last executing test programs: 30.013982073s ago: executing program 3 (id=816): unshare(0x22020600) r0 = syz_open_dev$loop(&(0x7f0000000100), 0xdf6, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x300, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1d, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000100", "2809e8dbe108598948224ad54afac11d875397bdb22d00009520a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bc0007008019000000000000000000000000af1e4ccfb7b3cad80004010400", [0x1, 0x2000000000001]}}) 29.045829794s ago: executing program 3 (id=818): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x88, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x88}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0xf5ff, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) 13.151708741s ago: executing program 0 (id=856): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="f000000010000d0400"/20, @ANYBLOB='\x00\b\x00'], 0xf0}, 0x1, 0x0, 0x0, 0x4}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000500fe8000000000000000000000000000bb0200010100000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000000000000030000000000000000000000000000000000000000000000dd020000400000000400000000000000000001000000000084010500ac141439000000000000000000000000000000002b00000000000000ac14140c000000000000000000000000000000000000ff000000000000000000000000007f000001000000000000000000000000000000003200000000000000ac1414bb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000003c00000002000000ac1414bb00000000000000000000000001000000010300"], 0x23c}}, 0x0) 12.592607642s ago: executing program 0 (id=859): r0 = socket(0x840000000002, 0x3, 0xff) io_setup(0x9, &(0x7f0000000b80)=0x0) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0xfffc, r0, 0x0, 0x0, 0x0, 0x0, 0x2}]) sendmmsg$inet(r0, &(0x7f0000000480)=[{{&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x3e}}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000240)="a905000000007464000100000000000040e5c06417e436a106993e1e5ad8311dabcd25ca", 0x24}], 0x1}}], 0x1, 0x40000) 11.759180146s ago: executing program 0 (id=862): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x556, 0x2, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000002200)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x4, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="9a", 0x1}], 0x1}}], 0x1, 0x4000000) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000480)={r6, 0x9}, 0xc) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000001c0)={r6, 0x6, 0x20, 0x4, 0xffffffff00000001}, &(0x7f0000000200)=0x18) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) migrate_pages(0x0, 0x8, &(0x7f0000000280)=0x9, &(0x7f00000003c0)=0x3) sendmmsg$inet(r7, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000700)}, {&(0x7f0000000d40)="b1f56ee29c433328d3b2a83bd97e37007087acae7568edff43ed556d76770122635aea1dc48755381c71590cd542e796cc2669e2af442a03760c5cdfc691b3da35ad6a8d2ef9c2baa53a8dec36a2e434d46e643a1277b1dd932f3ef2cf46c257d6a19523b8b789ef34b46e461725b5e437323385b88c368f8bb5b933aa9169f5f7b51dd5319b8016623d1863d70581691a79a6678db1e5e7fa1c98c5b9e4a87272e9c4a1bd98dbb2ab76919ba5c1020e80bd0659e82d861dc6fe4c62639134c504aa438689d28748c22ebfe2772d64b64e706d94864d785dcc6b24fff7858b2a4e", 0xe1}, {&(0x7f0000000b80)}], 0x3}}, {{0x0, 0x0, 0x0}}], 0x2, 0xc0) sendto$inet(r7, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x20c8, 0x11, 0x0, 0x27) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0xff, 0x2, 0x0, 0x2}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@newqdisc={0x34, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x55}, 0x4000) 11.350044409s ago: executing program 1 (id=864): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee5, 0x400, 0x1, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r4 = landlock_create_ruleset(&(0x7f0000000040)={0xb6a0, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)='./file0\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x3, r0, 0x0, 0x0, 0x0, 0x80000}) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r7, 0x8208ae63, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x7, 0xfffffffffffffffe, 0x40, 0x0, 0x7, 0x2000000000044, 0x0, 0x8000000000000, 0x5, 0x0, 0x9, 0x0, 0x0, 0x7, 0x1], 0x6000, 0x3c2a10}) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) 9.031839647s ago: executing program 0 (id=869): ioctl$TUNSETVNETBE(0xffffffffffffffff, 0x400454de, &(0x7f0000000000)=0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1, 0x0, 0x0, 0x4000}, 0x3500000000000000) socket$can_j1939(0x1d, 0x2, 0x7) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$vbi(0x0, 0x2, 0x2) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$vbi(0x0, 0x2, 0x2) r2 = syz_open_procfs(0x0, 0x0) connect$pppoe(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x8) syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x42}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6=r4}]}}}]}, 0x38}, 0x1, 0xba01}, 0x0) 8.986669592s ago: executing program 1 (id=870): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000940)=ANY=[@ANYBLOB="5400000010000304000000000000000000120000", @ANYRES32=0x0, @ANYBLOB="15020000000000002c00128009000100766c616e000000001c000280060001000000000010000480ff010000000000001205000008000500", @ANYRES32=r1], 0x54}, 0x1, 0xba01}, 0x0) 8.810128959s ago: executing program 4 (id=872): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)=ANY=[@ANYBLOB="140000000d0603"], 0x14}}, 0x0) sendmsg$IPSET_CMD_SWAP(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000060601"], 0x14}}, 0x810) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000001c0)=ANY=[@ANYBLOB="8c00000013000500"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000014000300766c616e300000000000000000000000080004000000000034002b"], 0x8c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) ptrace$cont(0x20, r5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) lstat(0x0, 0x0) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, 0x0) r6 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x20}}, 0x0) getsockname$packet(r6, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x4d, &(0x7f0000000140)={&(0x7f0000000380)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x5, 0x1, 0x5, 0x3c, 0x8, 0x6, 0x8001, 0x2, 0x8120}}}}]}, 0x58}}, 0x80) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000014c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xa, 0xfff3}, {}, {0x1c}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x1, 0xe}}]}}]}, 0x3c}}, 0x460d0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r0, 0x0) 8.632470687s ago: executing program 1 (id=873): pread64(0xffffffffffffffff, &(0x7f0000000600)=""/4091, 0xffb, 0x1010000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000140)={0x0, &(0x7f0000000280)}, 0x10) request_key(0x0, &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}, 0x60000000}], 0x400000000000172, 0x4001c00) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000fc0)={'wlan1\x00', 0x0}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r9, 0x0, r8, 0x0, 0x6, 0x0) write$binfmt_misc(r10, &(0x7f0000000140)='N', 0x1) sendmsg$NL80211_CMD_DEL_KEY(r6, &(0x7f00000010c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r5, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x818}, 0x22000040) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, r5, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x0, 0x70}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x89}]}, 0x30}}, 0x8000) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}]}}}]}]}], {0x14}}, 0xe8}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000340)={@local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "3000bb", 0x8, 0x2b, 0x0, @private2, @local, {[], {0x0, 0x0, 0x8}}}}}}, 0x0) 8.117973606s ago: executing program 1 (id=874): ioctl$KVM_CAP_X86_GUEST_MODE(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000240)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x402) r2 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000040)={0x23, 0x3, 0x1c, 0x6, 0x0, 0x5, 0x0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x8000000004, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000000c0)={0x1, @vbi={0x6, 0x4, 0x32315559, 0x36314d59, [0x3], [0xdb83, 0x6], 0x1}}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000080)={[0x7, 0x6, 0x7fffffffffffffff, 0x2, 0x9, 0x1, 0xffffffffffffffff, 0x49ca, 0x7, 0x2, 0x3, 0x3, 0x6, 0x401, 0x10000000, 0x2], 0xdddd0000, 0x10401}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 7.035001337s ago: executing program 1 (id=875): openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x8010, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) setsockopt$inet_int(r2, 0x0, 0x1, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x2) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xc8) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) rename(0x0, &(0x7f0000000780)='./file2\x00') r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) memfd_create(&(0x7f0000000040)='\x01\xfd\xae.+\xa6\x8c\xf8\xff2\x199\x94S,|\x99x?Ue[\xbd\xe1!\x03[d \xa0\x97\xf5G\x97A\xc2\xd8\xf0Uq\xe6+\xa5l\x94\v\xd3\a\x17\\\xfb\x04!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xeb\xe4\x9aR\xe5,\x82\x03\xfa\x18\x8dR\xbb\xea5F\x00G\xe8\xc6\xb9\xe4\xb4\x99\x8a\x19P\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xccV\xa6w%\x06\x19\x7f\xc3\xb3O\xe5t3\x03\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\xa1\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xef!\x8f\xf6]-\xe9k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7cdv[\t\x00\x8d\xf3\xcc1\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6x\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfcN\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00p+\x96\x1ei|n\xda\xee\x01\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\x9f\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11Z\xe6:\xf4\xcd\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xffY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0\xe1\x86\t\xaf\ti\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xad\x86\xd7\x17&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96\xb8\x02\x13pA\x19\tf\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKlb\xe5:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcc\b\x00\x00\x00\x00\x00\x00\x00\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01;\xbfM.\xe3\x84\x82\x9c\x91\a\x9b\x191c\xaeLz\xe0\x04Daz\x8d\xc3\x03\xab\x8dEGC$\x00e,\x94#\xcd4\xf9\x05\x88.