsigma failed with error -22 [ 389.959321][ T1218] usb 5-1: USB disconnect, device number 34 [ 389.999258][ T5672] usb 2-1: USB disconnect, device number 43 [ 390.013796][ T5672] usblp0: removed [ 390.014699][ T5706] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 390.168244][ T5706] usb 1-1: device descriptor read/64, error -71 [ 390.424448][ T5706] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 390.459593][ T9256] ptrace attach of "ci-upstream-kasan-gce-386/syz-executor exec"[5626] was attempted by "ci-upstream-kasan-gce-386/syz-executor exec"[9256] [ 390.576037][ T5706] usb 1-1: device descriptor read/64, error -71 [ 390.686087][ T5706] usb usb1-port1: attempt power cycle [ 391.043829][ T5706] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 391.075559][ T5706] usb 1-1: device descriptor read/8, error -71 [ 391.324034][ T5706] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 391.344747][ T5706] usb 1-1: device descriptor read/8, error -71 [ 391.455773][ T5706] usb usb1-port1: unable to enumerate USB device [ 391.731252][ T9263] netlink: 16 bytes leftover after parsing attributes in process `syz.1.763'. [ 392.222640][ T5706] usb 4-1: USB disconnect, device number 33 [ 392.622894][ T9273] netlink: 52 bytes leftover after parsing attributes in process `syz.3.765'. [ 392.774547][ T9248] syz.4.759 (9248): drop_caches: 2 [ 393.015643][ T9275] hub 1-0:1.0: USB hub found [ 393.016172][ T9275] hub 1-0:1.0: 1 port detected [ 394.456382][ T9283] netlink: 28 bytes leftover after parsing attributes in process `syz.0.767'. [ 394.685761][ T9287] hub 1-0:1.0: USB hub found [ 394.685984][ T9287] hub 1-0:1.0: 1 port detected [ 395.303945][ T5349] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 395.453944][ T5349] usb 5-1: Using ep0 maxpacket: 32 [ 395.454694][ T5349] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 395.456068][ T5349] usb 5-1: config index 0 descriptor too short (expected 27632, got 27) [ 395.456090][ T5349] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 395.456115][ T5349] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 395.456147][ T5349] usb 5-1: config 1 has no interface number 0 [ 395.456177][ T5349] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 395.456193][ T5349] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 395.456240][ T5349] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 395.584020][ T5349] snd_usb_pod 5-1:1.1: Line 6 Pocket POD found [ 395.703982][ T5349] snd_usb_pod 5-1:1.1: invalid control EP [ 395.703997][ T5349] snd_usb_pod 5-1:1.1: cannot start listening: -22 [ 395.704144][ T5349] snd_usb_pod 5-1:1.1: Line 6 Pocket POD now disconnected [ 395.704522][ T5349] snd_usb_pod 5-1:1.1: probe with driver snd_usb_pod failed with error -22 [ 396.048473][ T1234] usb 5-1: USB disconnect, device number 35 [ 396.085513][ T9309] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 396.085513][ T9309] program syz.1.772 not setting count and/or reply_len properly [ 396.088529][ T9309] netlink: 4 bytes leftover after parsing attributes in process `syz.1.772'. [ 396.736143][ T5349] usb 1-1: new full-speed USB device number 42 using dummy_hcd [ 396.897850][ T5349] usb 1-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 396.898893][ T5349] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 396.898936][ T5349] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 396.957594][ T5349] usb 1-1: config 0 descriptor?? [ 397.080644][ T9322] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 397.082846][ T9322] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 397.466737][ T5349] input: HID 0458:5005 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5005.0009/input/input37 [ 397.805248][ T5349] input: HID 0458:5005 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5005.0009/input/input38 [ 397.962555][ T9339] input: syz0 as /devices/virtual/input/input39 [ 398.038631][ T9343] netlink: 4 bytes leftover after parsing attributes in process `syz.1.778'. [ 398.090234][ T5349] kye 0003:0458:5005.0009: input,hiddev0,hidraw0: USB HID v7f.fd Device [HID 0458:5005] on usb-dummy_hcd.0-1/input0 [ 398.213053][ T9342] netlink: 52 bytes leftover after parsing attributes in process `syz.2.779'. [ 398.843767][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 399.580219][ T9348] usb 1-1: USB disconnect, device number 42 [ 401.689705][ T9369] netlink: 28 bytes leftover after parsing attributes in process `syz.1.783'. [ 401.826893][ T9374] MPI: mpi too large (113288 bits) [ 402.388391][ T9391] sg_write: data in/out 19942/28615 bytes for SCSI command 0x32-- guessing data in; [ 402.388391][ T9391] program syz.3.788 not setting count and/or reply_len properly [ 402.427126][ T9389] netlink: 4 bytes leftover after parsing attributes in process `syz.3.788'. [ 402.523815][ T5349] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 402.749424][ T5349] usb 3-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 402.772905][ T5349] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 402.772934][ T5349] usb 3-1: config 0 has no interfaces? [ 402.772956][ T5349] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.819963][ T5349] usb 3-1: config 0 descriptor?? [ 403.089374][ T9385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.107904][ T9385] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.023887][ T1234] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 404.143855][ T1218] usb 4-1: new low-speed USB device number 34 using dummy_hcd [ 404.167385][ T118] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 404.174002][ T1234] usb 2-1: Using ep0 maxpacket: 16 [ 404.178718][ T1234] usb 2-1: New USB device found, idVendor=046c, idProduct=14e8, bcdDevice= b.28 [ 404.188035][ T1234] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 404.188095][ T1234] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 404.188142][ T1234] usb 2-1: config 0 has no interface number 0 [ 404.209629][ T1234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.209694][ T1234] usb 2-1: Product: syz [ 404.209732][ T1234] usb 2-1: Manufacturer: syz [ 404.209764][ T1234] usb 2-1: SerialNumber: syz [ 404.254083][ T1234] usb 2-1: config 0 descriptor?? [ 404.289757][ T1234] uvcvideo 2-1:0.105: Found UVC 0.00 device syz (046c:14e8) [ 404.291521][ T1234] uvcvideo 2-1:0.105: No valid video chain found. [ 404.305976][ T1218] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 404.309427][ T1218] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 404.309498][ T1218] usb 4-1: config 0 has no interface number 0 [ 404.309596][ T1218] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 404.309659][ T1218] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 404.309762][ T1218] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 404.309825][ T1218] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 404.309898][ T1218] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 404.309958][ T1218] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 404.310077][ T1218] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.426983][ T1218] usb 4-1: config 0 descriptor?? [ 404.439535][ T9397] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 404.439683][ T9397] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 404.535006][ T1218] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 404.698272][ T5706] usb 2-1: USB disconnect, device number 44 [ 405.156575][ T9405] vivid-001: ================= START STATUS ================= [ 405.156644][ T9405] vivid-001: Radio HW Seek Mode: Bounded [ 405.177444][ T9405] vivid-001: Radio Programmable HW Seek: false [ 405.177474][ T9405] vivid-001: RDS Rx I/O Mode: Block I/O [ 405.182709][ T9405] vivid-001: Generate RBDS Instead of RDS: false [ 405.182738][ T9405] vivid-001: RDS Reception: true [ 405.182758][ T9405] vivid-001: RDS Program Type: 0 inactive [ 405.182857][ T9405] vivid-001: RDS PS Name: inactive [ 405.182908][ T9405] vivid-001: RDS Radio Text: inactive [ 405.182932][ T9405] vivid-001: RDS Traffic Announcement: false inactive [ 405.183029][ T9405] vivid-001: RDS Traffic Program: false inactive [ 405.183055][ T9405] vivid-001: RDS Music: false inactive [ 405.183079][ T9405] vivid-001: ================== END STATUS ================== [ 405.472465][ T5349] usb 3-1: string descriptor 0 read error: -71 [ 405.484510][ T5349] usb 3-1: USB disconnect, device number 36 [ 405.631975][ T9414] binder: 9409:9414 ioctl c0045005 800002c0 returned -22 [ 405.652214][ T9414] binder: 9409:9414 ioctl c0306201 0 returned -14 [ 405.923771][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 406.676575][ T9414] syz.0.792 (9414): drop_caches: 2 [ 407.261934][ T9431] input: syz0 as /devices/virtual/input/input40 [ 407.352779][ T5706] usb 4-1: USB disconnect, device number 34 [ 407.372766][ T9431] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 407.412122][ T5706] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 407.495911][ T9438] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 407.564236][ T9440] hub 1-0:1.0: USB hub found [ 407.568152][ T9440] hub 1-0:1.0: 1 port detected [ 407.569024][ T9436] netlink: 20 bytes leftover after parsing attributes in process `syz.2.795'. [ 407.789955][ T9447] netlink: 4 bytes leftover after parsing attributes in process `syz.4.794'. [ 407.852301][ T9449] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 407.902794][ T9451] hub 1-0:1.0: USB hub found [ 407.904717][ T9451] hub 1-0:1.0: 1 port detected [ 408.073887][ T1234] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 408.226377][ T1234] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 408.227910][ T1234] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.256588][ T1234] usb 3-1: config 0 descriptor?? [ 408.267923][ T1234] hub 3-1:0.0: bad descriptor, ignoring hub [ 408.267985][ T1234] hub 3-1:0.0: probe with driver hub failed with error -5 [ 408.288722][ T1234] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 409.726555][ T9455] netlink: 240 bytes leftover after parsing attributes in process `syz.3.798'. [ 409.890222][ T9461] netlink: 8 bytes leftover after parsing attributes in process `syz.0.800'. [ 409.892269][ T9462] netlink: 28 bytes leftover after parsing attributes in process `syz.4.799'. [ 409.964765][ T5706] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 410.124678][ T5706] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 410.129142][ T5706] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.129167][ T5706] usb 4-1: Product: syz [ 410.129181][ T5706] usb 4-1: Manufacturer: syz [ 410.129196][ T5706] usb 4-1: SerialNumber: syz [ 410.326269][ T1234] gp8psk: usb in 128 operation failed. [ 410.351927][ T1234] gp8psk: usb in 137 operation failed. [ 410.352498][ T1234] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 410.352541][ T1234] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 410.620936][ T5706] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 410.621024][ T5706] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 410.833583][ T9455] netlink: 32 bytes leftover after parsing attributes in process `syz.3.798'. [ 410.924165][ T1234] usb 3-1: USB disconnect, device number 37 [ 411.210754][ T12] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 411.277528][ T9478] syz.2.803 (9478): drop_caches: 2 [ 411.293674][ T9478] syz.2.803 (9478): drop_caches: 2 [ 411.568128][ T9481] netlink: 12 bytes leftover after parsing attributes in process `syz.4.805'. [ 411.757631][ T9484] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 411.778092][ T9484] syz.2.806 (9484): drop_caches: 2 [ 412.233902][ T1234] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 412.325663][ T5706] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000040. ret = -EPROTO [ 412.326112][ T5706] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 412.326569][ T5706] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 412.326621][ T5706] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 412.327215][ T5706] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 412.328824][ T5706] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 412.333000][ T5706] usb 4-1: USB disconnect, device number 35 [ 412.413794][ T1234] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 412.416344][ T1234] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 412.416363][ T1234] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 412.416377][ T1234] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 412.416406][ T1234] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 412.416423][ T1234] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 412.416442][ T1234] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 412.425229][ T1234] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 412.425288][ T1234] usb 3-1: Product: syz [ 412.425326][ T1234] usb 3-1: Manufacturer: syz [ 412.453951][ T5349] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 412.533456][ T9489] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 412.545705][ T1234] cdc_wdm 3-1:1.0: skipping garbage [ 412.545718][ T1234] cdc_wdm 3-1:1.0: skipping garbage [ 412.582985][ T1234] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 412.583072][ T1234] cdc_wdm 3-1:1.0: Unknown control protocol [ 412.644132][ T5349] usb 2-1: Using ep0 maxpacket: 32 [ 412.644740][ T5349] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 412.647084][ T5349] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 412.647109][ T5349] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 412.647127][ T5349] usb 2-1: config 0 has no interface number 0 [ 412.647811][ T5349] usb 2-1: config 0 interface 184 altsetting 7 endpoint 0x6 has invalid wMaxPacketSize 0 [ 412.647834][ T5349] usb 2-1: config 0 interface 184 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 412.647874][ T5349] usb 2-1: config 0 interface 184 has no altsetting 0 [ 412.651279][ T5349] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.651303][ T5349] usb 2-1: Product: syz [ 412.651318][ T5349] usb 2-1: Manufacturer: syz [ 412.651337][ T5349] usb 2-1: SerialNumber: syz [ 412.751927][ T5349] usb 2-1: config 0 descriptor?? [ 412.764647][ T5349] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 412.764881][ T5349] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -22 [ 412.807704][ C0] wdm_int_callback: 3034 callbacks suppressed [ 412.807752][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.807770][ C0] wdm_int_callback: 3034 callbacks suppressed [ 412.807784][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.808010][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.808028][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.808244][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.808262][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.808477][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.808495][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.808718][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.808738][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.808955][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.808973][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.809202][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.809219][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.809434][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.809451][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.809638][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.809650][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.809824][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 