\x13\x03\x04\xdb', 0x4) r5 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYBLOB="03070000b5"], 0xc8) write$binfmt_aout(r5, &(0x7f00000000c0)=ANY=[@ANYBLOB="03040000b500000001008aea0000feff"], 0xc8) dup3(0xffffffffffffffff, r5, 0x0) 5.236134969s ago: executing program 4 (id=879): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioperm(0x0, 0x82, 0x1e) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r2, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000005440)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)='+', 0x1}], 0x1}}], 0x1, 0x400c404) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6}]}) fanotify_init(0x0, 0x0) sendmmsg$inet6(r2, &(0x7f0000003640)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000140)="af", 0x1}], 0x1}}], 0x1, 0x4040005) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/tty/ldiscs\x00', 0x0, 0x0) r4 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd=r3, 0xffffffffffffffff, &(0x7f0000000580)=""/207, 0xcf, 0x2, 0x1}) io_uring_enter(r4, 0x627, 0x4c1, 0x43, 0x0, 0x30) 4.090864888s ago: executing program 0 (id=880): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee5, 0x400, 0x1, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r4 = landlock_create_ruleset(&(0x7f0000000040)={0xb6a0, 0x3}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)='./file0\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x3, r0, 0x0, 0x0, 0x0, 0x80000}) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r7, 0x8208ae63, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x7, 0xfffffffffffffffe, 0x40, 0x0, 0x7, 0x2000000000044, 0x0, 0x8000000000000, 0x5, 0x0, 0x9, 0x0, 0x0, 0x7, 0x1], 0x6000, 0x3c2a10}) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) 4.089980186s ago: executing program 1 (id=881): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0x9}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x20000023893) r3 = getpgid(0x0) ptrace$ARCH_SET_CPUID(0x1e, r3, 0x1, 0x1012) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000f000000000000000000000073013b000000000095000000000000009dc5b6aa03b3cb2e04a567c917206ec2128d5c49adb1be3235a1e6be47d9774fa75ab6f6e58f10a8ba60f0a4bdd699ed174638ed758afe56f8b57b34972ab6f0bc572049c16805f3bcc2ad99774a33fd673b1b9e6d8a9472597f47c5eba8f4ee76ea728096dce997194ea9e14fd6017851fa24a1fe06face111e782c0d95c7b2f12388dc720cdf1090b46b3074786398657ccd23a0cc7326dee7a78f125eef54013a755c4a378ff58a10b03a9238b38651d2862c4309"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r4, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='pids.current\x00', 0x0, 0x0) r5 = syz_open_dev$dri(0x0, 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r5, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r6, 0x0, 0x80, 0x4649, 0x9, 0x0, {0x9, 0xd6, 0x8d, 0x7, 0xfe, 0x401, 0x4, 0xa, 0x3, 0x8, 0x8000, 0x7e9, 0x401, 0x5, "cc630dab3a0338057401a192419598961f50dc45c87d55b42a28b8f01c0e0e7a"}}) mbind(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, &(0x7f0000000040)=0x80000001, 0x8, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80043, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) socket$inet6(0x2d, 0x806, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 3.154150636s ago: executing program 3 (id=818): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x88, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x88}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0xf5ff, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) 2.876221424s ago: executing program 3 (id=882): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) fsopen(&(0x7f0000000400)='efivarfs\x00', 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x388, 0xffffffff, 0x0, 0xd0, 0xd0, 0xfeffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev, @empty, [], [], 'macsec0\x00', 'bond_slave_0\x00', {}, {}, 0x6, 0x0, 0x1}, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@ipv6={@private0, @empty, [], [], 'sit0\x00', 'vxcan1\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x2, 0x0, 0x0, 0x0, "ddabf53d9b1435965491f65318776d8001e770b667f173dfa40b58c10327e3121114449fd20ba2be6e45cae72a972f25170163232ed996b4789b9d00"}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) r1 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ftruncate(r1, 0x100000001) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r5 = socket(0x1, 0x803, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1500000010"], 0x48) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) syz_emit_ethernet(0x6e, &(0x7f0000000600)={@link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e53aff", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "509159", 0x0, 0x32, 0x0, @mcast2, @mcast2, [], "c93edfc0a4089794"}}}}}}}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file4/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file4/file6\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file1/file4/file7\x00', 0x1c0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x114, &(0x7f0000000440)=0xf, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x5, 0x2, 0x0}) io_uring_enter(r9, 0x3516, 0x0, 0x0, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1/file4/file6\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file1/file4/file7/file6\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000600)='./file1/file4/file5\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file1/file4/file7/file6\x00', 0x2) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300, 0x1003200}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}, 0x1, 0x0, 0x1000000}, 0x0) 2.748138535s ago: executing program 4 (id=883): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x6e) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x80000) io_setup(0x42, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000580)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r1, &(0x7f0000000000)='e', 0x3f, 0x1100000000000000}]) sendmmsg$alg(r1, &(0x7f0000002280)=[{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000140)="1bb183ac97583e04dcc4c913a3609c9c75", 0x11}], 0x1, &(0x7f0000000800)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4001}], 0x1, 0x80) 2.181269617s ago: executing program 4 (id=887): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x6e) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x80000) io_setup(0x42, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000580)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r1, &(0x7f0000000000)='e', 0x3f}]) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/user\x00') r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021940000000c0a01030000000000000000070000000900020073797a31000000000900010073797a3000000000680003806400dec6080003400000000258000b80200001800a00010071756f7461000000100002800c0001400000000000000000340001800a0001006c696d69740000002400028008000440000000010c00024000000000000000000c0001400000000000000003"], 0x118}}, 0x0) 1.96043899s ago: executing program 2 (id=888): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='fdinfo\x00') (async) r0 = io_uring_setup(0x177d, &(0x7f00000002c0)={0x0, 0x698c, 0x1, 0x2, 0xfffffffe}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x40) (async) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f00000000c0), 0x10) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYRES16=r1, @ANYRES8=r0], 0x448}}, 0x0) (async) sendmsg$can_bcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000000808"], 0x80}}, 0x0) r2 = socket(0x21, 0x5, 0xffffffff) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) (async) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)) (async) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000000640)=0x40000) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="04010000100007000000000000000000ff020000000000000000000000000001e0000002000000000000000000000000ffff0000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc0000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000200000000000070000000000000000000000000000000000040000000000e80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bbec8c919b817e19695615653ebb437e8d0e6f8ddb34e25d9be965784664f516496daca70ca0d99755ca80dbab8e5474a32bc3e04108900b74a08a2d7f213c5a27a9c4b2a90effd2c8371e72875077f432f81d2ebfc115a3147a2476f778306cdfc5a15eff7a52d6219c22426595a89b8a70254929b40bdebe00683e9040265d947fb36cb4c79050137c47e8850a001a537f246f85886ebbc851cf3f4fe0f04be126545befce86b5a905b9d91de0b29d84c02cace647bced62b238a9daf2e77da2476b3315819ade8b2f622e98c9"], 0x104}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={0x0}}, 0x0) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4080}, 0x20040001) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) 1.721681642s ago: executing program 2 (id=889): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x5}]}], {0x52}}, 0x64}, 0x1, 0x0, 0x0, 0x890}, 0xf5ffffff) 1.721418045s ago: executing program 3 (id=890): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0xa, 0x300) bind$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000000028000000000003000000000088a8000081"], 0x3e) 1.300075289s ago: executing program 2 (id=891): openat$audio(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400400000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="08d1000000000000825712809050b55dcd278a03010000c6ae2ea514da1614000c0000000c0000000400048014000300766c616e3000"/64], 0x58}}, 0x0) 1.170884347s ago: executing program 3 (id=892): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_io_uring_setup(0x18da, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x2, 0x401a}, &(0x7f0000000100), &(0x7f0000ffe000)) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x0, 0x3, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000300)={'veth0_virt_wifi\x00', &(0x7f0000000200)=@ethtool_sset_info={0x37, 0x5, 0x6}}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r1, 0x2, &(0x7f0000000180), 0xfe) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) r6 = socket(0x10, 0x803, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x88a8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x50, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x7}, {}, {0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x20, 0x2, [@TCA_CGROUP_EMATCHES={0x1c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0xc, 0x1, 0x0, 0x0, {{0x1, 0x9, 0x1}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 1.060704752s ago: executing program 2 (id=893): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee1, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) socket$inet_smc(0x2b, 0x1, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_RECVMSG={0xa, 0x10, 0x1, r0, 0x0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=""/164, 0xa4}, 0x0, 0x0, 0x0, {0x3}}) io_uring_enter(r1, 0x47f6, 0x401000, 0x2, 0x0, 0x0) 1.05959039s ago: executing program 4 (id=894): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='freezer.state\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000680)) (async, rerun: 32) recvmmsg$unix(r0, &(0x7f0000000600)=[{{&(0x7f0000000580)=@abs, 0x6e, &(0x7f0000000200), 0x0, &(0x7f0000000280)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}}], 0x1, 0x100, 0x0) (async, rerun: 32) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x24004001) (async) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) r2 = socket(0x2, 0x80805, 0x0) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) (async) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) (async) r5 = dup3(r4, r3, 0x0) (async) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) r7 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r6, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) (async) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff2417d079bb892435a1e107fa5c0ecd207d9e6f2a209bf148e6bc56955cb53347d1499097488fcad724a1"}) syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffffffb) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000002c0)={0x50, 0x0, &(0x7f0000001640)=[@free_buffer={0x40086303, r7}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, 0x0, &(0x7f0000000100)) (async) ioctl$SNDRV_PCM_IOCTL_DRAIN(r1, 0x4144, 0x0) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x83, &(0x7f00000011c0)={r8}, &(0x7f0000000180)=0x8) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) (async) r9 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$cgroup_type(r9, &(0x7f0000000200), 0x9) 983.487489ms ago: executing program 0 (id=895): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) add_key(&(0x7f0000000000)='cifs.idmap\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x34, 0x3, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x16, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x9}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}, 0x1, 0x0, 0x0, 0x4040054}, 0x24000050) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)={0x18, r3, 0x1, 0x0, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}}, 0x2000c050) syz_usb_connect(0x0, 0x3e, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r4 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_timedsend(r4, 0x0, 0x0, 0x9, 0x0) mq_timedreceive(r4, &(0x7f0000004600)=""/102381, 0xfffffceb, 0x0, 0x0) 613.79888ms ago: executing program 4 (id=896): socket$nl_netfilter(0x10, 0x3, 0xc) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) write$cgroup_int(r0, &(0x7f0000000040)=0x900, 0x12) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r0, 0x330f, 0x100) r1 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r1, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="1800000000000000290000003b000000800a"], 0x18}}], 0x1, 0x4000000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000300)=0x3) epoll_pwait2(0xffffffffffffffff, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x692401, 0x0) fsync(r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x80) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)=ANY=[@ANYBLOB="240000005f304433b3c4d403b4c4ddca0e3cf4c122da00a646d2f5d832c05d66d0c0e7f6a1e88d3116c882674e74c604ea"], 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$RDS_CANCEL_SENT_TO(r6, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e21, @loopback}, 0x1c) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x3, 0x7, 0x24, '\x00', 0x200}) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae0000000160a01030000000000efca7b2c39000000010000010c00054000000000000000026c0003801800038014000100766574683100000000000000000000000800014000000000400003801400010069703665727370616e300000000000001400010070696d367265670000000000000000001400010070696d7265670000000000000000000008000240000000020900020073797a31000000000c00054000000000000000020900010073797a3100000000040000000000000014d8abf1530f2f789f9ff50001007767320000000000000000000000000008000140000000000900010073797a310000000040000000090a010400000000000000000700000308000a40000000000900e60073797a31000000000c0010400000000000000003080005400000000d0400128014000000100001000000"], 0x148}}, 0x20058890) r7 = socket$kcm(0x10, 0x7, 0x0) sendmsg$inet(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000080)="5c00000011006bcc9e3be34c6e17aa310769876c1d0000007ea60864160af36514001ac004000202080002000600010076e6f06cea2618c3ecb525c89c32f292b156a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 217.812483ms ago: executing program 2 (id=897): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x401, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}, 0x12000000}], 0x400000000000172, 0x4001c00) 0s ago: executing program 2 (id=898): socket$netlink(0x10, 0x3, 0x12) r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000080)={0x1d, r1, 0x2, {0x2, 0x0, 0x2}}, 0x18) sendmsg$kcm(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000005c0)=[{0x0}, {&(0x7f00000004c0)="8ae4f5dbfc58", 0x6}], 0x2}, 0x48005) r2 = epoll_create(0x2) r3 = fanotify_init(0x1, 0x101000) fanotify_mark(r3, 0x8, 0x40000000, 0xffffffffffffffff, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x2, 0x8}}, 0x70) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {r5, 0x1c, 0x0, @ib={0x1b, 0x50, 0x4, {"580d4939fb9b56d8b11a384f342bf3dc"}, 0x202, 0xff, 0x4}}}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) r6 = gettid() r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r7, &(0x7f0000000440)=""/247, 0x26) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r7, 0x4040534e, &(0x7f0000000080)={0x31, @time={0x3, 0xfffefffd}, 0x0, {0x0, 0x2}, 0x0, 0x0, 0x4}) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r7, 0x80045301, 0x0) r8 = syz_open_dev$vbi(&(0x7f0000000080), 0x1, 0x2) ioctl$VIDIOC_S_DV_TIMINGS(r8, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x1, 0x2, 0x0, 0x0, 0x101, 0x3, 0x7fff, 0x3ff, 0x7, 0x3, 0x90000000, 0x3, 0xfffffffa, 0x9, 0x2, 0x13, {0x4, 0x5}, 0x7, 0x5}}) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r7, 0xc0305302, &(0x7f0000000040)={0x36, 0x7, 0x4, 0x9, 0x1, 0x80}) tkill(r6, 0x7) r9 = userfaultfd(0x801) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r9, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_timeval(r10, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, &(0x7f00000005c0)={0x10}) openat$nci(0xffffffffffffff9c, &(0x7f0000001a00), 0x2, 0x0) kernel console output (not intermixed with test programs): reserved main item tag 0xd [ 231.580797][ T55] lenovo 0003:17EF:6067.0008: hidraw0: USB HID v0.01 Device [HID 17ef:6067] on usb-dummy_hcd.1-1/input0 [ 231.828626][ T5940] usb 5-1: Using ep0 maxpacket: 16 [ 231.860145][ T847] usbhid 3-1:0.0: can't add hid device: -71 [ 231.897602][ T5940] usb 5-1: config 0 interface 0 altsetting 253 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 231.951243][ T847] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 232.009590][ T9] usb 2-1: USB disconnect, device number 16 [ 232.033303][ T5940] usb 5-1: config 0 interface 0 has no altsetting 0 [ 232.077212][ T847] usb 3-1: USB disconnect, device number 25 [ 232.083412][ T5940] usb 5-1: New USB device found, idVendor=054c, idProduct=0ba0, bcdDevice= 0.00 [ 232.166522][ T5940] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.214108][ T7710] fido_id[7710]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 232.308529][ T9] usb 4-1: USB disconnect, device number 17 [ 232.392148][ T5940] usb 5-1: config 0 descriptor?? [ 232.588893][ T847] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 232.811552][ T847] usb 3-1: Using ep0 maxpacket: 16 [ 232.851650][ T7726] netlink: 20 bytes leftover after parsing attributes in process `syz.1.395'. [ 232.883759][ T847] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 232.902984][ T847] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 232.952396][ T847] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 232.984299][ T7722] cgroup: fork rejected by pids controller in /syz3 [ 232.993937][ T847] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 233.498825][ T847] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 233.551367][ T847] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 233.561082][ T847] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.778538][ T847] usb 3-1: Product: syz [ 233.835473][ T847] usb 3-1: Manufacturer: syz [ 233.854742][ T847] usb 3-1: SerialNumber: syz [ 234.470992][ T847] usb 3-1: USB disconnect, device number 26 [ 234.653845][ T6049] udevd[6049]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 235.292090][ T5940] usbhid 5-1:0.0: can't add hid device: -71 [ 235.390320][ T5940] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 235.527028][ T5940] usb 5-1: USB disconnect, device number 27 [ 235.597363][ T8822] netlink: 36 bytes leftover after parsing attributes in process `syz.2.398'. [ 236.128209][ T5940] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 236.302407][ T5940] usb 5-1: Using ep0 maxpacket: 16 [ 236.365736][ T5940] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 236.382537][ T5940] usb 5-1: config 0 has no interface number 0 [ 236.389821][ T5940] usb 5-1: config 0 interface 41 has no altsetting 0 [ 236.416229][ T5940] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 236.426064][ T5940] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.434699][ T5940] usb 5-1: Product: syz [ 236.439444][ T5940] usb 5-1: Manufacturer: syz [ 236.444197][ T5940] usb 5-1: SerialNumber: syz [ 236.461053][ T5940] usb 5-1: config 0 descriptor?? [ 236.554144][ T5940] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -22 [ 238.969827][ T5912] usb 5-1: USB disconnect, device number 28 [ 239.140964][ T8853] netlink: 20 bytes leftover after parsing attributes in process `syz.2.406'. [ 239.353869][ T8851] cgroup: fork rejected by pids controller in /syz0 [ 239.449117][ T8857] netlink: 32 bytes leftover after parsing attributes in process `syz.4.405'. [ 239.844147][ T8897] loop6: detected capacity change from 0 to 524287999 [ 240.762724][ T55] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 241.018660][ T55] usb 4-1: not running at top speed; connect to a high speed hub [ 241.057339][ T55] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 241.116904][ T55] usb 4-1: can't read configurations, error -22 [ 241.318307][ T55] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 241.572802][ T55] usb 4-1: not running at top speed; connect to a high speed hub [ 241.615890][ T55] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 241.644384][ T55] usb 4-1: can't read configurations, error -22 [ 241.665227][ T55] usb usb4-port1: attempt power cycle [ 242.058261][ T55] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 242.110914][ T55] usb 4-1: not running at top speed; connect to a high speed hub [ 242.146988][ T55] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 242.168498][ T5940] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 242.170234][ T55] usb 4-1: can't read configurations, error -22 [ 242.331486][ T55] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 242.351784][ T5940] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 242.375066][ T5940] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 242.384085][ T55] usb 4-1: not running at top speed; connect to a high speed hub [ 242.395487][ T5940] usb 5-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 242.414865][ T55] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 242.420047][ T5940] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 242.444751][ T55] usb 4-1: can't read configurations, error -22 [ 242.468622][ T55] usb usb4-port1: unable to enumerate USB device [ 242.508316][ T5940] usb 5-1: config 0 descriptor?? [ 242.738440][ T5912] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 242.950748][ T5940] cp2112 0003:10C4:EA90.0009: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.4-1/input0 [ 242.968997][ T5912] usb 2-1: Using ep0 maxpacket: 16 [ 242.989903][ T5912] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 243.000756][ T5912] usb 2-1: config 0 has no interface number 0 [ 243.006918][ T5912] usb 2-1: config 0 interface 41 has no altsetting 0 [ 243.130814][ T5912] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 243.185507][ T5940] cp2112 0003:10C4:EA90.0009: Part Number: 0x82 Device Version: 0xFE [ 243.261252][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.351702][ T5912] usb 2-1: Product: syz [ 243.414466][ T5912] usb 2-1: Manufacturer: syz [ 243.484029][ T5912] usb 2-1: SerialNumber: syz [ 243.632454][ T5912] usb 2-1: config 0 descriptor?? [ 243.651407][ T5912] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -22 [ 243.677833][T10177] netlink: 'syz.0.423': attribute type 1 has an invalid length. [ 243.893149][T10177] 8021q: adding VLAN 0 to HW filter on device bond1 [ 244.094360][T10179] bond1: (slave veth3): Enslaving as an active interface with a down link [ 244.337442][T10180] bond1: (slave veth0_to_bond): making interface the new active one [ 244.396742][ T5940] usb 5-1: reset high-speed USB device number 29 using dummy_hcd [ 244.430647][T10180] veth0_to_bond: entered promiscuous mode [ 244.443672][T10180] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 244.553751][T10183] vlan3: entered allmulticast mode [ 244.572963][T10183] veth0_to_bond: entered allmulticast mode [ 244.584724][T10183] bond1: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 245.667782][T10204] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 245.918373][ T847] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 246.185254][ T55] usb 2-1: USB disconnect, device number 17 [ 246.337075][ T847] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 246.353668][ T847] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 246.462485][T10204] bond1: entered promiscuous mode [ 246.468476][T10204] bond1: entered allmulticast mode [ 246.468599][ T847] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 246.493241][T10204] 8021q: adding VLAN 0 to HW filter on device bond1 [ 246.529029][ T847] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.561543][T10206] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 246.575326][ T847] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 247.194543][ T5857] usb 1-1: USB disconnect, device number 26 [ 247.268896][ T55] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 247.438697][ T55] usb 2-1: Using ep0 maxpacket: 16 [ 248.407050][T10268] loop6: detected capacity change from 0 to 524287999 [ 248.629152][T10273] sctp: [Deprecated]: syz.4.438 (pid 10273) Use of int in maxseg socket option. [ 248.629152][T10273] Use struct sctp_assoc_value instead [ 248.655792][T10273] netlink: 'syz.4.438': attribute type 10 has an invalid length. [ 249.648871][ T5940] usb 5-1: device descriptor read/64, error -110 [ 249.908487][ T5940] usb 5-1: reset high-speed USB device number 29 using dummy_hcd [ 250.071224][ T5940] usb 5-1: device descriptor read/64, error -32 [ 250.548607][ T5940] usb 5-1: reset high-speed USB device number 29 using dummy_hcd [ 250.909862][ T5940] usb 5-1: device descriptor read/8, error -32 [ 250.957448][ T55] usb 2-1: unable to get BOS descriptor or descriptor too short [ 250.989435][ T55] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 250.997154][ T55] usb 2-1: can't read configurations, error -71 [ 251.228220][ T5940] usb 5-1: reset high-speed USB device number 29 using dummy_hcd [ 251.707066][ T5940] usb 5-1: device descriptor read/8, error -32 [ 251.840692][ T5940] raw-gadget.1 gadget.4: failed to queue suspend event [ 251.851325][ T5912] usb 5-1: USB disconnect, device number 29 [ 252.338828][T10301] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 252.533159][T10301] bond3: entered promiscuous mode [ 252.542315][T10301] bond3: entered allmulticast mode [ 252.554103][T10301] 8021q: adding VLAN 0 to HW filter on device bond3 [ 253.098471][ T5939] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 253.124071][T10311] fuse: Bad value for 'fd' [ 253.269082][ T5939] usb 4-1: Using ep0 maxpacket: 16 [ 253.308749][ T5939] usb 4-1: config 8 has an invalid interface number: 198 but max is 0 [ 253.351142][ T5939] usb 4-1: config 8 has an invalid descriptor of length 36, skipping remainder of the config [ 253.592883][ T5939] usb 4-1: config 8 has no interface number 0 [ 253.617834][ T5939] usb 4-1: config 8 interface 198 has no altsetting 0 [ 253.654463][ T5939] usb 4-1: New USB device found, idVendor=0d49, idProduct=7000, bcdDevice=6c.67 [ 253.684703][ T5939] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.701912][ T5939] usb 4-1: Product: syz [ 254.025994][ T5939] usb 4-1: Manufacturer: syz [ 254.093923][ T5939] usb 4-1: SerialNumber: syz [ 254.436296][T10333] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 254.447838][T10333] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 255.774381][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.780930][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.274696][ T5939] ums-onetouch 4-1:8.198: USB Mass Storage device detected [ 256.766748][ T5939] usb 4-1: USB disconnect, device number 22 [ 256.870891][ T2901] veth0_to_bond: left promiscuous mode [ 256.987265][T10353] netlink: 36 bytes leftover after parsing attributes in process `syz.3.455'. [ 257.253621][T10352] random: crng reseeded on system resumption [ 257.469134][T10358] netlink: 8 bytes leftover after parsing attributes in process `syz.0.457'. [ 257.528572][ T5939] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 257.689044][ T5939] usb 2-1: Using ep0 maxpacket: 16 [ 257.696570][ T5939] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC6, changing to 0x86 [ 257.708939][ T5939] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 257.758162][ T5939] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 0 [ 257.778900][ T5939] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 257.811116][ T5939] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 257.834115][ T5939] usb 2-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 257.844289][ T5939] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.861383][ T5939] usb 2-1: Product: syz [ 257.877215][ T5939] usb 2-1: Manufacturer: syz [ 257.882499][ T5939] usb 2-1: SerialNumber: syz [ 257.892110][ T5939] usb 2-1: config 0 descriptor?? [ 257.928974][ T5939] port100 2-1:0.0: NFC: Could not get supported command types [ 258.141326][ T5939] usb 2-1: USB disconnect, device number 20 [ 258.158565][ T5925] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 258.196002][T10367] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 258.243057][T10367] bond1: entered promiscuous mode [ 258.253144][T10367] bond1: entered allmulticast mode [ 258.273059][T10367] 8021q: adding VLAN 0 to HW filter on device bond1 [ 258.346488][ T5925] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 258.379687][ T5925] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 258.393038][ T5925] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.424930][ T5925] usb 1-1: config 0 descriptor?? [ 258.446095][ T5925] pwc: Askey VC010 type 2 USB webcam detected. [ 258.719168][ T55] IPVS: starting estimator thread 0... [ 258.796238][T10370] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 258.803919][T10370] IPv6: NLM_F_CREATE should be set when creating new route [ 258.854114][T10372] IPVS: using max 27 ests per chain, 64800 per kthread [ 258.881575][T10370] lo: entered allmulticast mode [ 259.060632][T10370] tunl0: entered allmulticast mode [ 259.097866][T10370] gre0: entered allmulticast mode [ 259.223829][T10370] gretap0: entered allmulticast mode [ 259.241783][ T5925] pwc: recv_control_msg error -71 req 02 val 2b00 [ 259.249409][ T5925] pwc: recv_control_msg error -71 req 02 val 2700 [ 259.261130][ T5925] pwc: recv_control_msg error -71 req 02 val 2c00 [ 259.275534][T10370] erspan0: entered allmulticast mode [ 259.291093][ T5925] pwc: recv_control_msg error -71 req 04 val 1000 [ 259.293530][T10370] ip_vti0: entered allmulticast mode [ 259.304552][ T5925] pwc: recv_control_msg error -71 req 04 val 1300 [ 259.316391][T10370] ip6_vti0: entered allmulticast mode [ 259.323246][ T5925] pwc: recv_control_msg error -71 req 04 val 1400 [ 259.327287][T10370] sit0: entered allmulticast mode [ 259.353517][T10370] ip6tnl0: entered allmulticast mode [ 259.369014][ T5925] pwc: recv_control_msg error -71 req 02 val 2000 [ 259.381221][T10370] ip6gre0: entered allmulticast mode [ 259.396012][T10370] syz_tun: entered allmulticast mode [ 259.412720][T10370] ip6gretap0: entered allmulticast mode [ 259.425501][T10370] bridge0: entered allmulticast mode [ 259.434171][T10370] vcan0: entered allmulticast mode [ 259.447515][T10370] bond0: entered allmulticast mode [ 259.456044][T10370] team0: entered allmulticast mode [ 259.467918][T10370] dummy0: entered allmulticast mode [ 259.481870][T10370] nlmon0: entered allmulticast mode [ 259.487654][ T5925] pwc: recv_control_msg error -71 req 02 val 2100 [ 259.490095][T10370] caif0: entered allmulticast mode [ 259.512148][T10370] batadv0: entered allmulticast mode [ 259.525718][ T5925] pwc: recv_control_msg error -71 req 04 val 1500 [ 259.534620][T10370] vxcan0: entered allmulticast mode [ 259.544120][T10370] vxcan1: entered allmulticast mode [ 259.552242][T10370] veth0: entered allmulticast mode [ 259.565854][T10370] veth1: entered allmulticast mode [ 259.582341][T10370] wg0: entered allmulticast mode [ 259.592443][T10370] wg1: entered allmulticast mode [ 259.599275][ T5940] IPVS: starting estimator thread 0... [ 259.603063][T10383] net_ratelimit: 688 callbacks suppressed [ 259.603081][T10383] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 259.623050][ T5925] pwc: recv_control_msg error -71 req 02 val 2500 [ 259.630361][ T5925] pwc: recv_control_msg error -71 req 02 val 2400 [ 259.637442][T10370] wg2: entered allmulticast mode [ 259.637789][ T5925] pwc: recv_control_msg error -71 req 02 val 2600 [ 259.652567][ T5925] pwc: recv_control_msg error -71 req 02 val 2900 [ 259.660701][T10370] veth0_to_bridge: entered allmulticast mode [ 259.668134][ T5925] pwc: recv_control_msg error -71 req 02 val 2800 [ 259.675785][ T5925] pwc: recv_control_msg error -71 req 04 val 1100 [ 259.699462][T10385] IPVS: using max 26 ests per chain, 62400 per kthread [ 259.758632][ T5925] pwc: recv_control_msg error -71 req 04 val 1200 [ 259.794315][ T5925] pwc: Registered as video103. [ 