412.809836][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 412.850122][ T9489] input input41: cannot allocate more than FF_MAX_EFFECTS effects [ 412.876463][ T9489] netlink: 4 bytes leftover after parsing attributes in process `syz.2.808'. [ 412.917108][ T1234] usb 3-1: USB disconnect, device number 38 [ 414.209735][ T9511] input: syz0 as /devices/virtual/input/input42 [ 415.434970][ T5349] usb 2-1: USB disconnect, device number 45 [ 415.450250][ T9528] netlink: 'syz.0.824': attribute type 10 has an invalid length. [ 415.515851][ T9529] xt_l2tp: invalid flags combination: 0 [ 415.593412][ T9530] netlink: 8 bytes leftover after parsing attributes in process `syz.3.814'. [ 415.608958][ T9530] netlink: 8 bytes leftover after parsing attributes in process `syz.3.814'. [ 416.274868][ T9545] netlink: 16 bytes leftover after parsing attributes in process `syz.4.817'. [ 416.376633][ T5672] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 416.382342][ T9551] AppArmor: change_hat: Invalid input, NULL hat and NULL magic [ 416.534849][ T5672] usb 3-1: Using ep0 maxpacket: 8 [ 416.535690][ T5672] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 416.537469][ T5672] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 416.573820][ T5672] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.573844][ T5672] usb 3-1: Product: syz [ 416.573859][ T5672] usb 3-1: Manufacturer: syz [ 416.573873][ T5672] usb 3-1: SerialNumber: syz [ 416.609047][ T5672] usb 3-1: config 0 descriptor?? [ 416.631879][ T5672] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 416.661426][ T9554] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 12 out of range (51000000..2150000000) [ 417.078768][ T9544] netlink: 20 bytes leftover after parsing attributes in process `syz.2.816'. [ 417.078805][ T9544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.816'. [ 417.079290][ T9544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.816'. [ 417.079651][ T9544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.816'. [ 417.080028][ T9544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.816'. [ 417.092738][ T9544] netlink: 8 bytes leftover after parsing attributes in process `syz.2.816'. [ 417.354081][ T5672] gspca_zc3xx: reg_w_i err -110 [ 417.944154][ T5672] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 417.944219][ T5672] gspca_zc3xx 3-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 417.972932][ T5672] usb 3-1: USB disconnect, device number 39 [ 418.720321][ T9588] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.720448][ T9588] bridge0: port 1(bridge_slave_0) entered disabled state [ 418.828652][ T1234] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 418.995308][ T1234] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 418.998893][ T1234] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 418.998912][ T1234] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 418.998928][ T1234] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 418.998942][ T1234] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 418.998967][ T1234] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.001780][ T1234] usb 2-1: config 0 descriptor?? [ 419.150578][ T1218] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 419.272025][ T9587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.272374][ T9587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.287756][ T9587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.288083][ T9587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.302709][ T1218] usb 5-1: Using ep0 maxpacket: 16 [ 419.305972][ T1218] usb 5-1: New USB device found, idVendor=046c, idProduct=14e8, bcdDevice= b.28 [ 419.330497][ T1218] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 419.330515][ T1218] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 419.330527][ T1218] usb 5-1: config 0 has no interface number 0 [ 419.338042][ T1234] hdpvr 2-1:0.0: unexpected answer of status request, len -32 [ 419.338195][ T1234] hdpvr 2-1:0.0: device init failed [ 419.338514][ T1234] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12 [ 419.398700][ T1218] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.398731][ T1218] usb 5-1: Product: syz [ 419.398746][ T1218] usb 5-1: Manufacturer: syz [ 419.398762][ T1218] usb 5-1: SerialNumber: syz [ 419.431164][ T1218] usb 5-1: config 0 descriptor?? [ 419.436159][ T5702] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 419.467769][ T1218] uvcvideo 5-1:0.105: Found UVC 0.00 device syz (046c:14e8) [ 419.467795][ T1218] uvcvideo 5-1:0.105: No valid video chain found. [ 419.605093][ T5702] usb 4-1: Using ep0 maxpacket: 8 [ 419.605904][ T5702] usb 4-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 419.609584][ T5702] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 419.642472][ T5702] usb 4-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 419.642491][ T5702] usb 4-1: Product: syz [ 419.642501][ T5702] usb 4-1: Manufacturer: syz [ 419.642510][ T5702] usb 4-1: SerialNumber: syz [ 419.804869][ T1218] usb 5-1: USB disconnect, device number 36 [ 419.868413][ T5702] usb 4-1: Invalid connection information received from device [ 420.825685][ T9626] netlink: 'syz.4.831': attribute type 1 has an invalid length. [ 420.892410][ T9626] bond2: entered promiscuous mode [ 420.902006][ T9626] 8021q: adding VLAN 0 to HW filter on device bond2 [ 420.979762][ T9631] 8021q: adding VLAN 0 to HW filter on device bond2 [ 420.980083][ T9631] bond2: (slave ipip0): The slave device specified does not support setting the MAC address [ 420.980099][ T9631] bond2: (slave ipip0): Setting fail_over_mac to active for active-backup mode [ 421.023266][ T9631] bond2: (slave ipip0): making interface the new active one [ 421.023309][ T9631] ipip0: entered promiscuous mode [ 421.045167][ T9631] bond2: (slave ipip0): Enslaving as an active interface with an up link [ 421.722913][ T5702] usb 2-1: USB disconnect, device number 46 [ 421.925781][ T9647] program syz.1.833 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 421.938845][ T9647] __nla_validate_parse: 79 callbacks suppressed [ 421.938909][ T9647] netlink: 4 bytes leftover after parsing attributes in process `syz.1.833'. [ 423.644599][ T9670] binder: 9669:9670 ioctl c0306201 800002c0 returned -14 [ 423.720465][ T5702] usb 4-1: USB disconnect, device number 36 [ 424.028740][ T9686] netlink: 4 bytes leftover after parsing attributes in process `syz.0.835'. [ 424.239855][ T9688] program syz.3.837 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 424.289664][ T9688] netlink: 4 bytes leftover after parsing attributes in process `syz.3.837'. [ 426.143246][ T5702] hid_parser_main: 5 callbacks suppressed [ 426.143344][ T5702] hid-generic 0005:046E:0007.000A: unknown main item tag 0x1 [ 426.159105][ T9713] netlink: Conntrack attr has 4 unknown bytes [ 426.159259][ T9713] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 426.196668][ T5702] hid-generic 0005:046E:0007.000A: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 426.302148][ T9716] netlink: 4 bytes leftover after parsing attributes in process `syz.2.839'. [ 427.493799][ T5672] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 427.599062][ T9733] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 427.644200][ T5672] usb 4-1: Using ep0 maxpacket: 32 [ 427.644958][ T5672] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 427.647157][ T5672] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 427.650153][ T5672] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 427.650182][ T5672] usb 4-1: Product: syz [ 427.650195][ T5672] usb 4-1: Manufacturer: syz [ 427.650213][ T5672] usb 4-1: SerialNumber: syz [ 427.707809][ T5672] usb 4-1: config 0 descriptor?? [ 427.709368][ T9727] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 428.322704][ T9741] netlink: 52 bytes leftover after parsing attributes in process `syz.1.854'. [ 428.373834][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 428.693806][ T1234] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 428.850438][ T1234] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 428.851602][ T1234] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 428.851628][ T1234] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 428.851652][ T1234] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 428.851673][ T1234] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 428.851757][ T1234] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.893506][ T1234] usb 3-1: config 0 descriptor?? [ 429.012595][ T9748] netlink: 8 bytes leftover after parsing attributes in process `syz.0.846'. [ 429.300368][ T9743] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.300697][ T9743] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.338830][ T9743] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.339215][ T9743] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.408735][ T1234] hdpvr 3-1:0.0: unexpected answer of status request, len -32 [ 429.408770][ T1234] hdpvr 3-1:0.0: device init failed [ 429.408834][ T1234] hdpvr 3-1:0.0: probe with driver hdpvr failed with error -12 [ 429.646321][ T9752] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 429.646499][ T9752] block device autoloading is deprecated and will be removed. [ 430.043898][ T1234] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 430.196579][ T1234] usb 1-1: unable to get BOS descriptor or descriptor too short [ 430.196618][ T1234] usb 1-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.40 [ 430.198148][ T1234] usb 1-1: config 1 interface 0 has no altsetting 0 [ 430.202188][ T1234] usb 1-1: string descriptor 0 read error: -22 [ 430.202280][ T1234] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.384937][ T5349] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 430.536637][ T5349] usb 2-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 430.542526][ T5349] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 430.542547][ T5349] usb 2-1: config 0 has no interfaces? [ 430.542575][ T5349] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.591255][ T5349] usb 2-1: config 0 descriptor?? [ 430.689399][ T9767] syzkaller0: entered promiscuous mode [ 430.689466][ T9767] syzkaller0: entered allmulticast mode [ 430.722252][ T1218] usb 4-1: USB disconnect, device number 37 [ 430.846836][ T9765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.847286][ T9765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.991046][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 430.991080][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 430.991106][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 430.991130][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 430.991154][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 430.991176][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 430.991200][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 430.991222][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 430.991246][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147378][ T1234] hid_parser_main: 2092 callbacks suppressed [ 431.147402][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147438][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147464][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147480][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147519][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147541][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147562][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147585][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147605][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.147621][ T1234] glorious 0003:22D4:1503.000B: unknown main item tag 0x0 [ 431.377355][ T1234] glorious 0003:22D4:1503.000B: hidraw0: USB HID vff.7f Device [Glorious Model I] on usb-dummy_hcd.0-1/input0 [ 431.483966][ T9771] netlink: 4 bytes leftover after parsing attributes in process `syz.3.852'. [ 431.588415][ T1234] usb 3-1: USB disconnect, device number 40 [ 431.964313][ T1234] usb 1-1: USB disconnect, device number 43 [ 432.504400][ T1234] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 432.657490][ T1234] usb 3-1: Using ep0 maxpacket: 8 [ 432.680473][ T1234] usb 3-1: unable to get BOS descriptor or descriptor too short [ 432.680524][ T1234] usb 3-1: New USB device found, idVendor=2b73, idProduct=0013, bcdDevice= 1.40 [ 432.706650][ T1234] usb 3-1: config 1 has an invalid descriptor of length 145, skipping remainder of the config [ 432.706677][ T1234] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 432.711383][ T1234] usb 3-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 432.711406][ T1234] usb 3-1: Manufacturer: syz [ 433.224292][ T5702] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 433.375289][ T5702] usb 1-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 433.375320][ T5702] usb 1-1: too many configurations: 248, using maximum allowed: 8 [ 433.377321][ T5702] usb 1-1: config index 0 descriptor too short (expected 28277, got 36) [ 433.377350][ T5702] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.377363][ T5702] usb 1-1: config 0 has no interfaces? [ 433.380394][ T5702] usb 1-1: config index 1 descriptor too short (expected 28277, got 36) [ 433.380443][ T5702] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.380460][ T5702] usb 1-1: config 0 has no interfaces? [ 433.415425][ T5702] usb 1-1: config index 2 descriptor too short (expected 28277, got 36) [ 433.415528][ T5702] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.415576][ T5702] usb 1-1: config 0 has no interfaces? [ 433.484019][ T5702] usb 1-1: config index 3 descriptor too short (expected 28277, got 36) [ 433.484063][ T5702] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.484083][ T5702] usb 1-1: config 0 has no interfaces? [ 433.488482][ T5702] usb 1-1: config index 4 descriptor too short (expected 28277, got 36) [ 433.488500][ T5702] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.488512][ T5702] usb 1-1: config 0 has no interfaces? [ 433.493496][ T5702] usb 1-1: config index 5 descriptor too short (expected 28277, got 36) [ 433.493550][ T5702] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.493565][ T5702] usb 1-1: config 0 has no interfaces? [ 433.501295][ T5702] usb 1-1: config index 6 descriptor too short (expected 28277, got 36) [ 433.501349][ T5702] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.501395][ T5702] usb 1-1: config 0 has no interfaces? [ 433.516418][ T5702] usb 1-1: config index 7 descriptor too short (expected 28277, got 36) [ 433.516482][ T5702] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.516579][ T5702] usb 1-1: config 0 has no interfaces? [ 433.516664][ T5702] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.646017][ T5702] usb 1-1: config 0 descriptor?? [ 433.750212][ T5349] usb 2-1: string descriptor 0 read error: -71 [ 433.770384][ T5349] usb 2-1: USB disconnect, device number 47 [ 434.038156][ T5702] usb 1-1: string descriptor 0 read error: -71 [ 434.041207][ T5702] usb 1-1: USB disconnect, device number 44 [ 434.234203][ T9789] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.857' sets config #0 [ 434.236188][ T9790] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.857' sets config #1129335124 [ 434.510914][ T9804] openvswitch: netlink: Missing key (keys=40, expected=100) [ 434.761039][ T9809] netlink: 'syz.3.861': attribute type 1 has an invalid length. [ 434.761061][ T9809] netlink: 12 bytes leftover after parsing attributes in process `syz.3.861'. [ 434.785090][ T9808] hub 1-0:1.0: USB hub found [ 434.785397][ T9808] hub 1-0:1.0: 1 port detected [ 435.208459][ T9820] tipc: Failed to remove unknown binding: 66,0,0/0:1780791657/1780791659 [ 435.208500][ T9820] tipc: Failed to remove unknown binding: 66,0,0/0:1780791657/1780791658 [ 435.211457][ T9820] tipc: Failed to remove unknown binding: 66,0,0/0:1780791657/1780791659 [ 435.219609][ T9820] tipc: Failed to remove unknown binding: 66,0,0/0:1780791657/1780791658 [ 435.656678][ T9818] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 435.776898][ T9831] usb usb7: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 436.054087][ T5706] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 436.054288][ T5349] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 436.207220][ T5706] usb 5-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 436.210267][ T5349] usb 2-1: unable to get BOS descriptor or descriptor too short [ 436.210972][ T5706] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 436.210995][ T5706] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 436.211017][ T5706] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 436.211052][ T5706] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 436.211077][ T5706] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.212210][ T5349] usb 2-1: not running at top speed; connect to a high speed hub [ 436.212239][ T5349] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0323, bcdDevice=a7.8f [ 436.218190][ T5349] usb 2-1: config index 0 descriptor too short (expected 28771, got 10) [ 436.218246][ T5349] usb 2-1: config 114 has too many interfaces: 95, using maximum allowed: 32 [ 436.218307][ T5349] usb 2-1: config 114 descriptor has 1 excess byte, ignoring [ 436.218360][ T5349] usb 2-1: config 114 has 0 interfaces, different from the descriptor's value: 95 [ 436.301825][ T5349] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.301902][ T5349] usb 2-1: Product: syz [ 436.301956][ T5349] usb 2-1: Manufacturer: syz [ 436.301987][ T5349] usb 2-1: SerialNumber: syz [ 436.304422][ T5706] usb 5-1: config 0 descriptor?? [ 436.597440][ T9830] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.612609][ T9830] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.622677][ T9831] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.623388][ T9831] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.649974][ T9830] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.668565][ T9830] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.686809][ T5706] hdpvr 5-1:0.0: unexpected answer of status request, len -32 [ 436.686829][ T5706] hdpvr 5-1:0.0: device init failed [ 436.686898][ T5706] hdpvr 5-1:0.0: probe with driver hdpvr failed with error -12 [ 436.722521][ T5349] usb 2-1: USB disconnect, device number 48 [ 436.853020][ T9833] tipc: Started in network mode [ 436.853063][ T9833] tipc: Node identity 7f000001, cluster identity 4711 [ 436.853100][ T9833] tipc: Enabling of bearer rejected, failed to enable media [ 436.972732][ T9833] tipc: Enabling of bearer rejected, failed to enable media [ 437.168949][ T9839] netlink: 68 bytes leftover after parsing attributes in process `syz.0.868'. [ 437.693215][ T1234] usb 3-1: 0:1 : does not exist [ 437.761993][ T1234] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 437.774490][ T1234] usb 3-1: USB disconnect, device number 41 [ 437.822445][ T5616] udevd[5616]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 438.772800][ T5349] usb 5-1: USB disconnect, device number 37 [ 438.910521][ T9862] hub 1-0:1.0: USB hub found [ 438.910828][ T9862] hub 1-0:1.0: 1 port detected [ 439.896946][ T9872] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 440.005470][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.005509][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.104203][ T5349] usb 2-1: new low-speed USB device number 49 using dummy_hcd [ 440.200061][ T9880] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 440.254678][ T5349] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 440.255791][ T5349] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 440.255809][ T5349] usb 2-1: config 0 has no interface number 0 [ 440.255836][ T5349] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 440.255851][ T5349] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 440.255870][ T5349] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 440.255888][ T5349] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 440.255906][ T5349] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 440.255948][ T5349] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 440.255985][ T5349] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.260641][ T5349] usb 2-1: config 0 descriptor?? [ 440.262387][ T9873] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 440.262509][ T9873] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 440.416220][ T5349] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 440.486786][ T9882] syz.0.877 (9882): drop_caches: 2 [ 440.669433][ T9884] vivid-002: ================= START STATUS ================= [ 440.669561][ T9884] vivid-002: Radio HW Seek Mode: Bounded [ 440.669619][ T9884] vivid-002: Radio Programmable HW Seek: false [ 440.669748][ T9884] vivid-002: RDS Rx I/O Mode: Block I/O [ 440.669768][ T9884] vivid-002: Generate RBDS Instead of RDS: false [ 440.669788][ T9884] vivid-002: RDS Reception: true [ 440.669808][ T9884] vivid-002: RDS Program Type: 0 inactive [ 440.669833][ T9884] vivid-002: RDS PS Name: inactive [ 440.669959][ T9884] vivid-002: RDS Radio Text: inactive [ 440.669999][ T9884] vivid-002: RDS Traffic Announcement: false inactive [ 440.670025][ T9884] vivid-002: RDS Traffic Program: false inactive [ 440.670123][ T9884] vivid-002: RDS Music: false inactive [ 440.670148][ T9884] vivid-002: ================== END STATUS ================== [ 442.951351][ T9909] vim2m vim2m.0: Fourcc format (0x31384142) invalid. [ 443.271754][ T9916] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 443.271754][ T9916] program syz.0.883 not setting count and/or reply_len properly [ 443.386682][ T5349] usb 2-1: USB disconnect, device number 49 [ 443.399942][ T5706] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 443.413320][ T5349] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 443.546160][ T5706] usb 5-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 443.547980][ T5706] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 443.548001][ T5706] usb 5-1: config 0 has no interfaces? [ 443.548041][ T5706] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.555114][ T1234] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 443.602683][ T5706] usb 5-1: config 0 descriptor?? [ 443.714153][ T1234] usb 1-1: device descriptor read/64, error -71 [ 443.822627][ T9909] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 443.840402][ T9909] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.974596][ T1234] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 444.033835][ T5702] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 444.116681][ T1234] usb 1-1: device descriptor read/64, error -71 [ 444.193844][ T5702] usb 2-1: Using ep0 maxpacket: 8 [ 444.194669][ T5702] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 444.195826][ T5702] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 444.195897][ T5702] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 444.195913][ T5702] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 444.195929][ T5702] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 444.195945][ T5702] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 444.195994][ T5702] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.275290][ T1234] usb usb1-port1: attempt power cycle [ 444.424345][ T5702] usb 2-1: GET_CAPABILITIES returned 0 [ 444.424395][ T5702] usbtmc 2-1:16.0: can't read capabilities [ 444.637212][ T1234] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 444.637749][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640047][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640081][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640110][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640157][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640352][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640383][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640413][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640453][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640481][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640679][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640707][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640733][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640760][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.640786][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 444.641016][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -2 [ 444.670614][ T1234] usb 1-1: device descriptor read/8, error -71 [ 444.944612][ T1234] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 444.964524][ T1234] usb 1-1: device descriptor read/8, error -71 [ 445.047815][ T9927] binder: 9925:9927 ioctl c0306201 800003c0 returned -14 [ 445.074716][ T1234] usb usb1-port1: unable to enumerate USB device [ 445.801997][ T5706] usb 5-1: string descriptor 0 read error: -71 [ 445.811365][ T5706] usb 5-1: USB disconnect, device number 38 [ 445.890418][ T9936] binder: 9933:9936 ioctl c0306201 800002c0 returned -14 [ 445.999953][ T9939] netlink: 'syz.4.890': attribute type 10 has an invalid length. [ 446.002126][ T9939] ipvlan0: entered allmulticast mode [ 446.002146][ T9939] veth0_vlan: entered allmulticast mode [ 446.042320][ T9939] team0: Device ipvlan0 failed to register rx_handler [ 446.211596][ T9939] bond3: (slave bond_slave_1): Device is not our slave [ 446.211613][ T9939] bond3: option active_slave: invalid value (bond_slave_1) [ 446.229890][ T9939] bond3 (unregistering): Released all slaves [ 446.984537][ T9] usb 2-1: USB disconnect, device number 50 [ 447.919099][ T9944] hub 1-0:1.0: USB hub found [ 447.920904][ T9944] hub 1-0:1.0: 1 port detected [ 448.004623][ T9950] dummy0: left promiscuous mode [ 448.014314][ T9950] team0: Port device dummy0 removed [ 448.033343][ T9950] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 12 out of range (51000000..2150000000) [ 450.069290][ T9990] netlink: 28 bytes leftover after parsing attributes in process `syz.4.900'. [ 450.341206][ T9992] netlink: 4 bytes leftover after parsing attributes in process `syz.0.899'. [ 450.346637][ T9992] netlink: 192 bytes leftover after parsing attributes in process `syz.0.899'. [ 451.623460][ T9999] netlink: 4 bytes leftover after parsing attributes in process `syz.4.904'. [ 451.651958][ T9996] sit0: entered promiscuous mode [ 451.651973][ T9996] sit0: entered allmulticast mode [ 451.711495][ T9998] tipc: Started in network mode [ 451.711516][ T9998] tipc: Node identity 00000000000040000000000000000001, cluster identity 4711 [ 451.711567][ T9998] tipc: Enabling of bearer rejected, failed to enable media [ 451.973939][ T5702] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 452.130994][ T5702] usb 5-1: Using ep0 maxpacket: 8 [ 452.131803][ T5702] usb 5-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 452.133651][ T5702] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 1536, setting to 64 [ 452.133682][ T5702] usb 5-1: config 0 interface 0 has no altsetting 0 [ 452.199108][ T5702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.199135][ T5702] usb 5-1: Product: syz [ 452.199144][ T5702] usb 5-1: Manufacturer: syz [ 452.199154][ T5702] usb 5-1: SerialNumber: syz [ 452.201924][ T5702] usb 5-1: config 0 descriptor?? [ 452.241000][ T5702] snd_usb_toneport 5-1:0.0: Line 6 TonePort UX2 found [ 452.413233][ T5702] snd_usb_toneport 5-1:0.0: Line 6 TonePort UX2 now disconnected [ 452.425498][ T5702] snd_usb_toneport 5-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 452.632753][ T9] usb 5-1: USB disconnect, device number 39 [ 452.833009][T10009] fuse: Unknown parameter 'default_permissionskvm' [ 453.239781][T10019] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 453.239781][T10019] program syz.1.908 not setting count and/or reply_len properly [ 453.354442][T10016] hub 1-0:1.0: USB hub found [ 453.355176][T10016] hub 1-0:1.0: 1 port detected [ 453.504686][ T5706] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 453.635438][ T5706] usb 2-1: device descriptor read/64, error -71 [ 453.730948][T10027] netlink: 20 bytes leftover after parsing attributes in process `syz.4.909'. [ 453.857334][ T9967] ALSA: mixer_oss: invalid OSS volume '' [ 453.874524][ T5706] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 453.931567][T10027] bond0: (slave bond_slave_1): Releasing backup interface [ 454.004529][ T5706] usb 2-1: device descriptor read/64, error -71 [ 454.114492][ T5706] usb usb2-port1: attempt power cycle [ 454.274319][ T9] usb 5-1: new full-speed USB device number 40 using dummy_hcd [ 454.428375][ T9] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 454.452215][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.453907][ T5706] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 454.470505][ T9] usb 5-1: config 0 descriptor?? [ 454.480600][ T5706] usb 2-1: device descriptor read/8, error -71 [ 454.506142][ T9] hub 5-1:0.0: bad descriptor, ignoring hub [ 454.506160][ T9] hub 5-1:0.0: probe with driver hub failed with error -5 [ 454.520223][ T9] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 454.714603][ T5706] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 454.745485][ T5706] usb 2-1: device descriptor read/8, error -71 [ 454.854196][ T5706] usb usb2-port1: unable to enumerate USB device [ 456.381020][T10044] binder: 10036:10044 ioctl c0045005 800002c0 returned -22 [ 456.381326][T10044] binder: 10036:10044 ioctl c0306201 0 returned -14 [ 456.564639][ T9] gp8psk: usb in 128 operation failed. [ 456.564982][ T9] gp8psk: usb in 137 operation failed. [ 456.565027][ T9] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 456.565127][ T9] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 456.613805][ T5349] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 456.764468][ T5349] usb 3-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 456.765864][ T5349] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.772118][ T5349] usb 3-1: config 0 descriptor?? [ 457.185421][ T9] usb 5-1: USB disconnect, device number 40 [ 457.257021][ T32] kauditd_printk_skb: 40 callbacks suppressed [ 457.257042][ T32] audit: type=1400 audit(1790256488.647:1146): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=10040 comm="syz.2.912" [ 457.371411][T10050] netlink: 28 bytes leftover after parsing attributes in process `syz.4.914'. [ 457.491271][ T5349] hackrf 3-1:0.0: usb_control_msg() failed -71 request 0f [ 457.491293][ T5349] hackrf 3-1:0.0: Could not detect board [ 457.491327][ T5349] hackrf 3-1:0.0: probe with driver hackrf failed with error -71 [ 457.506897][ T5349] usb 3-1: USB disconnect, device number 42 [ 458.784736][T10071] hub 1-0:1.0: USB hub found [ 458.784948][T10071] hub 1-0:1.0: 1 port detected [ 459.020440][T10072] netlink: 8 bytes leftover after parsing attributes in process `syz.3.917'. [ 459.103575][T10074] netlink: 4 bytes leftover after parsing attributes in process `syz.0.920'. [ 