259.826206][ T5925] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input11 [ 259.857964][T10370] bridge_slave_0: entered allmulticast mode [ 259.894626][ T5925] usb 1-1: USB disconnect, device number 27 [ 259.916630][T10370] veth1_to_bridge: entered allmulticast mode [ 260.009186][T10370] bridge_slave_1: entered allmulticast mode [ 260.087186][T10370] bond_slave_0: entered allmulticast mode [ 260.136173][T10370] veth1_to_bond: entered allmulticast mode [ 260.146403][T10370] bond_slave_1: entered allmulticast mode [ 260.155186][T10370] veth0_to_team: entered allmulticast mode [ 260.165705][T10370] team_slave_0: entered allmulticast mode [ 260.176855][T10370] veth1_to_team: entered allmulticast mode [ 260.186751][T10370] team_slave_1: entered allmulticast mode [ 260.215483][T10370] veth0_to_batadv: entered allmulticast mode [ 260.237287][T10370] batadv_slave_0: entered allmulticast mode [ 260.256317][T10370] veth1_to_batadv: entered allmulticast mode [ 260.282731][T10370] batadv_slave_1: entered allmulticast mode [ 260.310442][T10370] xfrm0: entered allmulticast mode [ 260.322752][T10370] veth0_to_hsr: entered allmulticast mode [ 260.335816][T10370] hsr_slave_0: entered allmulticast mode [ 260.344869][T10370] veth1_to_hsr: entered allmulticast mode [ 260.354818][T10370] hsr_slave_1: entered allmulticast mode [ 260.364802][T10370] hsr0: entered allmulticast mode [ 260.380152][T10370] veth1_virt_wifi: entered allmulticast mode [ 260.392013][T10370] veth0_virt_wifi: entered allmulticast mode [ 260.401601][T10370] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 260.410807][T10370] veth1_vlan: entered allmulticast mode [ 260.420470][T10370] veth0_vlan: entered allmulticast mode [ 260.492470][T10370] vlan0: left promiscuous mode [ 260.523637][T10370] vlan0: entered allmulticast mode [ 260.540128][T10370] vlan1: entered allmulticast mode [ 260.554144][T10370] macvlan0: entered allmulticast mode [ 260.572202][T10370] macvlan1: entered allmulticast mode [ 260.599830][T10370] ipvlan0: entered allmulticast mode [ 260.615171][T10370] ipvlan1: entered allmulticast mode [ 260.635080][T10370] veth1_macvtap: entered allmulticast mode [ 260.656421][T10370] veth0_macvtap: entered allmulticast mode [ 260.677160][T10370] macvtap0: entered allmulticast mode [ 260.694325][T10370] macsec0: entered allmulticast mode [ 260.715280][T10370] geneve0: entered allmulticast mode [ 260.721345][ T5940] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 260.744903][T10370] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.757286][T10370] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.767329][T10370] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.779595][T10370] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.789193][T10370] geneve1: entered allmulticast mode [ 260.825617][T10370] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 260.860846][T10370] netdevsim netdevsim2 netdevsim1: entered allmulticast mode [ 260.877751][T10370] netdevsim netdevsim2 netdevsim2: entered allmulticast mode [ 260.904302][ T5940] usb 4-1: config index 0 descriptor too short (expected 5292, got 77) [ 260.913344][ T5940] usb 4-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 260.924260][T10370] netdevsim netdevsim2 netdevsim3: entered allmulticast mode [ 260.931996][ T5940] usb 4-1: config 55 has 0 interfaces, different from the descriptor's value: 20 [ 260.963635][T10370] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 260.972738][ T5940] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 260.982327][ T5940] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.991200][ T5940] usb 4-1: Product: syz [ 260.995734][ T5940] usb 4-1: Manufacturer: syz [ 261.039836][ T5940] usb 4-1: SerialNumber: syz [ 261.045087][T10370] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 261.268813][T10394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.277430][T10394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.288516][T10370] syztnl1: entered allmulticast mode [ 261.309167][T10370] bond1: entered allmulticast mode [ 261.315600][T10370] veth2: entered allmulticast mode [ 261.395283][T10370] veth3: entered allmulticast mode [ 261.988680][ T55] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 262.008259][ T5939] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 262.180816][ T55] usb 3-1: config 219 has an invalid descriptor of length 0, skipping remainder of the config [ 262.203442][ T55] usb 3-1: config 219 has 0 interfaces, different from the descriptor's value: 1 [ 262.236060][ T55] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 262.304793][ T55] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.593448][ T5939] usb 2-1: config index 0 descriptor too short (expected 5292, got 77) [ 262.602189][ T5939] usb 2-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 262.613381][ T5939] usb 2-1: config 55 has 0 interfaces, different from the descriptor's value: 20 [ 262.633287][ T5939] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 262.642882][ T5939] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.651149][ T5939] usb 2-1: Product: syz [ 262.665288][ T5939] usb 2-1: Manufacturer: syz [ 262.710245][ T5939] usb 2-1: SerialNumber: syz [ 262.736888][ T55] usb 3-1: string descriptor 0 read error: -71 [ 262.835837][ T55] usb 3-1: USB disconnect, device number 27 [ 263.107070][T10408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.122527][T10408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.378984][ T5939] usb 4-1: USB disconnect, device number 23 [ 263.471341][T10419] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 263.530679][T10419] bond2: entered promiscuous mode [ 263.536552][T10419] bond2: entered allmulticast mode [ 263.553791][T10419] 8021q: adding VLAN 0 to HW filter on device bond2 [ 264.702914][T10429] netlink: 36 bytes leftover after parsing attributes in process `syz.3.476'. [ 265.659914][ T5939] usb 2-1: USB disconnect, device number 21 [ 266.026277][T10450] netlink: 8 bytes leftover after parsing attributes in process `syz.0.480'. [ 266.114559][T10450] netlink: 8 bytes leftover after parsing attributes in process `syz.0.480'. [ 266.789123][T10465] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 267.049212][T10465] bond2: entered promiscuous mode [ 267.096420][T10465] bond2: entered allmulticast mode [ 267.110857][T10465] 8021q: adding VLAN 0 to HW filter on device bond2 [ 268.447602][T10493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.466850][T10493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.563890][T10493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.763324][ T847] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 268.780977][T10493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.928304][ T847] usb 3-1: Using ep0 maxpacket: 32 [ 269.019940][ T847] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 269.035584][ T847] usb 3-1: config 0 has no interface number 0 [ 269.126594][ T847] usb 3-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 269.136181][ T847] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.174631][ T847] usb 3-1: Product: syz [ 269.399681][ T847] usb 3-1: Manufacturer: syz [ 269.450878][ T847] usb 3-1: SerialNumber: syz [ 269.534327][T10500] x_tables: unsorted underflow at hook 2 [ 269.542924][ T847] usb 3-1: config 0 descriptor?? [ 269.567724][ T847] hub 3-1:0.89: bad descriptor, ignoring hub [ 269.577198][T10500] netlink: 'syz.3.495': attribute type 1 has an invalid length. [ 269.586144][ T847] hub 3-1:0.89: probe with driver hub failed with error -5 [ 269.619769][ T847] option 3-1:0.89: GSM modem (1-port) converter detected [ 269.657995][T10500] bond3: entered promiscuous mode [ 269.666681][T10500] 8021q: adding VLAN 0 to HW filter on device bond3 [ 269.686067][ T847] usb 3-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 269.780031][T10492] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 269.820873][ T5940] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 269.919044][ T5939] usb 3-1: USB disconnect, device number 28 [ 269.934474][ T5939] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 269.976419][ T5939] option 3-1:0.89: device disconnected [ 270.198477][ T2901] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 270.468372][ T5939] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 271.376304][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 271.395593][ T13] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 271.442500][T10517] program syz.0.499 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 271.668569][ T5956] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 271.819004][ T5857] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 271.839721][T10524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.849709][T10524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 271.879232][ T5956] usb 4-1: Using ep0 maxpacket: 16 [ 272.018651][T10515] netlink: 8 bytes leftover after parsing attributes in process `syz.3.497'. [ 272.065173][T10524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.074963][T10524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.143844][T10528] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 272.156808][T10518] netlink: 4 bytes leftover after parsing attributes in process `syz.3.497'. [ 272.232860][T10529] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 272.540417][T10532] netlink: 60 bytes leftover after parsing attributes in process `syz.1.503'. [ 272.676638][T10529] bond2: entered promiscuous mode [ 272.688913][T10529] bond2: entered allmulticast mode [ 272.718254][T10529] 8021q: adding VLAN 0 to HW filter on device bond2 [ 273.008729][T10539] netlink: 36 bytes leftover after parsing attributes in process `syz.2.504'. [ 274.278277][ T5956] usb 4-1: unable to get BOS descriptor or descriptor too short [ 274.301439][ T5956] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 274.338493][ T5956] usb 4-1: can't read configurations, error -71 [ 274.397528][ T30] audit: type=1400 audit(1752162170.591:44): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626200D3A06B1C25E964106EE18C023AE1DAEE1 pid=10545 comm="syz.0.507" [ 275.448243][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 276.226242][T10589] netlink: 'syz.3.512': attribute type 10 has an invalid length. [ 276.478573][T10588] bond0: entered promiscuous mode [ 276.490981][T10588] bond_slave_0: entered promiscuous mode [ 276.504672][T10588] bond_slave_1: entered promiscuous mode [ 276.537929][T10588] hsr1: entered allmulticast mode [ 276.621759][T10588] bridge0: entered allmulticast mode [ 276.627542][T10588] bond0: entered allmulticast mode [ 276.646703][T10588] bond_slave_0: entered allmulticast mode [ 276.673168][T10588] bond_slave_1: entered allmulticast mode [ 277.468874][T10604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.517684][T10604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.252498][T10612] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 