459.103612][T10074] netlink: 4 bytes leftover after parsing attributes in process `syz.0.920'. [ 459.128624][T10074] netlink: 14544 bytes leftover after parsing attributes in process `syz.0.920'. [ 459.419766][T10080] netlink: 4 bytes leftover after parsing attributes in process `syz.4.921'. [ 459.505228][T10080] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 459.505388][T10080] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 459.535835][T10080] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 459.535858][T10080] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 459.771580][T10087] hub 1-0:1.0: USB hub found [ 459.779824][T10087] hub 1-0:1.0: 1 port detected [ 459.881204][T10089] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 459.881204][T10089] program syz.0.923 not setting count and/or reply_len properly [ 460.224095][ T5702] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 460.281311][T10094] ALSA: mixer_oss: invalid OSS volume '' [ 460.384079][ T5702] usb 1-1: Using ep0 maxpacket: 16 [ 460.387410][ T5702] usb 1-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 460.388920][ T5702] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 460.388986][ T5702] usb 1-1: config 0 has an invalid descriptor of length 20, skipping remainder of the config [ 460.389027][ T5702] usb 1-1: config 0 has no interface number 0 [ 460.389146][ T5702] usb 1-1: config 0 interface 35 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 460.410532][ T5702] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.410551][ T5702] usb 1-1: Product: syz [ 460.410562][ T5702] usb 1-1: Manufacturer: syz [ 460.410573][ T5702] usb 1-1: SerialNumber: syz [ 460.482671][ T5702] usb 1-1: config 0 descriptor?? [ 460.497621][ T5702] cypress_m8 1-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 460.522527][ T5702] nokiaca42v2 ttyUSB0: required endpoint is missing [ 460.545363][ T1234] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 460.714056][ T1234] usb 5-1: Using ep0 maxpacket: 8 [ 460.740389][T10084] netlink: 4 bytes leftover after parsing attributes in process `syz.0.923'. [ 460.752749][ T9] usb 1-1: USB disconnect, device number 49 [ 460.775666][ T1234] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 460.796012][ T9] cypress_m8 1-1:0.35: device disconnected [ 460.950255][ T1234] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 460.950358][ T1234] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.002987][ T1234] usb 5-1: config 0 descriptor?? [ 461.060265][T10103] binder: 10097:10103 ioctl c0045005 800002c0 returned -22 [ 461.072983][T10103] binder: 10097:10103 ioctl c0306201 0 returned -14 [ 461.374050][ T1234] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 461.730863][T10107] netlink: 12 bytes leftover after parsing attributes in process `syz.4.924'. [ 462.923387][T10113] netlink: 8 bytes leftover after parsing attributes in process `syz.2.928'. [ 463.103538][T10113] vlan2: entered promiscuous mode [ 463.103563][T10113] bond0: entered promiscuous mode [ 463.305295][T10113] netlink: 284 bytes leftover after parsing attributes in process `syz.2.928'. [ 463.395385][T10121] hub 1-0:1.0: USB hub found [ 463.395734][T10121] hub 1-0:1.0: 1 port detected [ 463.427273][T10122] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 463.427273][T10122] program syz.1.929 not setting count and/or reply_len properly [ 463.704952][ T1234] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 463.876097][ T1234] usb 2-1: Using ep0 maxpacket: 16 [ 463.879283][ T1234] usb 2-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 463.881708][ T1234] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 463.881770][ T1234] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 463.942693][ T1234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.942754][ T1234] usb 2-1: Product: syz [ 463.942789][ T1234] usb 2-1: Manufacturer: syz [ 463.942825][ T1234] usb 2-1: SerialNumber: syz [ 463.989319][ T1234] usb 2-1: config 0 descriptor?? [ 464.231390][T10117] netlink: 4 bytes leftover after parsing attributes in process `syz.1.929'. [ 464.544067][ T1234] usb 5-1: USB disconnect, device number 41 [ 465.057778][T10146] hub 1-0:1.0: USB hub found [ 465.062882][T10146] hub 1-0:1.0: 1 port detected [ 465.140673][ T5349] usb 2-1: USB disconnect, device number 55 [ 465.542755][T10153] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 465.542755][T10153] program syz.3.937 not setting count and/or reply_len properly [ 465.814122][ T1234] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 465.951194][ T1234] usb 4-1: device descriptor read/64, error -71 [ 466.204205][ T1234] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 466.335446][ T1234] usb 4-1: device descriptor read/64, error -71 [ 466.454843][ T1234] usb usb4-port1: attempt power cycle [ 466.805909][ T1234] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 466.826916][ T1234] usb 4-1: device descriptor read/8, error -71 [ 467.084600][ T1234] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 467.126550][ T1234] usb 4-1: device descriptor read/8, error -71 [ 467.237077][ T1234] usb usb4-port1: unable to enumerate USB device [ 467.658546][T10164] binder: 10160:10164 ioctl c0045005 800002c0 returned -22 [ 467.658897][T10164] binder: 10160:10164 ioctl c0306201 0 returned -14 [ 468.038313][T10166] nvme nvme0: rdma connection establishment failed (-104) [ 468.065687][ T9] usb 2-1: new full-speed USB device number 56 using dummy_hcd [ 468.214586][ T9] usb 2-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=ba.be [ 468.217850][ T9] usb 2-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 468.217874][ T9] usb 2-1: Product: syz [ 468.217890][ T9] usb 2-1: Manufacturer: syz [ 468.217909][ T9] usb 2-1: SerialNumber: syz [ 468.270208][ T9] usb 2-1: config 0 descriptor?? [ 468.522274][ T9] peak_usb 2-1:0.0: PEAK-System PCAN-Chip USB v2 fw v77.153.104 (1 channels) [ 468.727178][ T9] peak_usb 2-1:0.0 can0: sending command failure: -8 [ 468.727272][ T9] peak_usb 2-1:0.0 can0: sending command failure: -8 [ 468.727418][ T9] peak_usb 2-1:0.0 can0: sending command failure: -8 [ 468.825347][ T9] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -8 [ 468.948470][T10174] hub 1-0:1.0: USB hub found [ 468.953547][T10174] hub 1-0:1.0: 1 port detected [ 468.969128][T10169] futex_wake_op: syz.1.941 tries to shift op by -1; fix this program [ 468.982437][T10169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.982873][T10169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.178155][T10178] binder: 10168:10178 ioctl f502 0 returned -22 [ 469.410227][T10169] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(17) [ 469.410256][T10169] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 469.434278][T10169] vhci_hcd vhci_hcd.0: Device attached [ 469.675782][ T5702] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 469.946813][T10191] hub 1-0:1.0: USB hub found [ 469.947152][T10191] hub 1-0:1.0: 1 port detected [ 470.526140][T10197] vim2m vim2m.0: Fourcc format (0x31384142) invalid. [ 470.981217][ T9] usb 1-1: new full-speed USB device number 50 using dummy_hcd [ 471.078331][T10184] vhci_hcd: connection reset by peer [ 471.106710][ T118] vhci_hcd vhci_hcd.1: stop threads [ 471.107193][ T118] vhci_hcd vhci_hcd.1: release socket [ 471.132531][ T118] vhci_hcd vhci_hcd.1: disconnect device [ 471.148172][ T9] usb 1-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 471.150506][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 471.150529][ T9] usb 1-1: config 0 has no interfaces? [ 471.150557][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.187411][ T9] usb 1-1: config 0 descriptor?? [ 471.464176][T10197] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 471.486439][T10197] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 471.701162][ T1218] usb 2-1: USB disconnect, device number 56 [ 472.843737][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 473.463425][T10210] bridge3: entered promiscuous mode [ 473.463490][T10210] bridge3: entered allmulticast mode [ 473.682153][T10210] team0: Port device bridge3 added [ 473.682668][T10203] bridge0: port 1(team0) entered blocking state [ 473.682798][T10203] bridge0: port 1(team0) entered disabled state [ 473.682958][T10203] team0: entered allmulticast mode [ 473.957152][T10203] team0: entered promiscuous mode [ 473.981351][T10203] bridge0: port 1(team0) entered blocking state [ 473.981513][T10203] bridge0: port 1(team0) entered forwarding state [ 474.794134][ T5702] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 475.949333][ T9] usb 1-1: string descriptor 0 read error: -71 [ 475.995888][ T9] usb 1-1: USB disconnect, device number 50 [ 477.493995][ T5702] usb 3-1: new full-speed USB device number 43 using dummy_hcd [ 477.645028][ T5702] usb 3-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 477.653624][ T5702] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 477.745351][ T5672] usb 5-1: new full-speed USB device number 42 using dummy_hcd [ 477.762863][ T5702] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.762882][ T5702] usb 3-1: Product: syz [ 477.762905][ T5702] usb 3-1: Manufacturer: syz [ 477.762915][ T5702] usb 3-1: SerialNumber: syz [ 477.900490][ T5672] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 477.928445][ T5672] usb 5-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x79, changing to 0x9 [ 477.928474][ T5672] usb 5-1: config 0 interface 0 altsetting 255 endpoint 0x9 has an invalid bInterval 0, changing to 4 [ 477.928498][ T5672] usb 5-1: config 0 interface 0 altsetting 255 endpoint 0x9 has invalid wMaxPacketSize 0 [ 477.928519][ T5672] usb 5-1: config 0 interface 0 has no altsetting 0 [ 477.947936][ T5702] usb 3-1: config 0 descriptor?? [ 478.005317][ T5672] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 478.005345][ T5672] usb 5-1: Product: syz [ 478.005360][ T5672] usb 5-1: Manufacturer: syz [ 478.005375][ T5672] usb 5-1: SerialNumber: syz [ 478.112320][ T5672] usb 5-1: config 0 descriptor?? [ 478.175244][ T5702] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 478.222765][ T5672] usb 5-1: selecting invalid altsetting 0 [ 478.414118][ T5687] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 478.515669][T10248] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.585936][ T5687] usb 2-1: Using ep0 maxpacket: 16 [ 478.593435][ T5687] usb 2-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 478.620136][T10248] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 478.638239][ T5687] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 478.638324][ T5687] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 478.638357][ T5687] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 478.639682][ T5672] usb 5-1: USB disconnect, device number 42 [ 478.688540][ T5687] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.688592][ T5687] usb 2-1: Product: syz [ 478.688628][ T5687] usb 2-1: Manufacturer: syz [ 478.688638][ T5687] usb 2-1: SerialNumber: syz [ 478.719068][ T5687] usb 2-1: config 0 descriptor?? [ 478.719565][ T5702] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 478.719654][ T5702] gspca_pac7302 3-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 478.766329][ T5687] mcba_usb 2-1:0.0: Can't find endpoints [ 479.240260][ T6945] udevd[6945]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 480.929774][T10266] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 480.929774][T10266] program syz.3.960 not setting count and/or reply_len properly [ 481.066642][T10268] netlink: 12 bytes leftover after parsing attributes in process `syz.4.961'. [ 481.137973][T10268] ip6gretap0: entered promiscuous mode [ 481.187600][ T5702] usb 2-1: USB disconnect, device number 57 [ 481.204338][ T5687] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 481.354036][ T5687] usb 4-1: Using ep0 maxpacket: 16 [ 481.360578][ T5687] usb 4-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 481.377583][ T5687] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 481.377625][ T5687] usb 4-1: config 0 has no interface number 0 [ 481.377715][ T5687] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 481.382366][ T5687] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.382395][ T5687] usb 4-1: Product: syz [ 481.382405][ T5687] usb 4-1: Manufacturer: syz [ 481.382461][ T5687] usb 4-1: SerialNumber: syz [ 481.442276][ T5687] usb 4-1: config 0 descriptor?? [ 481.457453][ T5687] cypress_m8 4-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 481.655770][ T5702] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 481.791003][ T5687] usb 4-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 481.812635][ T5687] usb 4-1: USB disconnect, device number 42 [ 481.844675][ T5687] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 481.847629][ T5687] cypress_m8 4-1:0.35: device disconnected [ 481.849464][ T5702] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 481.851944][ T5702] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.921712][ T5702] usb 2-1: config 0 descriptor?? [ 482.144591][T10272] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 482.147486][T10272] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 482.376126][ T5687] usb 3-1: USB disconnect, device number 43 [ 482.412369][T10276] netlink: 28 bytes leftover after parsing attributes in process `syz.4.963'. [ 482.512408][ T5702] usb 2-1: Cannot set MAC address [ 482.512642][ T5702] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 482.547660][ T5702] usb 2-1: USB disconnect, device number 58 [ 482.948574][T10284] netlink: 'syz.2.964': attribute type 10 has an invalid length. [ 482.972232][T10286] vim2m vim2m.0: Fourcc format (0x31384142) invalid. [ 483.072571][T10287] netlink: 'syz.2.964': attribute type 10 has an invalid length. [ 483.184632][T10281] ksmbd: Unknown IPC event: 3, ignore. [ 483.264096][ T5672] usb 4-1: new full-speed USB device number 43 using dummy_hcd [ 483.424632][ T5672] usb 4-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 483.426345][ T5672] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 483.426369][ T5672] usb 4-1: config 0 has no interfaces? [ 483.426410][ T5672] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 483.474872][ T5672] usb 4-1: config 0 descriptor?? [ 483.750519][T10286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.751074][T10286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.332966][T10284] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 484.384600][T10284] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 484.388466][T10284] netdevsim netdevsim2 netdevsim1: entered allmulticast mode [ 484.483965][ T9] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 484.508888][T10284] team0: Port device netdevsim1 added [ 484.522785][T10287] netdevsim netdevsim2 netdevsim1: left promiscuous mode [ 484.531341][T10287] netdevsim netdevsim2 netdevsim1: left allmulticast mode [ 484.613853][ T9] usb 5-1: device descriptor read/64, error -71 [ 484.617294][T10287] team0: Port device netdevsim1 removed [ 484.674221][T10287] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 484.702567][T10287] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 484.719922][T10287] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 484.863936][ T9] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 485.001170][ T9] usb 5-1: device descriptor read/64, error -71 [ 485.104415][ T9] usb usb5-port1: attempt power cycle [ 485.420827][T10261] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 