278.436985][T10612] bond3: entered promiscuous mode [ 278.446691][T10612] bond3: entered allmulticast mode [ 278.453096][T10612] 8021q: adding VLAN 0 to HW filter on device bond3 [ 278.558200][ T5940] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 278.871598][ T5940] usb 2-1: Using ep0 maxpacket: 8 [ 279.014903][ T5940] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 279.023534][ T5940] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 279.131232][ T5940] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 279.150513][ T5940] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 279.184313][ T5940] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 279.275505][ T5940] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 279.370949][ T5940] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.714869][ T5940] usb 2-1: usb_control_msg returned -32 [ 279.720690][ T5940] usbtmc 2-1:16.0: can't read capabilities [ 280.452838][T10633] netlink: 36 bytes leftover after parsing attributes in process `syz.2.522'. [ 280.596160][T10628] usbtmc 2-1:16.0: usb_control_msg returned -32 [ 280.756164][T10638] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 280.798939][ T55] usb 2-1: USB disconnect, device number 22 [ 281.963226][T10656] netlink: 36 bytes leftover after parsing attributes in process `syz.2.526'. [ 282.468664][ T55] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 282.633870][ T55] usb 2-1: config index 0 descriptor too short (expected 5292, got 77) [ 282.645138][ T55] usb 2-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 282.663193][ T55] usb 2-1: config 55 has 0 interfaces, different from the descriptor's value: 20 [ 282.682152][ T55] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 282.693627][ T55] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.704683][ T55] usb 2-1: Product: syz [ 282.709461][ T55] usb 2-1: Manufacturer: syz [ 282.714232][ T55] usb 2-1: SerialNumber: syz [ 283.288281][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 283.664679][T10657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.675949][T10657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.180915][T10674] loop6: detected capacity change from 0 to 524287999 [ 285.565665][ T847] usb 2-1: USB disconnect, device number 23 [ 285.705583][T10680] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 285.992113][T10683] netlink: 12 bytes leftover after parsing attributes in process `syz.1.533'. [ 286.056406][T10680] bond4: entered promiscuous mode [ 286.078677][T10680] bond4: entered allmulticast mode [ 286.084549][T10680] 8021q: adding VLAN 0 to HW filter on device bond4 [ 286.283928][T10687] FAULT_INJECTION: forcing a failure. [ 286.283928][T10687] name failslab, interval 1, probability 0, space 0, times 0 [ 286.313253][T10687] CPU: 0 UID: 0 PID: 10687 Comm: syz.4.536 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 286.313283][T10687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 286.313296][T10687] Call Trace: [ 286.313304][T10687] [ 286.313313][T10687] dump_stack_lvl+0x189/0x250 [ 286.313344][T10687] ? __pfx____ratelimit+0x10/0x10 [ 286.313376][T10687] ? __pfx_dump_stack_lvl+0x10/0x10 [ 286.313401][T10687] ? __pfx__printk+0x10/0x10 [ 286.313436][T10687] ? __pfx___might_resched+0x10/0x10 [ 286.313458][T10687] ? fs_reclaim_acquire+0x7d/0x100 [ 286.313493][T10687] should_fail_ex+0x414/0x560 [ 286.313526][T10687] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 286.313551][T10687] should_failslab+0xa8/0x100 [ 286.313579][T10687] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 286.313602][T10687] kmem_cache_alloc_lru_noprof+0x78/0x3d0 [ 286.313626][T10687] ? alloc_inode+0x67/0x1b0 [ 286.313661][T10687] ? start_creating+0x2a3/0x3c0 [ 286.313686][T10687] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 286.313710][T10687] alloc_inode+0x67/0x1b0 [ 286.313738][T10687] new_inode+0x22/0x170 [ 286.313770][T10687] __debugfs_create_file+0x14d/0x4f0 [ 286.313800][T10687] debugfs_create_file_full+0x3f/0x60 [ 286.313829][T10687] bdi_register_va+0x2d5/0x740 [ 286.313874][T10687] super_setup_bdi_name+0xe6/0x200 [ 286.313897][T10687] ? fuse_dev_install+0x8d/0x1a0 [ 286.313932][T10687] ? __pfx_super_setup_bdi_name+0x10/0x10 [ 286.313964][T10687] ? do_raw_spin_unlock+0x122/0x240 [ 286.314001][T10687] fuse_fill_super_common+0x64a/0x1150 [ 286.314042][T10687] ? __pfx_fuse_fill_super_common+0x10/0x10 [ 286.314072][T10687] ? __init_swait_queue_head+0xa9/0x150 [ 286.314106][T10687] ? shrinker_register+0x16b/0x230 [ 286.314139][T10687] ? sget_fc+0x962/0xa40 [ 286.314164][T10687] fuse_fill_super+0x176/0x1f0 [ 286.314193][T10687] ? __pfx_fuse_fill_super+0x10/0x10 [ 286.314225][T10687] get_tree_nodev+0xb8/0x150 [ 286.314252][T10687] fuse_get_tree+0x2eb/0x4e0 [ 286.314294][T10687] vfs_get_tree+0x92/0x2b0 [ 286.314322][T10687] do_new_mount+0x24a/0xa40 [ 286.314359][T10687] __se_sys_mount+0x317/0x410 [ 286.314394][T10687] ? __pfx___se_sys_mount+0x10/0x10 [ 286.314423][T10687] ? __secure_computing+0xe2/0x2a0 [ 286.314450][T10687] ? __x64_sys_mount+0x20/0xc0 [ 286.314480][T10687] do_syscall_64+0xfa/0x3b0 [ 286.314500][T10687] ? lockdep_hardirqs_on+0x9c/0x150 [ 286.314530][T10687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.314550][T10687] ? clear_bhb_loop+0x60/0xb0 [ 286.314577][T10687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.314597][T10687] RIP: 0033:0x7f10fe78e929 [ 286.314617][T10687] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 286.314657][T10687] RSP: 002b:00007f10ff66f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 286.314681][T10687] RAX: ffffffffffffffda RBX: 00007f10fe9b5fa0 RCX: 00007f10fe78e929 [ 286.314696][T10687] RDX: 0000200000002100 RSI: 00002000000020c0 RDI: 0000000000000000 [ 286.314710][T10687] RBP: 00007f10ff66f090 R08: 0000200000002140 R09: 0000000000000000 [ 286.314724][T10687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 286.314737][T10687] R13: 0000000000000000 R14: 00007f10fe9b5fa0 R15: 00007f10feadfa28 [ 286.314771][T10687] [ 286.378954][T10687] debugfs: out of free dentries, can not create file 'wb_stats' [ 287.396853][T10701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 287.409156][T10701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 287.550267][T10707] netlink: 8 bytes leftover after parsing attributes in process `syz.2.539'. [ 287.692045][T10709] netlink: 16 bytes leftover after parsing attributes in process `syz.3.540'. [ 290.236703][T10739] netlink: 20 bytes leftover after parsing attributes in process `syz.1.546'. [ 292.668420][ T5939] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 292.830224][ T5939] usb 2-1: Using ep0 maxpacket: 8 [ 292.853446][ T5939] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 292.869552][T10763] bridge_slave_0: left allmulticast mode [ 292.885096][T10765] netlink: 'syz.4.556': attribute type 2 has an invalid length. [ 292.913893][ T5939] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 292.933505][T10763] bridge_slave_0: left promiscuous mode [ 292.948183][T10765] netlink: 'syz.4.556': attribute type 1 has an invalid length. [ 292.955890][T10765] netlink: 777 bytes leftover after parsing attributes in process `syz.4.556'. [ 292.958690][T10763] bridge0: port 1(bridge_slave_0) entered disabled state [ 292.983265][ T5939] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 293.001099][ T5939] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 293.024834][ T5939] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 293.067599][T10763] bridge_slave_1: left allmulticast mode [ 293.081219][T10763] bridge_slave_1: left promiscuous mode [ 293.086995][ T5939] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 293.100302][T10763] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.111341][ T5939] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.124345][T10763] bond1: (slave veth0_to_bond): Releasing active interface [ 293.165698][T10765] netlink: 129904 bytes leftover after parsing attributes in process `syz.4.556'. [ 293.193708][T10763] bond0: (slave bond_slave_0): Releasing backup interface [ 293.271225][T10765] netlink: 'syz.4.556': attribute type 2 has an invalid length. [ 293.290042][T10765] netlink: 'syz.4.556': attribute type 1 has an invalid length. [ 293.306984][T10765] netlink: 777 bytes leftover after parsing attributes in process `syz.4.556'. [ 293.357174][T10763] bond0: (slave bond_slave_1): Releasing backup interface [ 293.445351][T10763] team0: Failed to send options change via netlink (err -105) [ 293.466807][ T5939] usb 2-1: usb_control_msg returned -32 [ 293.482547][ T5939] usbtmc 2-1:16.0: can't read capabilities [ 293.489610][T10763] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 293.537094][T10763] team0: Port device team_slave_0 removed [ 293.620375][T10763] team0: Port device team_slave_1 removed [ 293.630711][T10763] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 293.639064][T10763] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 293.663599][T10763] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 293.690638][T10763] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 293.713346][T10763] bond1: (slave veth3): Releasing active interface [ 294.187182][T10783] usbtmc 2-1:16.0: usb_control_msg returned -32 [ 294.283066][T10781] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 294.303205][T10781] bond2: entered promiscuous mode [ 294.309203][T10781] ip6gretap1: entered promiscuous mode [ 294.316927][T10781] 8021q: adding VLAN 0 to HW filter on device bond2 [ 294.395558][ T55] usb 2-1: USB disconnect, device number 24 [ 294.509804][ T5939] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 294.689568][ T5939] usb 1-1: Using ep0 maxpacket: 8 [ 294.729921][ T5939] usb 1-1: unable to get BOS descriptor or descriptor too short [ 294.743474][ T5939] usb 1-1: config 10 has an invalid interface number: 223 but max is 2 [ 294.768207][ T5939] usb 1-1: config 10 has an invalid descriptor of length 0, skipping remainder of the config [ 294.801405][ T5939] usb 1-1: config 10 has 1 interface, different from the descriptor's value: 3 [ 294.812194][ T5939] usb 1-1: config 10 has no interface number 0 [ 294.818616][ T5939] usb 1-1: config 10 interface 223 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 15 [ 294.832463][ T5939] usb 1-1: config 10 interface 223 has no altsetting 0 [ 294.846568][T10781] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface [ 294.861007][T10781] ip6gretap1: left promiscuous mode [ 294.871516][ T5939] usb 1-1: New USB device found, idVendor=2013, idProduct=025d, bcdDevice=a3.4b [ 294.873757][T10781] bond2 (unregistering): Released all slaves [ 294.891171][ T5939] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.908138][ T5939] usb 1-1: Product: syz [ 294.917797][ T5939] usb 1-1: Manufacturer: syz [ 294.928437][ T5939] usb 1-1: SerialNumber: syz [ 295.375059][T10798] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 295.802123][ T5939] dvb-usb: found a 'PCTV 2002e SE' in cold state, will try to load a firmware [ 295.829382][ T5939] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 295.854770][T10809] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 295.876453][ T5939] dib0700: firmware download failed at 7 with -22 [ 295.901029][ T5939] usb 1-1: USB disconnect, device number 28 [ 295.993930][ T6049] udevd[6049]: setting owner of /dev/bus/usb/001/028 to uid=0, gid=0 failed: No such file or directory [ 296.032729][T10809] bond4: entered promiscuous mode [ 296.038310][T10809] bond4: entered allmulticast mode [ 296.043987][T10809] 8021q: adding VLAN 0 to HW filter on device bond4 [ 298.244569][T10839] macvlan3: entered promiscuous mode [ 298.678438][ T55] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 298.801993][T10850] xt_NFQUEUE: number of total queues is 0 [ 298.878757][ T55] usb 2-1: config index 0 descriptor too short (expected 5292, got 77) [ 298.899514][ T55] usb 2-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 298.949317][ T55] usb 2-1: config 55 has 0 interfaces, different from the descriptor's value: 20 [ 298.975705][ T55] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 298.991903][T10850] macvlan4: entered allmulticast mode [ 298.998734][T10850] bond_slave_0: entered promiscuous mode [ 299.004502][T10850] bond_slave_1: entered promiscuous mode [ 299.029223][T10850] bond0: entered allmulticast mode [ 299.035197][T10850] bond_slave_0: entered allmulticast mode [ 299.044994][ T55] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.068698][T10850] bond_slave_1: entered allmulticast mode [ 299.078276][ T55] usb 2-1: Product: syz [ 299.101145][ T55] usb 2-1: Manufacturer: syz [ 299.150112][ T55] usb 2-1: SerialNumber: syz [ 299.158480][ T5939] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 299.167310][T10850] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 299.286906][T10850] team0: Port device macvlan4 added [ 299.334230][ T5939] usb 1-1: Using ep0 maxpacket: 8 [ 299.364272][ T5939] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 299.392447][ T5939] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 299.432221][ T5939] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 299.497291][T10852] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 299.497295][ T5939] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 299.497324][ T5939] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 299.515494][T10843] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 299.556634][T10843] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.642483][ T5939] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 299.655774][ T5939] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 299.849616][T10854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 299.904464][T10854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 299.928320][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 299.946200][ T5939] usb 1-1: usb_control_msg returned -32 [ 299.950082][T10857] macsec1: entered allmulticast mode [ 299.961323][ T5939] usbtmc 1-1:16.0: can't read capabilities [ 299.975672][T10857] bridge0: port 1(macsec1) entered blocking state [ 300.001025][T10857] bridge0: port 1(macsec1) entered disabled state [ 300.072410][T10863] netlink: 20 bytes leftover after parsing attributes in process `syz.3.587'. [ 300.485785][T10870] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 300.565593][T10870] bond5: entered promiscuous mode [ 300.581281][T10870] bond5: entered allmulticast mode [ 300.587772][T10870] 8021q: adding VLAN 0 to HW filter on device bond5 [ 300.671534][T10872] usbtmc 1-1:16.0: usb_control_msg returned -32 [ 300.873761][ T55] usb 1-1: USB disconnect, device number 29 [ 301.330473][ T847] usb 2-1: USB disconnect, device number 25 [ 302.232369][T10892] fuse: Bad value for 'user_id' [ 302.237302][T10892] fuse: Bad value for 'user_id' [ 302.698642][ T847] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 302.750428][ T55] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 302.762238][ T55] hid-generic 0000:0000:0000.000A: hidraw1: HID v0.00 Device [syz1] on syz0 [ 302.863516][ T847] usb 1-1: config index 0 descriptor too short (expected 5292, got 77) [ 302.876837][ T847] usb 1-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 302.920170][ T847] usb 1-1: config 55 has 0 interfaces, different from the descriptor's value: 20 [ 302.962427][ T847] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 302.988744][ T847] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.003743][ T847] usb 1-1: Product: syz [ 303.021487][ T847] usb 1-1: Manufacturer: syz [ 303.062391][ T847] usb 1-1: SerialNumber: syz [ 303.405469][T10889] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 303.414557][T10889] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 303.536720][ T55] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 303.698366][ T55] usb 4-1: Using ep0 maxpacket: 32 [ 303.706478][ T55] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 303.720997][ T55] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 303.737002][ T55] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 303.774822][ T55] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 303.817632][ T55] usb 4-1: config 0 interface 0 has no altsetting 0 [ 303.841197][ T55] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 303.852817][ T55] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 303.862146][ T55] usb 4-1: Product: syz [ 303.869206][ T55] usb 4-1: Manufacturer: syz [ 303.880055][ T55] usb 4-1: SerialNumber: syz [ 303.910995][ T55] usb 4-1: config 0 descriptor?? [ 303.957403][ T55] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 303.984347][ T55] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 304.226040][ T55] usb 4-1: USB disconnect, device number 26 [ 304.232097][ C0] ldusb 4-1:0.0: usb_submit_urb failed (-19) [ 304.279495][ T55] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 304.775250][ T847] usb 1-1: USB disconnect, device number 30 [ 305.301023][T10929] FAULT_INJECTION: forcing a failure. [ 305.301023][T10929] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 305.413315][T10929] CPU: 1 UID: 0 PID: 10929 Comm: syz.3.603 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 305.413346][T10929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 305.413358][T10929] Call Trace: [ 305.413367][T10929] [ 305.413376][T10929] dump_stack_lvl+0x189/0x250 [ 305.413410][T10929] ? __pfx____ratelimit+0x10/0x10 [ 305.413440][T10929] ? __pfx_dump_stack_lvl+0x10/0x10 [ 305.413464][T10929] ? __pfx__printk+0x10/0x10 [ 305.413490][T10929] ? __might_fault+0xb0/0x130 [ 305.413525][T10929] should_fail_ex+0x414/0x560 [ 305.413560][T10929] _copy_from_user+0x2d/0xb0 [ 305.413584][T10929] generic_map_update_batch+0x51b/0x7f0 [ 305.413625][T10929] ? __pfx_generic_map_update_batch+0x10/0x10 [ 305.413651][T10929] ? __fget_files+0x2a/0x420 [ 305.413685][T10929] ? __pfx_generic_map_update_batch+0x10/0x10 [ 305.413709][T10929] bpf_map_do_batch+0x369/0x5f0 [ 305.413736][T10929] __sys_bpf+0x384/0x860 [ 305.413758][T10929] ? __pfx___sys_bpf+0x10/0x10 [ 305.413790][T10929] ? ksys_write+0x22a/0x250 [ 305.413815][T10929] ? __pfx_ksys_write+0x10/0x10 [ 305.413843][T10929] ? rcu_is_watching+0x15/0xb0 [ 305.413874][T10929] __x64_sys_bpf+0x7c/0x90 [ 305.413903][T10929] do_syscall_64+0xfa/0x3b0 [ 305.413921][T10929] ? lockdep_hardirqs_on+0x9c/0x150 [ 305.413951][T10929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.413970][T10929] ? clear_bhb_loop+0x60/0xb0 [ 305.413994][T10929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.414013][T10929] RIP: 0033:0x7fac6058e929 [ 305.414032][T10929] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 305.414049][T10929] RSP: 002b:00007fac614d3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 305.414071][T10929] RAX: ffffffffffffffda RBX: 00007fac607b5fa0 RCX: 00007fac6058e929 [ 305.414086][T10929] RDX: 0000000000000038 RSI: 0000200000000200 RDI: 000000000000001a [ 305.414098][T10929] RBP: 00007fac614d3090 R08: 0000000000000000 R09: 0000000000000000 [ 305.414110][T10929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 305.414122][T10929] R13: 0000000000000000 R14: 00007fac607b5fa0 R15: 00007fac608dfa28 [ 305.414154][T10929] [ 306.748448][ T847] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 306.797024][T10944] cifs: Unknown parameter 'f,' [ 306.898216][ T847] usb 1-1: Using ep0 maxpacket: 8 [ 306.952545][ T847] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 306.976012][ T847] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 307.002320][ T847] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 307.051655][ T847] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 307.105443][ T847] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 307.282463][ T847] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 307.388419][ T847] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 307.478557][ T5857] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 307.668196][ T5857] usb 2-1: Using ep0 maxpacket: 16 [ 307.686994][ T5857] usb 2-1: config 0 has no interfaces? [ 307.696131][ T5857] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 307.708390][ T5939] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 307.732924][ T847] usb 1-1: usb_control_msg returned -32 [ 307.738763][ T5857] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 307.738794][ T5857] usb 2-1: Manufacturer: syz [ 307.756876][ T5857] usb 2-1: config 0 descriptor?? [ 307.779390][ T847] usbtmc 1-1:16.0: can't read capabilities [ 307.977368][ T5939] usb 3-1: config index 0 descriptor too short (expected 5292, got 77) [ 308.007641][ T5939] usb 3-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 308.068487][ T5939] usb 3-1: config 55 has 0 interfaces, different from the descriptor's value: 20 [ 308.115980][T10952] netlink: 'syz.1.609': attribute type 27 has an invalid length. [ 308.138389][ T5939] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 308.147492][ T5939] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.165339][ T5939] usb 3-1: Product: syz [ 308.169975][ T5939] usb 3-1: Manufacturer: syz [ 308.175762][ T5939] usb 3-1: SerialNumber: syz [ 308.433467][T10956] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 308.444633][T10956] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 308.464964][T10961] usbtmc 1-1:16.0: usb_control_msg returned -32 [ 308.667010][ T5939] usb 1-1: USB disconnect, device number 31 [ 308.970951][ T5956] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 309.145732][ T5956] usb 4-1: Using ep0 maxpacket: 32 [ 309.164968][ T5956] usb 4-1: unable to get BOS descriptor or descriptor too short [ 309.179406][ T5956] usb 4-1: config 7 has an invalid interface