485.444781][ T9] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 485.479563][ T9] usb 5-1: device descriptor read/8, error -71 [ 485.510092][T10300] sg_write: data in/out 19942/29284 bytes for SCSI command 0x32-- guessing data in; [ 485.510092][T10300] program syz.1.968 not setting count and/or reply_len properly [ 485.713837][ T9] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 485.735677][ T9] usb 5-1: device descriptor read/8, error -71 [ 485.787447][ T5687] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 485.844332][ T9] usb usb5-port1: unable to enumerate USB device [ 485.924031][ T5687] usb 2-1: device descriptor read/64, error -71 [ 485.995952][ T5672] usb 4-1: string descriptor 0 read error: -71 [ 486.002978][ T5672] usb 4-1: USB disconnect, device number 43 [ 486.177532][ T5687] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 486.317855][T10306] tipc: Invalid UDP bearer configuration [ 486.317905][T10306] tipc: Enabling of bearer rejected, failed to enable media [ 486.354967][ T5687] usb 2-1: device descriptor read/64, error -71 [ 486.375128][T10305] hub 1-0:1.0: USB hub found [ 486.375512][T10305] hub 1-0:1.0: 1 port detected [ 486.466682][ T5687] usb usb2-port1: attempt power cycle [ 486.814460][ T5687] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 486.834646][ T5687] usb 2-1: device descriptor read/8, error -71 [ 486.959294][T10317] netlink: 20 bytes leftover after parsing attributes in process `syz.3.973'. [ 487.097644][ T5687] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 487.133359][ T5687] usb 2-1: device descriptor read/8, error -71 [ 487.244290][ T5687] usb usb2-port1: unable to enumerate USB device [ 487.268430][ T5702] usb 4-1: new full-speed USB device number 44 using dummy_hcd [ 487.416459][T10319] tipc: Enabling of bearer rejected, failed to enable media [ 487.476785][ T5702] usb 4-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 487.529673][ T5702] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.545726][ T5702] usb 4-1: config 0 descriptor?? [ 487.582713][ T5702] hub 4-1:0.0: bad descriptor, ignoring hub [ 487.582732][ T5702] hub 4-1:0.0: probe with driver hub failed with error -5 [ 487.605201][ T5702] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 487.699715][T10319] tipc: Enabling of bearer rejected, failed to enable media [ 487.736961][T10322] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 487.736961][T10322] program syz.0.975 not setting count and/or reply_len properly [ 488.014955][ T5687] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 488.137312][T10326] binder: 10323:10326 ioctl c0045005 800002c0 returned -22 [ 488.139954][T10326] binder: 10323:10326 ioctl c0306201 0 returned -14 [ 488.189738][ T5687] usb 1-1: Using ep0 maxpacket: 16 [ 488.205370][ T5687] usb 1-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 488.212436][ T5687] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 488.212452][ T5687] usb 1-1: config 0 has no interface number 0 [ 488.212502][ T5687] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 488.264517][ T5687] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.264554][ T5687] usb 1-1: Product: syz [ 488.264577][ T5687] usb 1-1: Manufacturer: syz [ 488.264587][ T5687] usb 1-1: SerialNumber: syz [ 488.303143][ T5687] usb 1-1: config 0 descriptor?? [ 488.328473][ T5687] cypress_m8 1-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 488.500289][T10326] syz.4.976 (10326): drop_caches: 2 [ 488.549374][ T5687] usb 1-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 488.601503][ T5687] usb 1-1: USB disconnect, device number 51 [ 488.702839][ T5687] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 488.730691][ T5687] cypress_m8 1-1:0.35: device disconnected [ 489.100640][T10332] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 489.122783][T10332] qrtr: Invalid version 0 [ 489.373795][ T5672] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 489.527493][ T5672] usb 2-1: Using ep0 maxpacket: 32 [ 489.531976][ T5672] usb 2-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 489.548764][ T5672] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 489.548824][ T5672] usb 2-1: config 1 interface 1 altsetting 1 has an invalid endpoint descriptor of length 4, skipping [ 489.575114][ T5672] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.575141][ T5672] usb 2-1: Product: syz [ 489.575156][ T5672] usb 2-1: Manufacturer: syz [ 489.575170][ T5672] usb 2-1: SerialNumber: syz [ 489.689741][ T5702] gp8psk: usb in 128 operation failed. [ 489.698882][ T5702] gp8psk: usb in 137 operation failed. [ 489.698929][ T5702] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 489.699077][ T5702] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 490.044788][ T5349] usb 4-1: USB disconnect, device number 44 [ 490.225249][T10338] netlink: 52 bytes leftover after parsing attributes in process `syz.0.979'. [ 491.162362][T10346] hub 1-0:1.0: USB hub found [ 491.163630][T10346] hub 1-0:1.0: 1 port detected [ 491.345987][T10348] netlink: 4 bytes leftover after parsing attributes in process `syz.3.981'. [ 491.522003][T10344] netlink: 192 bytes leftover after parsing attributes in process `syz.3.981'. [ 492.294373][T10350] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 12 out of range (51000000..2150000000) [ 492.855977][ T5672] snd-ua101 2-1:1.1: invalid bNumEndpoints [ 492.856084][ T5672] snd-ua101 2-1:1.0: invalid num_altsetting [ 492.888822][ T5672] usb 2-1: USB disconnect, device number 63 [ 493.048922][T10363] netlink: 8 bytes leftover after parsing attributes in process `syz.0.986'. [ 493.092672][T10363] vlan2: entered promiscuous mode [ 493.195550][T10363] netlink: 284 bytes leftover after parsing attributes in process `syz.0.986'. [ 493.245870][T10366] netlink: 4 bytes leftover after parsing attributes in process `syz.2.984'. [ 493.509909][T10364] tipc: Enabling of bearer rejected, failed to enable media [ 493.570164][T10370] tipc: Started in network mode [ 493.570197][T10370] tipc: Node identity 7f000001, cluster identity 4711 [ 493.570248][T10370] tipc: Enabling of bearer rejected, failed to enable media [ 493.650762][T10368] syz.4.988 (10368): drop_caches: 2 [ 493.803962][ T5349] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 493.838015][T10370] tipc: Enabling of bearer rejected, failed to enable media [ 493.954639][ T5349] usb 3-1: Using ep0 maxpacket: 8 [ 493.955245][ T5349] usb 3-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 493.956276][ T5349] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 1536, setting to 64 [ 493.956322][ T5349] usb 3-1: config 0 interface 0 has no altsetting 0 [ 493.960416][ T5349] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.960439][ T5349] usb 3-1: Product: syz [ 493.960454][ T5349] usb 3-1: Manufacturer: syz [ 493.960467][ T5349] usb 3-1: SerialNumber: syz [ 493.987808][ T5349] usb 3-1: config 0 descriptor?? [ 494.078002][ T5349] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 found [ 494.164419][ T9] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 494.283009][ T5349] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 now disconnected [ 494.293306][ T5349] snd_usb_toneport 3-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 494.323337][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 494.323388][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 494.345619][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.345644][ T9] usb 2-1: Product: syz [ 494.345658][ T9] usb 2-1: Manufacturer: syz [ 494.345671][ T9] usb 2-1: SerialNumber: syz [ 494.492680][ T5349] usb 3-1: USB disconnect, device number 44 [ 494.596050][ T9] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 494.596518][ T9] usb 2-1: 2:1 : no UAC_FORMAT_TYPE desc [ 494.646008][ T9] usb 2-1: USB disconnect, device number 64 [ 494.668082][ T6936] udevd[6936]: setting mode of /dev/bus/usb/002/064 to 020664 failed: No such file or directory [ 494.668219][ T6936] udevd[6936]: setting owner of /dev/bus/usb/002/064 to uid=0, gid=0 failed: No such file or directory [ 494.714121][ T5616] udevd[5616]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 494.911605][ T32] audit: type=1800 audit(1790256526.297:1147): pid=10380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.990" name="/" dev="fuse" ino=1 res=0 errno=0 [ 495.440659][T10391] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 12 out of range (51000000..2150000000) [ 495.476610][T10389] netlink: 20 bytes leftover after parsing attributes in process `syz.0.991'. [ 495.678760][T10389] bond0: (slave bond_slave_1): Releasing backup interface [ 495.726145][T10389] bond_slave_1: left promiscuous mode [ 495.764156][ T5687] usb 3-1: new full-speed USB device number 45 using dummy_hcd [ 495.835590][T10399] netlink: 52 bytes leftover after parsing attributes in process `syz.3.996'. [ 495.867669][T10405] hub 1-0:1.0: USB hub found [ 495.882207][T10405] hub 1-0:1.0: 1 port detected [ 495.944847][ T5687] usb 3-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=ba.be [ 495.998945][ T5687] usb 3-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 495.999012][ T5687] usb 3-1: Product: syz [ 495.999036][ T5687] usb 3-1: Manufacturer: syz [ 495.999046][ T5687] usb 3-1: SerialNumber: syz [ 496.065758][ T5687] usb 3-1: config 0 descriptor?? [ 496.410729][ T1234] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 496.431294][ T5687] peak_usb 3-1:0.0: PEAK-System PCAN-Chip USB v2 fw v77.153.104 (1 channels) [ 496.641277][ T1234] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 496.674125][ T5687] peak_usb 3-1:0.0 can0: sending command failure: -8 [ 496.674646][ T5687] peak_usb 3-1:0.0 can0: sending command failure: -8 [ 496.674740][ T5687] peak_usb 3-1:0.0 can0: sending command failure: -8 [ 496.675066][ T1234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.738501][ T1234] usb 1-1: config 0 descriptor?? [ 496.744025][ T1234] hub 1-1:0.0: bad descriptor, ignoring hub [ 496.744086][ T1234] hub 1-1:0.0: probe with driver hub failed with error -5 [ 496.781051][ T1234] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 496.845914][T10397] futex_wake_op: syz.2.994 tries to shift op by -1; fix this program [ 496.869637][T10397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.870085][T10397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.178523][T10422] binder: 10392:10422 ioctl f502 0 returned -22 [ 497.336586][T10427] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(17) [ 497.336615][T10427] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 497.336693][T10427] vhci_hcd vhci_hcd.0: Device attached [ 497.466635][ T5687] peak_usb 3-1:0.0: probe with driver peak_usb failed with error -8 [ 497.576241][ T9] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 497.973959][ T5687] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 498.135743][ T5687] usb 2-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 498.142362][ T5687] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 498.142393][ T5687] usb 2-1: Product: syz [ 498.142403][ T5687] usb 2-1: Manufacturer: syz [ 498.359601][ T1234] gp8psk: usb in 128 operation failed. [ 498.360708][ T1234] gp8psk: usb in 137 operation failed. [ 498.360732][ T1234] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 498.360779][ T1234] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 498.413072][ T1234] usb 1-1: USB disconnect, device number 52 [ 498.490045][ T5687] scsi host1: uas [ 498.739914][T10428] vhci_hcd: connection reset by peer [ 498.750663][ T118] vhci_hcd vhci_hcd.2: stop threads [ 498.750966][ T118] vhci_hcd vhci_hcd.2: release socket [ 498.751070][ T118] vhci_hcd vhci_hcd.2: disconnect device [ 498.878477][ C1] usb 2-1: stat urb: status -71 [ 498.878781][ C1] usb 2-1: cmd cmplt err -71 [ 498.879623][ T1234] usb 2-1: USB disconnect, device number 65 [ 498.964817][ T1234] scsi 1:0:0:0: tag#0 uas_zap_pending 0 uas-tag 1 inflight: CMD [ 498.964873][ T1234] scsi 1:0:0:0: tag#0 CDB: Inquiry 12 00 00 00 24 00 [ 499.634864][T10445] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1011'. [ 499.828933][ T5672] usb 3-1: USB disconnect, device number 45 [ 499.903380][T10445] ip6gretap0: entered promiscuous mode [ 499.952847][T10451] vim2m vim2m.0: Fourcc format (0x31384142) invalid. [ 500.293866][ T5349] usb 2-1: new full-speed USB device number 66 using dummy_hcd [ 500.457622][ T5349] usb 2-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 500.481166][ T5349] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 500.481193][ T5349] usb 2-1: config 0 has no interfaces? [ 500.481225][ T5349] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.527117][ T5349] usb 2-1: config 0 descriptor?? [ 500.609052][T10467] Sensor A: ================= START STATUS ================= [ 500.609087][T10467] Sensor A: Test Pattern: 75% Colorbar [ 500.609145][T10467] Sensor A: Show Information: All [ 500.609181][T10467] Sensor A: Vertical Flip: false [ 500.609218][T10467] Sensor A: Horizontal Flip: false [ 500.609253][T10467] Sensor A: Brightness: 128 [ 500.609306][T10467] Sensor A: Contrast: 128 [ 500.609340][T10467] Sensor A: Hue: 3 [ 500.609375][T10467] Sensor A: Saturation: 128 [ 500.609412][T10467] Sensor A: Pixel Rate: 160000000 [ 500.609449][T10467] Sensor A: Horizontal Blanking: 800 [ 500.609484][T10467] Sensor A: Vertical Blanking: 3223 [ 500.609537][T10467] Sensor A: ================== END STATUS ================== [ 501.031344][T10451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.051330][T10451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.446799][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.446883][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.713978][ T9] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 503.044222][ T5349] usb 2-1: string descriptor 0 read error: -71 [ 503.046625][ T5349] usb 2-1: USB disconnect, device number 66 [ 503.362687][T10483] hub 1-0:1.0: USB hub found [ 503.376081][T10483] hub 1-0:1.0: 1 port detected [ 503.576158][T10489] hub 1-0:1.0: USB hub found [ 503.580526][T10489] hub 1-0:1.0: 1 port detected [ 504.107931][T10498] netlink: 'syz.4.1012': attribute type 1 has an invalid length. [ 505.194161][ T1234] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 505.365628][ T1234] usb 1-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 505.388931][ T1234] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 505.388992][ T1234] usb 1-1: Product: syz [ 505.389024][ T1234] usb 1-1: Manufacturer: syz [ 505.744774][ T1234] scsi host1: uas [ 505.975703][ C1] usb 1-1: stat urb: status -71 [ 505.975798][ C1] usb 1-1: cmd cmplt err -71 [ 505.978205][ T9] usb 1-1: USB disconnect, device number 53 [ 506.009882][ T9] scsi 1:0:0:0: tag#0 uas_zap_pending 0 uas-tag 1 inflight: CMD [ 506.009943][ T9] scsi 1:0:0:0: tag#0 CDB: Inquiry 12 00 00 00 24 00 [ 506.054644][T10512] netlink: 79 bytes leftover after parsing attributes in process `syz.4.1015'. [ 506.139928][T10513] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1015'. [ 507.173790][ T9] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 507.323873][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 507.328957][ T9] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 507.349807][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 507.349857][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.374422][ T9] usb 1-1: config 0 descriptor?? [ 507.554214][ T5703] usb 5-1: new full-speed USB device number 47 using dummy_hcd [ 507.668332][ T9] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 507.753533][ T5703] usb 5-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 507.772655][ T5703] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 507.791655][ T5703] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.791699][ T5703] usb 5-1: Product: syz [ 507.791714][ T5703] usb 5-1: Manufacturer: syz [ 507.791729][ T5703] usb 5-1: SerialNumber: syz [ 507.817155][ T5703] usb 5-1: config 0 descriptor?? [ 507.827919][ T5703] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 507.928267][T10523] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1017'. [ 508.134636][T10525] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.135543][T10525] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.334340][ T5703] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 508.334431][ T5703] gspca_pac7302 5-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 509.372394][T10533] usb 1-1: USB disconnect, device number 54 [ 509.743839][ T5703] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 509.894298][ T5703] usb 2-1: Using ep0 maxpacket: 16 [ 509.897274][ T5703] usb 2-1: unable to get BOS descriptor or descriptor too short [ 509.897325][ T5703] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 509.902696][ T5703] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 509.902769][ T5703] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 509.957057][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.957085][ T5703] usb 2-1: Product: syz [ 509.957101][ T5703] usb 2-1: Manufacturer: syz [ 509.957117][ T5703] usb 2-1: SerialNumber: syz [ 510.284223][ T31] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 510.448160][ T31] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 510.449972][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 510.450007][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 510.450099][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.507415][ T31] usb 4-1: config 0 descriptor?? [ 510.578597][ T5672] usb 5-1: USB disconnect, device number 47 [ 510.924409][ T5703] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 510.924768][ T5703] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 511.000686][ T5703] usb 2-1: USB disconnect, device number 67 [ 511.077008][ T5616] udevd[5616]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 511.106001][ T31] usbhid 4-1:0.0: can't add hid device: -71 [ 511.106210][ T31] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 511.139559][ T31] usb 4-1: USB disconnect, device number 45 [ 511.419546][T10554] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1027'. [ 511.773040][T10562] hub 1-0:1.0: USB hub found [ 511.783040][T10562] hub 1-0:1.0: 1 port detected [ 511.910269][T10556] tipc: Enabling of bearer rejected, failed to enable media [ 511.987192][T10567] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1030'. [ 512.033997][ T9] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 512.120891][T10565] binder: 10557:10565 ioctl 4018620d 0 returned -22 [ 512.172897][T10565] geneve0: entered promiscuous mode [ 512.189600][T10565] geneve0: left promiscuous mode [ 512.194070][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 512.196665][ T9] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 512.208448][ T9] usb 1-1: config 0 has an invalid interface number: 143 but max is 0 [ 512.208471][ T9] usb 1-1: config 0 has no interface number 0 [ 512.208511][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.255023][ T9] usb 1-1: config 0 descriptor?? [ 512.385861][ T9] viperboard 1-1:0.143: version 0.00 found at bus 001 address 055 [ 512.451234][ T9] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 512.451266][ T9] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 512.777944][T10546] usb 1-1: USB disconnect, device number 55 [ 514.205958][T10583] hub 1-0:1.0: USB hub found [ 514.207818][T10583] hub 1-0:1.0: 1 port detected [ 514.615542][T10590] hub 1-0:1.0: USB hub found [ 514.618606][T10590] hub 1-0:1.0: 1 port detected [ 514.728370][T10597] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 514.728370][T10597] program syz.0.1045 not setting count and/or reply_len properly [ 515.023840][ T5672] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 515.044465][ T9] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 515.183881][ T5672] usb 2-1: Using ep0 maxpacket: 8 [ 515.202347][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 515.203164][ T9] usb 1-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 515.205657][ T9] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 515.205718][ T9] usb 1-1: config 0 has no interface number 0 [ 515.205879][ T9] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 515.235845][ T5672] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 515.246630][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.246747][ T9] usb 1-1: Product: syz [ 515.246785][ T9] usb 1-1: Manufacturer: syz [ 515.246831][ T9] usb 1-1: SerialNumber: syz [ 515.294477][ T9] usb 1-1: config 0 descriptor?? [ 515.318486][ T9] cypress_m8 1-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 515.350873][ T5672] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 515.350919][ T5672] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.376819][ T5672] usb 2-1: config 0 descriptor?? [ 515.515307][T10591] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1045'. [ 515.539513][ T9] usb 1-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 515.591964][ T9] usb 1-1: USB disconnect, device number 56 [ 515.678144][ T9] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 515.678774][ T9] cypress_m8 1-1:0.35: device disconnected [ 515.708079][ T5672] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 515.843211][T10601] openvswitch: netlink: Actions may not be safe on all matching packets [ 515.944835][T10596] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1035'. [ 516.023377][T10601] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1037'. [ 516.042730][T10601] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1037'. [ 516.204719][ T9] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 516.356500][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 516.363176][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 516.363223][ T9] usb 4-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 516.393639][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 516.395114][ T9] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 516.427812][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.427836][ T9] usb 4-1: Product: syz [ 516.427849][ T9] usb 4-1: Manufacturer: syz [ 516.427862][ T9] usb 4-1: SerialNumber: syz [ 516.671286][T10611] hub 1-0:1.0: USB hub found [ 516.684333][T10611] hub 1-0:1.0: 1 port detected [ 516.994236][ T31] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 517.154539][ T31] usb 5-1: Using ep0 maxpacket: 8 [ 517.161092][ T31] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 517.186189][ T31] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 517.186264][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 517.232162][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.232239][ T31] usb 5-1: Product: syz [ 517.232275][ T31] usb 5-1: Manufacturer: syz [ 517.232298][ T31] usb 5-1: SerialNumber: syz [ 517.280411][ T31] usb 5-1: config 0 descriptor?? [ 517.348668][ T31] streamzap 5-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 518.055590][ T1218] usb 5-1: USB disconnect, device number 48 [ 518.375876][ T1218] usb 2-1: USB disconnect, device number 68 [ 518.743472][ T9] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 518.760432][ T9] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 518.938841][T10631] hub 1-0:1.0: USB hub found [ 518.941570][T10631] hub 1-0:1.0: 1 port detected [ 518.992533][ T9] usb 4-1: USB disconnect, device number 46 [ 519.143024][ T5616] udevd[5616]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 519.747427][T10636] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1048'. [ 519.753651][T10635] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1047'. [ 519.878459][T10635] tipc: Enabling of bearer rejected, failed to enable media [ 520.133870][ T1218] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 520.231411][T10642] hub 1-0:1.0: USB hub found [ 520.238726][T10642] hub 1-0:1.0: 1 port detected [ 520.284236][ T1218] usb 4-1: Using ep0 maxpacket: 8 [ 520.285582][ T1218] usb 4-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 520.290592][ T1218] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 1536, setting to 64 [ 520.290658][ T1218] usb 4-1: config 0 interface 0 has no altsetting 0 [ 520.331911][ T1218] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.331940][ T1218] usb 4-1: Product: syz [ 520.331949][ T1218] usb 4-1: Manufacturer: syz [ 520.331958][ T1218] usb 4-1: SerialNumber: syz [ 520.377788][ T1218] usb 4-1: config 0 descriptor?? [ 520.454634][ T1218] snd_usb_toneport 4-1:0.0: Line 6 TonePort UX2 found [ 520.662427][ T1218] snd_usb_toneport 4-1:0.0: Line 6 TonePort UX2 now disconnected [ 520.679274][ T1218] snd_usb_toneport 4-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 520.862936][ T1218] usb 4-1: USB disconnect, device number 47 [ 521.810618][T10658] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1051'. [ 522.133861][ T5672] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 522.288679][ T5672] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 522.306594][ T5672] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.324845][ T5672] usb 2-1: config 0 descriptor?? [ 522.358305][ T5672] hub 2-1:0.0: bad descriptor, ignoring hub [ 522.358333][ T5672] hub 2-1:0.0: probe with driver hub failed with error -5 [ 522.432252][ T5672] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 522.782676][T10664] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 522.782676][T10664] program syz.2.1052 not setting count and/or reply_len properly [ 523.100795][ T31] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 523.257071][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 523.259506][ T31] usb 3-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 523.351350][ T31] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 523.351413][ T31] usb 3-1: config 0 has no interface number 0 [ 523.351547][ T31] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 523.431432][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.431499][ T31] usb 3-1: Product: syz [ 523.431536][ T31] usb 3-1: Manufacturer: syz [ 523.431571][ T31] usb 3-1: SerialNumber: syz [ 523.456835][T10667] hub 1-0:1.0: USB hub found [ 523.471085][T10667] hub 1-0:1.0: 1 port detected [ 523.494521][ T31] usb 3-1: config 0 descriptor?? [ 523.531616][ T31] cypress_m8 3-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 523.887318][T10663] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1052'. [ 524.490315][ T5672] gp8psk: usb in 128 operation failed. [ 524.492656][ T5672] gp8psk: usb in 137 operation failed. [ 524.492674][ T5672] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 524.492708][ T5672] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 524.887228][T10669] ªªªªªª: renamed from vlan0 (while UP) [ 524.916093][T10669] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1066'. [ 525.129862][T10671] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1056'. [ 525.477641][T10679] netlink: 34 bytes leftover after parsing attributes in process `syz.3.1057'. [ 525.521906][ T31] usb 3-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 525.559822][ T31] usb 3-1: USB disconnect, device number 46 [ 525.614701][ T5703] usb 1-1: new full-speed USB device number 57 using dummy_hcd [ 525.615398][ T31] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 525.618771][ T31] cypress_m8 3-1:0.35: device disconnected [ 525.656388][ T5349] usb 2-1: USB disconnect, device number 69 [ 525.765069][ T5703] usb 1-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 525.770897][ T5703] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 525.790031][ T5703] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.790101][ T5703] usb 1-1: Product: syz [ 525.790131][ T5703] usb 1-1: Manufacturer: syz [ 525.790167][ T5703] usb 1-1: SerialNumber: syz [ 525.811029][T10681] syzkaller0: entered promiscuous mode [ 525.811075][T10681] syzkaller0: entered allmulticast mode [ 525.854363][T10681] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1058'. [ 525.860523][T10681] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1058'. [ 525.861269][T10681] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1058'. [ 525.863579][T10687] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1060'. [ 525.874562][ T5703] usb 1-1: config 0 descriptor?? [ 525.916050][T10688] 0: reclassify loop, rule prio 0, protocol 800 [ 525.918163][T10681] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1058'. [ 525.918398][T10681] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1058'. [ 525.922199][ T5703] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 525.971240][T10685] batman_adv: batadv0: Adding interface: veth0 [ 525.971257][T10685] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 525.971288][T10685] batman_adv: batadv0: Interface activated: veth0 [ 526.036069][T10685] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 526.036120][T10685] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 526.082984][T10685] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 526.083009][T10685] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 526.100451][T10685] batman_adv: batadv0: Interface deactivated: veth0 [ 526.100488][T10685] batman_adv: batadv0: Removing interface: veth0 [ 526.163477][T10690] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1059'. [ 526.182342][T10677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.197372][T10677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.458164][ T5703] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 526.458246][ T5703] gspca_pac7302 1-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 526.897559][T10703] binder: 10698:10703 ioctl c0045005 800002c0 returned -22 [ 526.898380][T10703] binder: 10698:10703 ioctl c0306201 0 returned -14 [ 526.970222][T10703] syz.1.1063 (10703): drop_caches: 2 [ 528.081549][T10712] bridge2: entered promiscuous mode [ 528.081571][T10712] bridge2: entered allmulticast mode [ 528.102047][T10712] team0: Port device bridge2 added [ 528.156161][T10712] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2870834618 (5741669236 ns) > initial count (396924862 ns). Using initial count to start timer. [ 528.182904][ T1218] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 528.236060][T10711] bridge0: port 3(team0) entered blocking state [ 528.236247][T10711] bridge0: port 3(team0) entered disabled state [ 528.240941][T10711] team0: entered allmulticast mode [ 528.240970][T10711] team_slave_0: entered allmulticast mode [ 528.240985][T10711] team_slave_1: entered allmulticast mode [ 528.287831][T10711] team0: entered promiscuous mode [ 528.287858][T10711] team_slave_0: entered promiscuous mode [ 528.288182][T10711] team_slave_1: entered promiscuous mode [ 528.314639][T10711] bridge0: port 3(team0) entered blocking state [ 528.314806][T10711] bridge0: port 3(team0) entered forwarding state [ 528.383485][ T1218] usb 3-1: unable to get BOS descriptor or descriptor too short [ 528.383584][ T1218] usb 3-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 528.411732][ T1218] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 528.411763][ T1218] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 528.411805][ T1218] usb 3-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 528.411855][ T1218] usb 3-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 528.411893][ T1218] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 528.411924][ T1218] usb 3-1: config 1 interface 1 has no altsetting 0 [ 528.504004][ T1218] usb 3-1: string descriptor 0 read error: -22 [ 528.504148][ T1218] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.753334][T10717] usb 1-1: USB disconnect, device number 57 [ 528.808724][T10717] hub 1-0:1.0: USB hub found [ 528.812620][T10717] hub 1-0:1.0: 1 port detected [ 528.978246][ T5687] usb 1-1: new full-speed USB device number 58 using dummy_hcd [ 529.170225][T10723] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 529.174768][T10723] bond1 (unregistering): Released all slaves [ 529.207857][T10725] overlayfs: missing 'lowerdir' [ 529.272550][T10723] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 529.389393][ T1218] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 529.389460][ T1218] usb 3-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 529.389496][ T1218] usb 3-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/1/1 [ 529.476260][ T1218] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 529.517782][ T1218] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 529.543083][ T1218] usb 3-1: USB disconnect, device number 47 [ 530.470188][T10744] ipip0: entered promiscuous mode [ 530.470247][T10744] ipip0: entered allmulticast mode [ 530.602379][T10740] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1071'. [ 530.693052][T10740] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1071'. [ 533.214393][ T1218] usb 3-1: new full-speed USB device number 48 using dummy_hcd [ 533.377806][ T1218] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 533.381407][ T1218] usb 3-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x79, changing to 0x9 [ 533.381472][ T1218] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x9 has an invalid bInterval 0, changing to 4 [ 533.381513][ T1218] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x9 has invalid wMaxPacketSize 0 [ 533.381550][ T1218] usb 3-1: config 0 interface 0 has no altsetting 0 [ 533.473293][ T1218] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 533.473356][ T1218] usb 3-1: Product: syz [ 533.473390][ T1218] usb 3-1: Manufacturer: syz [ 533.473422][ T1218] usb 3-1: SerialNumber: syz [ 533.503516][ T1218] usb 3-1: config 0 descriptor?? [ 533.539334][ T1218] usb 3-1: selecting invalid altsetting 0 [ 533.808747][T10768] binder: 10761:10768 ioctl c0045005 800002c0 returned -22 [ 533.833391][T10768] binder: 10761:10768 ioctl c0306201 0 returned -14 [ 534.021905][T10768] syz.0.1077 (10768): drop_caches: 2 [ 535.741173][T10784] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 535.741173][T10784] program syz.3.1080 not setting count and/or reply_len properly [ 535.741634][T10787] hub 1-0:1.0: USB hub found [ 535.742261][T10787] hub 1-0:1.0: 1 port detected [ 535.869608][T10789] vim2m vim2m.0: Fourcc format (0x31384142) invalid. [ 536.043932][ T1218] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 536.129961][T10792] hub 1-0:1.0: USB hub found [ 536.130432][T10792] hub 1-0:1.0: 1 port detected [ 536.224610][ T5349] usb 2-1: new full-speed USB device number 70 using dummy_hcd [ 536.244152][ T1218] usb 4-1: Using ep0 maxpacket: 16 [ 536.249067][ T1218] usb 4-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 536.253524][ T1218] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 536.253554][ T1218] usb 4-1: config 0 has no interface number 0 [ 536.253643][ T1218] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 536.292216][T10795] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 536.292216][T10795] program syz.4.1083 not setting count and/or reply_len properly [ 536.335830][ T1218] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.335866][ T1218] usb 4-1: Product: syz [ 536.335888][ T1218] usb 4-1: Manufacturer: syz [ 536.335898][ T1218] usb 4-1: SerialNumber: syz [ 536.377557][ T5349] usb 2-1: New USB device found, idVendor=09da, idProduct=022b, bcdDevice= 0.00 [ 536.378835][ T1218] usb 4-1: config 0 descriptor?? [ 536.381745][ T5349] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 536.381766][ T5349] usb 2-1: config 0 has no interfaces? [ 536.381792][ T5349] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.431888][ T5349] usb 2-1: config 0 descriptor?? [ 536.479787][ T1218] cypress_m8 4-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 536.565072][ T5703] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 536.661291][T10789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 536.677580][T10789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.716372][ T5703] usb 5-1: Using ep0 maxpacket: 16 [ 536.721034][ T5703] usb 5-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 536.727411][ T5703] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 536.727474][ T5703] usb 5-1: config 0 has no interface number 0 [ 536.727578][ T5703] usb 5-1: config 0 interface 35 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 536.760129][ T5703] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.760188][ T5703] usb 5-1: Product: syz [ 536.760302][ T5703] usb 5-1: Manufacturer: syz [ 536.760339][ T5703] usb 5-1: SerialNumber: syz [ 536.806962][ T5703] usb 5-1: config 0 descriptor?? [ 536.827476][ T9] usb 1-1: new full-speed USB device number 59 using dummy_hcd [ 536.832509][ T5703] cypress_m8 5-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 536.847168][ T5703] nokiaca42v2 ttyUSB1: required endpoint is missing [ 536.980027][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 536.980062][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 536.981850][ T9] usb 1-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config [ 536.981908][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 537.035054][ T1218] usb 4-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 537.086567][T10793] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1083'. [ 537.092969][ T9] uvcvideo 1-1:1.0: Found UVC 1.00 device (046d:0825) [ 537.093114][ T9] uvcvideo 1-1:1.0: No streaming interface found for terminal 32770. [ 537.139975][ T1218] usb 4-1: USB disconnect, device number 48 [ 537.217968][ T1218] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 537.219720][ T1218] cypress_m8 4-1:0.35: device disconnected [ 538.169062][ T9] usb 5-1: USB disconnect, device number 49 [ 538.231100][ T9] cypress_m8 5-1:0.35: device disconnected [ 538.279294][ T5703] usb 1-1: USB disconnect, device number 59 [ 538.334875][T10800] fuse: Bad value for 'fd' [ 539.695827][ T5349] usb 2-1: string descriptor 0 read error: -71 [ 539.704851][ T5349] usb 2-1: USB disconnect, device number 70 [ 540.059885][ T9] usb 3-1: USB disconnect, device number 48 [ 540.148919][T10823] hub 1-0:1.0: USB hub found [ 540.150321][T10823] hub 1-0:1.0: 1 port detected [ 540.217981][T10822] openvswitch: netlink: Actions may not be safe on all matching packets [ 540.318989][T10822] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1099'. [ 540.320952][T10822] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1099'. [ 540.977607][T10836] IPVS: Unknown mcast interface: ip6gretap0 [ 541.306845][T10841] hub 1-0:1.0: USB hub found [ 541.312539][T10841] hub 1-0:1.0: 1 port detected [ 541.703150][T10845] hub 1-0:1.0: USB hub found [ 541.708599][T10845] hub 1-0:1.0: 1 port detected [ 542.032981][T10850] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 542.032981][T10850] program syz.1.1096 not setting count and/or reply_len properly [ 542.295437][ T1234] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 542.453769][ T1234] usb 2-1: Using ep0 maxpacket: 16 [ 542.455070][ T1234] usb 2-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 542.457372][ T1234] usb 2-1: config 0 has an invalid interface number: 35 but max is 0 [ 542.457402][ T1234] usb 2-1: config 0 has no interface number 0 [ 542.457443][ T1234] usb 2-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 542.460607][ T1234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.460623][ T1234] usb 2-1: Product: syz [ 542.460674][ T1234] usb 2-1: Manufacturer: syz [ 542.460684][ T1234] usb 2-1: SerialNumber: syz [ 542.480749][ T1234] usb 2-1: config 0 descriptor?? [ 542.561487][ T1234] cypress_m8 2-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 542.658604][T10864] binder: 10856:10864 ioctl c0045005 800002c0 returned -22 [ 542.662857][T10864] binder: 10856:10864 ioctl c0306201 0 returned -14 [ 542.735131][ T1234] usb 2-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 542.802428][ T1234] usb 2-1: USB disconnect, device number 71 [ 542.881571][ T1234] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 542.883004][ T1234] cypress_m8 2-1:0.35: device disconnected [ 543.063245][T10864] syz.2.1098 (10864): drop_caches: 2 [ 543.142687][T10872] hub 1-0:1.0: USB hub found [ 543.143302][T10872] hub 1-0:1.0: 1 port detected [ 543.635962][T10879] hub 1-0:1.0: USB hub found [ 543.636274][T10879] hub 1-0:1.0: 1 port detected [ 543.666977][T10880] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 543.666977][T10880] program syz.4.1105 not setting count and/or reply_len properly [ 543.733777][ T5703] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 543.884199][ T5703] usb 4-1: Using ep0 maxpacket: 16 [ 543.888995][ T5703] usb 4-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 543.892491][ T5703] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.909176][ T5703] usb 4-1: config 0 descriptor?? [ 543.923982][ T9] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 543.925699][ T5703] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 544.074837][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 544.075704][ T9] usb 5-1: New USB device found, idVendor=07d0, idProduct=4101, bcdDevice=ec.5c [ 544.077225][ T9] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 544.077248][ T9] usb 5-1: config 0 has no interface number 0 [ 544.077289][ T9] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 544.082335][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.082357][ T9] usb 5-1: Product: syz [ 544.082371][ T9] usb 5-1: Manufacturer: syz [ 544.082409][ T9] usb 5-1: SerialNumber: syz [ 544.095907][ T9] usb 5-1: config 0 descriptor?? [ 544.110448][ T9] cypress_m8 5-1:0.35: Nokia CA-42 V2 Adapter converter detected [ 544.320487][ T9] usb 5-1: Nokia CA-42 V2 Adapter converter now attached to ttyUSB0 [ 544.343515][ T9] usb 5-1: USB disconnect, device number 50 [ 544.377572][ T9] nokiaca42v2 ttyUSB0: Nokia CA-42 V2 Adapter converter now disconnected from ttyUSB0 [ 544.382363][ T9] cypress_m8 5-1:0.35: device disconnected [ 545.059150][T10885] hub 1-0:1.0: USB hub found [ 545.060418][T10886] openvswitch: netlink: Actions may not be safe on all matching packets [ 545.062156][T10885] hub 1-0:1.0: 1 port detected [ 545.097770][T10886] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1107'. [ 545.102636][T10886] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1107'. [ 545.484875][ T5703] gspca_sonixj: i2c_w8 err -71 [ 545.506535][ T5703] sonixj 4-1:0.0: probe with driver sonixj failed with error -71 [ 545.523361][ T5703] usb 4-1: USB disconnect, device number 49 [ 546.059108][T10898] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 12 out of range (51000000..2150000000) [ 546.323492][T10909] hub 1-0:1.0: USB hub found [ 546.330284][T10909] hub 1-0:1.0: 1 port detected [ 547.306018][T10925] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 547.306018][T10925] program syz.3.1117 not setting count and/or reply_len properly [ 547.564688][ T5349] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 547.693823][ T5349] usb 4-1: device descriptor read/64, error -71 [ 547.933975][ T5349] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 548.010362][T10932] binder: 10928:10932 ioctl c0045005 800002c0 returned -22 [ 548.010784][T10932] binder: 10928:10932 ioctl c0306201 0 returned -14 [ 548.064079][ T5349] usb 4-1: device descriptor read/64, error -71 [ 548.114091][T10932] syz.1.1119 (10932): drop_caches: 2 [ 548.174283][ T5349] usb usb4-port1: attempt power cycle [ 548.178433][T10933] hub 1-0:1.0: USB hub found [ 548.178676][T10933] hub 1-0:1.0: 1 port detected [ 548.513868][ T5349] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 548.534366][ T5349] usb 4-1: device descriptor read/8, error -71 [ 548.774749][ T5349] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 548.796538][ T5349] usb 4-1: device descriptor read/8, error -71 [ 548.904113][ T5349] usb usb4-port1: unable to enumerate USB device [ 549.882184][T10945] openvswitch: netlink: Actions may not be safe on all matching packets [ 549.909660][T10945] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1124'. [ 549.930926][T10945] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1124'. [ 550.041832][T10950] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 12 out of range (51000000..2150000000) [ 550.488108][T10962] ªªªªªª: renamed from vlan0 (while UP) [ 550.514293][T10962] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1127'. [ 550.684318][ T5349] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 550.819878][T10965] hub 1-0:1.0: USB hub found [ 550.820290][T10965] hub 1-0:1.0: 1 port detected [ 550.834639][ T5349] usb 4-1: Using ep0 maxpacket: 32 [ 550.844388][ T5349] usb 4-1: unable to get BOS descriptor or descriptor too short [ 550.844437][ T5349] usb 4-1: New USB device found, idVendor=1f71, idProduct=3306, bcdDevice=2a.c0 [ 550.850675][ T5349] usb 4-1: config 3 has an invalid interface number: 223 but max is 1 [ 550.850701][ T5349] usb 4-1: config 3 has an invalid interface number: 25 but max is 1 [ 550.850722][ T5349] usb 4-1: config 3 has an invalid interface number: 223 but max is 1 [ 550.850743][ T5349] usb 4-1: config 3 has no interface number 0 [ 550.850760][ T5349] usb 4-1: config 3 has no interface number 1 [ 550.850812][ T5349] usb 4-1: config 3 interface 25 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 550.850833][ T5349] usb 4-1: config 3 interface 25 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 550.850876][ T5349] usb 4-1: too many endpoints for config 3 interface 223 altsetting 155: 82, using maximum allowed: 30 [ 550.850915][ T5349] usb 4-1: config 3 interface 223 altsetting 155 endpoint 0xD has invalid maxpacket 512, setting to 64 [ 550.862940][ T5349] usb 4-1: config 3 interface 223 altsetting 155 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 550.863006][ T5349] usb 4-1: config 3 interface 223 altsetting 155 has 4 endpoint descriptors, different from the interface descriptor's value: 82 [ 550.863036][ T5349] usb 4-1: config 3 interface 223 has no altsetting 1 [ 550.863057][ T5349] usb 4-1: config 3 interface 25 has no altsetting 0 [ 550.999348][ T5349] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.999366][ T5349] usb 4-1: Product: syz [ 550.999375][ T5349] usb 4-1: Manufacturer: syz [ 550.999384][ T5349] usb 4-1: SerialNumber: syz [ 551.691733][T10972] hub 1-0:1.0: USB hub found [ 551.699250][T10972] hub 1-0:1.0: 1 port detected [ 551.712760][ T5349] usbtv 4-1:3.223: Fushicai USBTV007 Audio-Video Grabber [ 551.745118][ T9] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 551.775080][ T5349] usb 4-1: USB disconnect, device number 54 [ 551.893777][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 551.898050][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 551.898098][ T9] usb 3-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 551.899250][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 551.899317][ T9] usb 3-1: too many endpoints for config 1 interface 2 altsetting 1: 255, using maximum allowed: 30 [ 551.899352][ T9] usb 3-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 551.971101][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.971131][ T9] usb 3-1: Product: syz [ 551.971147][ T9] usb 3-1: Manufacturer: syz [ 551.971163][ T9] usb 3-1: SerialNumber: syz [ 552.026604][ T5349] [ 552.028979][ T5349] ========================= [ 552.033490][ T5349] WARNING: held lock freed! [ 552.038108][ T5349] syzkaller #0 Tainted: G L [ 552.044119][ T5349] ------------------------- [ 552.048668][ T5349] kworker/0:3/5349 is freeing memory ffff88804ccc3000-ffff88804ccc37ff, with a lock still held there! [ 552.059653][ T5349] ffff88804ccc31a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 552.069974][ T5349] locks held by kworker/0:3/5349: 5, last CPU#0: [ 552.076400][ T5349] #0: ffff88801ee86140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 552.087805][ T5349] #1: ffffc90002e57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 552.099685][ T5349] #2: ffff888029e0e1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 552.108707][ T5349] #3: ffff88802592a1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 [ 552.117907][ T5349] #4: ffff88804ccc31a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 552.128486][ T5349] [ 552.128486][ T5349] stack backtrace: [ 552.134467][ T5349] CPU: 0 UID: 0 PID: 5349 Comm: kworker/0:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 552.145446][ T5349] Tainted: [L]=SOFTLOCKUP [ 552.149796][ T5349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 552.159876][ T5349] Workqueue: usb_hub_wq hub_event [ 552.164950][ T5349] Call Trace: [ 552.168316][ T5349] [ 552.171325][ T5349] dump_stack_lvl+0xe8/0x150 [ 552.175994][ T5349] debug_check_no_locks_freed+0x149/0x170 [ 552.181762][ T5349] kfree+0x12b/0x650 [ 552.185735][ T5349] ? device_release+0xc4/0x1f0 [ 552.190570][ T5349] ? __pfx_usb_release_interface+0x10/0x10 [ 552.196444][ T5349] device_release+0xc4/0x1f0 [ 552.201075][ T5349] kobject_put+0x222/0x550 [ 552.205617][ T5349] v4l2_device_disconnect+0x79/0xd0 [ 552.210938][ T5349] usbtv_video_free+0x25/0x30 [ 552.215797][ T5349] usbtv_disconnect+0x5c/0xa0 [ 552.220511][ T5349] usb_unbind_interface+0x295/0x9f0 [ 552.225752][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 552.231538][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 552.237291][ T5349] ? __pfx_usb_unbind_interface+0x10/0x10 [ 552.243072][ T5349] device_release_driver_internal+0x4f5/0x880 [ 552.249174][ T5349] bus_remove_device+0x444/0x560 [ 552.254157][ T5349] ? __pfx_bus_remove_device+0x10/0x10 [ 552.259662][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 552.265418][ T5349] device_del+0x524/0x8f0 [ 552.269785][ T5349] ? __pfx_device_del+0x10/0x10 [ 552.274679][ T5349] ? __pfx___mutex_lock+0x10/0x10 [ 552.279828][ T5349] usb_disable_device+0x3d4/0x8d0 [ 552.284894][ T5349] usb_disconnect+0x346/0x9a0 [ 552.289598][ T5349] hub_event+0x1bbb/0x4d30 [ 552.294064][ T5349] ? register_lock_class+0x31/0x2e0 [ 552.299298][ T5349] ? __pfx_hub_event+0x10/0x10 [ 552.304085][ T5349] ? rcu_is_watching+0x16/0xb0 [ 552.308909][ T5349] ? process_scheduled_works+0x97a/0x1630 [ 552.314664][ T5349] process_scheduled_works+0xc3d/0x1630 [ 552.320275][ T5349] ? __pfx_process_scheduled_works+0x10/0x10 [ 552.326287][ T5349] ? assign_work+0x3cf/0x5d0 [ 552.330911][ T5349] worker_thread+0xa47/0xfb0 [ 552.335537][ T5349] ? __kthread_parkme+0x71/0x1f0 [ 552.340512][ T5349] kthread+0x38b/0x480 [ 552.344604][ T5349] ? __pfx_worker_thread+0x10/0x10 [ 552.349744][ T5349] ? __pfx_kthread+0x10/0x10 [ 552.354386][ T5349] ret_from_fork+0x514/0xb70 [ 552.359031][ T5349] ? __pfx_ret_from_fork+0x10/0x10 [ 552.364166][ T5349] ? __switch_to+0xc89/0x1420 [ 552.368951][ T5349] ? __pfx_kthread+0x10/0x10 [ 552.373583][ T5349] ret_from_fork_asm+0x1a/0x30 [ 552.378385][ T5349] [ 552.393988][ T5349] ================================================================== [ 552.394002][ T5349] BUG: KASAN: slab-use-after-free in usb_unbind_interface+0x2c2/0x9f0 [ 552.394047][ T5349] Read of size 8 at addr ffff88804ccc3008 by task kworker/0:3/5349 [ 552.394065][ T5349] [ 552.394079][ T5349] CPU: 0 UID: 0 PID: 5349 Comm: kworker/0:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 552.394108][ T5349] Tainted: [L]=SOFTLOCKUP [ 552.394116][ T5349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 552.394131][ T5349] Workqueue: usb_hub_wq hub_event [ 552.394157][ T5349] Call Trace: [ 552.394166][ T5349] [ 552.394175][ T5349] dump_stack_lvl+0xe8/0x150 [ 552.394206][ T5349] print_address_description+0x55/0x1e0 [ 552.394265][ T5349] ? usb_unbind_interface+0x2c2/0x9f0 [ 552.394291][ T5349] print_report+0x58/0x70 [ 552.394315][ T5349] kasan_report+0x117/0x150 [ 552.394343][ T5349] ? usb_unbind_interface+0x2c2/0x9f0 [ 552.394373][ T5349] usb_unbind_interface+0x2c2/0x9f0 [ 552.394399][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 552.394427][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 552.394451][ T5349] ? __pfx_usb_unbind_interface+0x10/0x10 [ 552.394478][ T5349] device_release_driver_internal+0x4f5/0x880 [ 552.394508][ T5349] bus_remove_device+0x444/0x560 [ 552.394541][ T5349] ? __pfx_bus_remove_device+0x10/0x10 [ 552.394575][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 552.394600][ T5349] device_del+0x524/0x8f0 [ 552.394625][ T5349] ? __pfx_device_del+0x10/0x10 [ 552.394646][ T5349] ? __pfx___mutex_lock+0x10/0x10 [ 552.394677][ T5349] usb_disable_device+0x3d4/0x8d0 [ 552.394706][ T5349] usb_disconnect+0x346/0x9a0 [ 552.394731][ T5349] hub_event+0x1bbb/0x4d30 [ 552.394762][ T5349] ? register_lock_class+0x31/0x2e0 [ 552.394796][ T5349] ? __pfx_hub_event+0x10/0x10 [ 552.394826][ T5349] ? rcu_is_watching+0x16/0xb0 [ 552.394851][ T5349] ? process_scheduled_works+0x97a/0x1630 [ 552.394880][ T5349] process_scheduled_works+0xc3d/0x1630 [ 552.394920][ T5349] ? __pfx_process_scheduled_works+0x10/0x10 [ 552.394951][ T5349] ? assign_work+0x3cf/0x5d0 [ 552.394978][ T5349] worker_thread+0xa47/0xfb0 [ 552.395011][ T5349] ? __kthread_parkme+0x71/0x1f0 [ 552.395054][ T5349] kthread+0x38b/0x480 [ 552.395074][ T5349] ? __pfx_worker_thread+0x10/0x10 [ 552.395101][ T5349] ? __pfx_kthread+0x10/0x10 [ 552.395121][ T5349] ret_from_fork+0x514/0xb70 [ 552.395141][ T5349] ? __pfx_ret_from_fork+0x10/0x10 [ 552.395159][ T5349] ? __switch_to+0xc89/0x1420 [ 552.395188][ T5349] ? __pfx_kthread+0x10/0x10 [ 552.395208][ T5349] ret_from_fork_asm+0x1a/0x30 [ 552.395246][ T5349] [ 552.395255][ T5349] [ 552.395260][ T5349] Allocated by task 5349: [ 552.395319][ T5349] kasan_save_track+0x3e/0x80 [ 552.395341][ T5349] __kasan_kmalloc+0x93/0xb0 [ 552.395363][ T5349] __kmalloc_cache_noprof+0x321/0x600 [ 552.395381][ T5349] usb_set_configuration+0x3cc/0x2180 [ 552.395405][ T5349] usb_generic_driver_probe+0x8d/0x150 [ 552.395488][ T5349] usb_probe_device+0x1c3/0x3b0 [ 552.395513][ T5349] really_probe+0x254/0xae0 [ 552.395537][ T5349] __driver_probe_device+0x1e8/0x360 [ 552.395559][ T5349] driver_probe_device+0x4f/0x240 [ 552.395582][ T5349] __device_attach_driver+0x270/0x410 [ 552.395605][ T5349] bus_for_each_drv+0x258/0x2f0 [ 552.395633][ T5349] __device_attach+0x2c4/0x450 [ 552.395654][ T5349] device_initial_probe+0xa1/0xd0 [ 552.395675][ T5349] bus_probe_device+0x12a/0x220 [ 552.395703][ T5349] device_add+0x7d7/0xb80 [ 552.395720][ T5349] usb_new_device+0x9aa/0x1690 [ 552.395738][ T5349] hub_event+0x28e8/0x4d30 [ 552.395760][ T5349] process_scheduled_works+0xc3d/0x1630 [ 552.395782][ T5349] worker_thread+0xa47/0xfb0 [ 552.395808][ T5349] kthread+0x38b/0x480 [ 552.395825][ T5349] ret_from_fork+0x514/0xb70 [ 552.395841][ T5349] ret_from_fork_asm+0x1a/0x30 [ 552.395870][ T5349] [ 552.395875][ T5349] Freed by task 5349: [ 552.395884][ T5349] kasan_save_track+0x3e/0x80 [ 552.395904][ T5349] kasan_save_free_info+0x40/0x50 [ 552.395932][ T5349] __kasan_slab_free+0x5c/0x80 [ 552.395952][ T5349] kfree+0x1c5/0x650 [ 552.395977][ T5349] device_release+0xc4/0x1f0 [ 552.396011][ T5349] kobject_put+0x222/0x550 [ 552.396045][ T5349] v4l2_device_disconnect+0x79/0xd0 [ 552.396072][ T5349] usbtv_video_free+0x25/0x30 [ 552.396097][ T5349] usbtv_disconnect+0x5c/0xa0 [ 552.396118][ T5349] usb_unbind_interface+0x295/0x9f0 [ 552.396141][ T5349] device_release_driver_internal+0x4f5/0x880 [ 552.396163][ T5349] bus_remove_device+0x444/0x560 [ 552.396189][ T5349] device_del+0x524/0x8f0 [ 552.396206][ T5349] usb_disable_device+0x3d4/0x8d0 [ 552.396227][ T5349] usb_disconnect+0x346/0x9a0 [ 552.396243][ T5349] hub_event+0x1bbb/0x4d30 [ 552.396264][ T5349] process_scheduled_works+0xc3d/0x1630 [ 552.396304][ T5349] worker_thread+0xa47/0xfb0 [ 552.396329][ T5349] kthread+0x38b/0x480 [ 552.396345][ T5349] ret_from_fork+0x514/0xb70 [ 552.396361][ T5349] ret_from_fork_asm+0x1a/0x30 [ 552.396399][ T5349] [ 552.396404][ T5349] The buggy address belongs to the object at ffff88804ccc3000 [ 552.396404][ T5349] which belongs to the cache kmalloc-2k of size 2048 [ 552.396421][ T5349] The buggy address is located 8 bytes inside of [ 552.396421][ T5349] freed 2048-byte region [ffff88804ccc3000, ffff88804ccc3800) [ 552.396440][ T5349] [ 552.396445][ T5349] The buggy address belongs to the physical page: [ 552.396462][ T5349] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ccc0 [ 552.396480][ T5349] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 552.396496][ T5349] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 552.396519][ T5349] page_type: f5(slab) [ 552.396537][ T5349] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 552.396555][ T5349] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 552.396574][ T5349] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 552.396590][ T5349] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 552.396608][ T5349] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 552.396625][ T5349] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 552.396635][ T5349] page dumped because: kasan: bad access detected [ 552.396650][ T5349] page_owner tracks the page as allocated [ 552.396657][ T5349] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9679, tgid 9672 (syz.0.835), ts 426292906082 [ 552.396689][ T5349] post_alloc_hook+0x1f9/0x250 [ 552.396748][ T5349] get_page_from_freelist+0x2209/0x2280 [ 552.396768][ T5349] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 552.396788][ T5349] allocate_slab+0x7d/0x620 [ 552.396810][ T5349] refill_objects+0x2d5/0x350 [ 552.396834][ T5349] __pcs_replace_empty_main+0x2c8/0x6c0 [ 552.396857][ T5349] __kmalloc_cache_noprof+0x39b/0x600 [ 552.396874][ T5349] br_vlan_add+0x22d/0x1060 [ 552.396953][ T5349] __vlan_add+0x46b/0x29f0 [ 552.396991][ T5349] nbp_vlan_add+0x27c/0xb20 [ 552.397045][ T5349] br_vlan_info+0x100/0x470 [ 552.397093][ T5349] br_process_vlan_info+0x61f/0x8b0 [ 552.397117][ T5349] br_afspec+0x3a5/0x600 [ 552.397138][ T5349] br_setlink+0x34f/0x830 [ 552.397158][ T5349] rtnl_bridge_setlink+0x5b6/0x7e0 [ 552.397238][ T5349] rtnetlink_rcv_msg+0x7b9/0xc00 [ 552.397262][ T5349] page last free pid 6074 tgid 6074 ts 123667998161 stack trace: [ 552.397277][ T5349] __free_pages_ok+0xb6c/0xc60 [ 552.397304][ T5349] system_heap_dma_buf_release+0x154/0x260 [ 552.397405][ T5349] dma_buf_release+0x112/0x260 [ 552.397471][ T5349] dentry_kill+0x228/0x880 [ 552.397504][ T5349] finish_dput+0x1a/0x260 [ 552.397533][ T5349] __fput+0x675/0xa50 [ 552.397554][ T5349] task_work_run+0x1d9/0x270 [ 552.397572][ T5349] exit_to_user_mode_loop+0x204/0x770 [ 552.397590][ T5349] __do_fast_syscall_32+0x437/0x6a0 [ 552.397659][ T5349] do_fast_syscall_32+0x33/0x70 [ 552.397682][ T5349] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 552.397723][ T5349] [ 552.397729][ T5349] Memory state around the buggy address: [ 552.397739][ T5349] ffff88804ccc2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 552.397752][ T5349] ffff88804ccc2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 552.397766][ T5349] >ffff88804ccc3000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 552.397776][ T5349] ^ [ 552.397785][ T5349] ffff88804ccc3080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 552.397799][ T5349] ffff88804ccc3100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 552.397808][ T5349] ================================================================== [ 552.397855][ T5349] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 553.229298][ T5349] CPU: 0 UID: 0 PID: 5349 Comm: kworker/0:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 553.240275][ T5349] Tainted: [L]=SOFTLOCKUP [ 553.244607][ T5349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 553.254704][ T5349] Workqueue: usb_hub_wq hub_event [ 553.259780][ T5349] Call Trace: [ 553.263076][ T5349] [ 553.266028][ T5349] vpanic+0x56d/0xa60 [ 553.270069][ T5349] ? __pfx_vpanic+0x10/0x10 [ 553.274588][ T5349] ? __pfx___schedule+0x10/0x10 [ 553.279455][ T5349] panic+0xc5/0xd0 [ 553.283196][ T5349] ? __pfx_panic+0x10/0x10 [ 553.287674][ T5349] ? preempt_schedule_thunk+0x16/0x40 [ 553.293062][ T5349] ? usb_unbind_interface+0x2c2/0x9f0 [ 553.298450][ T5349] check_panic_on_warn+0x89/0xb0 [ 553.303404][ T5349] ? usb_unbind_interface+0x2c2/0x9f0 [ 553.308788][ T5349] end_report+0x73/0x170 [ 553.313049][ T5349] ? usb_unbind_interface+0x2c2/0x9f0 [ 553.318434][ T5349] kasan_report+0x128/0x150 [ 553.322960][ T5349] ? usb_unbind_interface+0x2c2/0x9f0 [ 553.328358][ T5349] usb_unbind_interface+0x2c2/0x9f0 [ 553.333583][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 553.339329][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 553.345068][ T5349] ? __pfx_usb_unbind_interface+0x10/0x10 [ 553.350826][ T5349] device_release_driver_internal+0x4f5/0x880 [ 553.356923][ T5349] bus_remove_device+0x444/0x560 [ 553.361891][ T5349] ? __pfx_bus_remove_device+0x10/0x10 [ 553.367398][ T5349] ? kernfs_remove_by_name_ns+0x101/0x140 [ 553.373141][ T5349] device_del+0x524/0x8f0 [ 553.377493][ T5349] ? __pfx_device_del+0x10/0x10 [ 553.382389][ T5349] ? __pfx___mutex_lock+0x10/0x10 [ 553.387438][ T5349] usb_disable_device+0x3d4/0x8d0 [ 553.392514][ T5349] usb_disconnect+0x346/0x9a0 [ 553.397217][ T5349] hub_event+0x1bbb/0x4d30 [ 553.401664][ T5349] ? register_lock_class+0x31/0x2e0 [ 553.406903][ T5349] ? __pfx_hub_event+0x10/0x10 [ 553.411707][ T5349] ? rcu_is_watching+0x16/0xb0 [ 553.416488][ T5349] ? process_scheduled_works+0x97a/0x1630 [ 553.422245][ T5349] process_scheduled_works+0xc3d/0x1630 [ 553.427826][ T5349] ? __pfx_process_scheduled_works+0x10/0x10 [ 553.433822][ T5349] ? assign_work+0x3cf/0x5d0 [ 553.438426][ T5349] worker_thread+0xa47/0xfb0 [ 553.443034][ T5349] ? __kthread_parkme+0x71/0x1f0 [ 553.447996][ T5349] kthread+0x38b/0x480 [ 553.452086][ T5349] ? __pfx_worker_thread+0x10/0x10 [ 553.457225][ T5349] ? __pfx_kthread+0x10/0x10 [ 553.461827][ T5349] ret_from_fork+0x514/0xb70 [ 553.466429][ T5349] ? __pfx_ret_from_fork+0x10/0x10 [ 553.471561][ T5349] ? __switch_to+0xc89/0x1420 [ 553.476277][ T5349] ? __pfx_kthread+0x10/0x10 [ 553.480882][ T5349] ret_from_fork_asm+0x1a/0x30 [ 553.485695][ T5349] [ 553.488915][ T5349] Kernel Offset: disabled [ 553.493251][ T5349] Rebooting in 86400 seconds..