number: 187 but max is 0 [ 309.190082][ T5956] usb 4-1: config 7 has no interface number 0 [ 309.220876][ T5956] usb 4-1: config 7 interface 187 has no altsetting 0 [ 309.253506][ T5956] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 309.298270][ T5956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.327998][ T5956] usb 4-1: Product: syz [ 309.357415][ T5956] usb 4-1: Manufacturer: syz [ 309.393441][ T5956] usb 4-1: SerialNumber: syz [ 309.987165][ T5956] usb 4-1: Cannot retrieve CPort count: -71 [ 310.003198][ T5956] usb 4-1: Cannot retrieve CPort count: -71 [ 310.019999][ T5956] es2_ap_driver 4-1:7.187: probe with driver es2_ap_driver failed with error -71 [ 310.045607][T10969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 310.062124][ T5956] usb 4-1: USB disconnect, device number 27 [ 310.070557][T10969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 310.130402][ T5857] usb 3-1: USB disconnect, device number 29 [ 310.273763][T10969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 310.288882][T10969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 310.748335][ T5956] usb 2-1: USB disconnect, device number 26 [ 311.118332][T10984] FAULT_INJECTION: forcing a failure. [ 311.118332][T10984] name failslab, interval 1, probability 0, space 0, times 0 [ 311.241567][T10984] CPU: 1 UID: 0 PID: 10984 Comm: syz.1.617 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 311.241598][T10984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 311.241608][T10984] Call Trace: [ 311.241616][T10984] [ 311.241623][T10984] dump_stack_lvl+0x189/0x250 [ 311.241648][T10984] ? __pfx____ratelimit+0x10/0x10 [ 311.241680][T10984] ? __pfx_dump_stack_lvl+0x10/0x10 [ 311.241700][T10984] ? __pfx__printk+0x10/0x10 [ 311.241725][T10984] ? __pfx___might_resched+0x10/0x10 [ 311.241751][T10984] ? fs_reclaim_acquire+0x7d/0x100 [ 311.241778][T10984] should_fail_ex+0x414/0x560 [ 311.241805][T10984] should_failslab+0xa8/0x100 [ 311.241828][T10984] __kmalloc_noprof+0xcb/0x4f0 [ 311.241852][T10984] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 311.241876][T10984] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 311.241907][T10984] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 311.241939][T10984] genl_family_rcv_msg_doit+0xb8/0x300 [ 311.241969][T10984] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 311.242000][T10984] ? rcu_is_watching+0x15/0xb0 [ 311.242028][T10984] ? apparmor_capable+0x137/0x1b0 [ 311.242048][T10984] ? bpf_lsm_capable+0x9/0x20 [ 311.242066][T10984] ? security_capable+0x7e/0x2e0 [ 311.242101][T10984] genl_rcv_msg+0x60e/0x790 [ 311.242137][T10984] ? __pfx_genl_rcv_msg+0x10/0x10 [ 311.242158][T10984] ? ref_tracker_free+0x63a/0x7d0 [ 311.242181][T10984] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 311.242202][T10984] ? __pfx_nl80211_set_wiphy+0x10/0x10 [ 311.242224][T10984] ? __pfx_nl80211_post_doit+0x10/0x10 [ 311.242247][T10984] ? __pfx_ref_tracker_free+0x10/0x10 [ 311.242282][T10984] netlink_rcv_skb+0x205/0x470 [ 311.242301][T10984] ? __pfx_genl_rcv_msg+0x10/0x10 [ 311.242326][T10984] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 311.242361][T10984] ? down_read+0x1ad/0x2e0 [ 311.242381][T10984] genl_rcv+0x28/0x40 [ 311.242402][T10984] netlink_unicast+0x758/0x8d0 [ 311.242430][T10984] netlink_sendmsg+0x805/0xb30 [ 311.242459][T10984] ? __pfx_netlink_sendmsg+0x10/0x10 [ 311.242481][T10984] ? aa_sock_msg_perm+0x94/0x160 [ 311.242506][T10984] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 311.242529][T10984] ? __pfx_netlink_sendmsg+0x10/0x10 [ 311.242549][T10984] __sock_sendmsg+0x219/0x270 [ 311.242577][T10984] ____sys_sendmsg+0x505/0x830 [ 311.242603][T10984] ? __pfx_____sys_sendmsg+0x10/0x10 [ 311.242640][T10984] ? import_iovec+0x74/0xa0 [ 311.242662][T10984] ___sys_sendmsg+0x21f/0x2a0 [ 311.242684][T10984] ? __pfx____sys_sendmsg+0x10/0x10 [ 311.242739][T10984] ? __fget_files+0x2a/0x420 [ 311.242759][T10984] ? __fget_files+0x3a0/0x420 [ 311.242790][T10984] __x64_sys_sendmsg+0x19b/0x260 [ 311.242813][T10984] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 311.242843][T10984] ? __pfx_ksys_write+0x10/0x10 [ 311.242866][T10984] ? rcu_is_watching+0x15/0xb0 [ 311.242890][T10984] ? do_syscall_64+0xbe/0x3b0 [ 311.242918][T10984] do_syscall_64+0xfa/0x3b0 [ 311.242937][T10984] ? lockdep_hardirqs_on+0x9c/0x150 [ 311.242961][T10984] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 311.242977][T10984] ? clear_bhb_loop+0x60/0xb0 [ 311.242996][T10984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 311.243011][T10984] RIP: 0033:0x7fab8618e929 [ 311.243026][T10984] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 311.243041][T10984] RSP: 002b:00007fab86fb6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 311.243059][T10984] RAX: ffffffffffffffda RBX: 00007fab863b5fa0 RCX: 00007fab8618e929 [ 311.243077][T10984] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 311.243087][T10984] RBP: 00007fab86fb6090 R08: 0000000000000000 R09: 0000000000000000 [ 311.243096][T10984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 311.243106][T10984] R13: 0000000000000000 R14: 00007fab863b5fa0 R15: 00007fab864dfa28 [ 311.243132][T10984] [ 311.881805][T10990] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 313.538467][ T5940] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 313.789674][ T5940] usb 1-1: config 0 has no interfaces? [ 313.989164][ T5940] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 314.008921][ T5940] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.017027][ T5940] usb 1-1: Product: syz [ 314.041812][ T5940] usb 1-1: Manufacturer: syz [ 314.148127][ T5940] usb 1-1: SerialNumber: syz [ 314.173654][ T5940] usb 1-1: config 0 descriptor?? [ 314.512282][T11007] program syz.0.622 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 314.522485][T11007] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 316.238619][T11038] xt_NFQUEUE: number of total queues is 0 [ 316.307136][ T5939] usb 1-1: USB disconnect, device number 32 [ 316.383282][T11040] macvlan0: entered allmulticast mode [ 316.436670][T11040] bond0: entered allmulticast mode [ 316.478025][T11043] netlink: 16 bytes leftover after parsing attributes in process `syz.0.631'. [ 316.479177][T11040] bond_slave_0: entered allmulticast mode [ 316.494832][T11043] netlink: 16 bytes leftover after parsing attributes in process `syz.0.631'. [ 316.547747][ T5956] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 316.555597][T11040] bond_slave_1: entered allmulticast mode [ 316.617195][T11040] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 316.631937][T11040] team0: Port device macvlan0 added [ 316.742104][ T5956] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 316.821220][ T5956] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 316.905497][ T5956] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 316.962935][ T5956] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.004007][T11041] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 317.031819][ T5956] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 317.219086][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.225480][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.353999][ T5939] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 317.665392][ T5939] usb 2-1: config 0 has no interfaces? [ 317.695062][ T5939] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 317.701594][ T55] usb 3-1: USB disconnect, device number 30 [ 317.721299][ T5939] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.804589][ T5939] usb 2-1: Product: syz [ 317.820967][ T5939] usb 2-1: Manufacturer: syz [ 317.836208][ T5939] usb 2-1: SerialNumber: syz [ 317.862073][ T5939] usb 2-1: config 0 descriptor?? [ 318.504097][ T5956] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 318.779673][ T5956] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 318.792421][ T5956] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 318.833051][ T5956] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 318.914062][ T5956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.957331][T11070] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 318.970414][ T5956] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 319.426429][T11073] netlink: 28 bytes leftover after parsing attributes in process `syz.2.638'. [ 319.542018][ T847] usb 1-1: USB disconnect, device number 33 [ 319.815261][T11076] FAULT_INJECTION: forcing a failure. [ 319.815261][T11076] name failslab, interval 1, probability 0, space 0, times 0 [ 319.846887][T11076] CPU: 1 UID: 0 PID: 11076 Comm: syz.3.639 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 319.846922][T11076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 319.846934][T11076] Call Trace: [ 319.846943][T11076] [ 319.846952][T11076] dump_stack_lvl+0x189/0x250 [ 319.846983][T11076] ? __pfx____ratelimit+0x10/0x10 [ 319.847014][T11076] ? __pfx_dump_stack_lvl+0x10/0x10 [ 319.847038][T11076] ? __pfx__printk+0x10/0x10 [ 319.847071][T11076] ? __pfx___might_resched+0x10/0x10 [ 319.847092][T11076] ? fs_reclaim_acquire+0x7d/0x100 [ 319.847126][T11076] should_fail_ex+0x414/0x560 [ 319.847161][T11076] should_failslab+0xa8/0x100 [ 319.847190][T11076] __kmalloc_cache_noprof+0x70/0x3d0 [ 319.847213][T11076] ? xdp_umem_create+0x58/0x8e0 [ 319.847247][T11076] xdp_umem_create+0x58/0x8e0 [ 319.847288][T11076] xsk_setsockopt+0x62a/0x710 [ 319.847320][T11076] ? __pfx_xsk_setsockopt+0x10/0x10 [ 319.847351][T11076] ? __lock_acquire+0xab9/0xd20 [ 319.847380][T11076] ? aa_sock_opt_perm+0x74/0x110 [ 319.847412][T11076] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 319.847440][T11076] ? __pfx_xsk_setsockopt+0x10/0x10 [ 319.847468][T11076] do_sock_setsockopt+0x25a/0x3e0 [ 319.847499][T11076] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 319.847528][T11076] ? __fget_files+0x2a/0x420 [ 319.847566][T11076] __x64_sys_setsockopt+0x18b/0x220 [ 319.847663][T11076] do_syscall_64+0xfa/0x3b0 [ 319.847682][T11076] ? lockdep_hardirqs_on+0x9c/0x150 [ 319.847712][T11076] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.847732][T11076] ? clear_bhb_loop+0x60/0xb0 [ 319.847757][T11076] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.847776][T11076] RIP: 0033:0x7fac6058e929 [ 319.847796][T11076] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 319.847814][T11076] RSP: 002b:00007fac614d3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 319.847837][T11076] RAX: ffffffffffffffda RBX: 00007fac607b5fa0 RCX: 00007fac6058e929 [ 319.847851][T11076] RDX: 0000000000000004 RSI: 000000000000011b RDI: 0000000000000006 [ 319.847922][T11076] RBP: 00007fac614d3090 R08: 000000000000001c R09: 0000000000000000 [ 319.847934][T11076] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 319.847944][T11076] R13: 0000000000000000 R14: 00007fac607b5fa0 R15: 00007fac608dfa28 [ 319.847979][T11076] [ 320.410916][ T5939] usb 2-1: USB disconnect, device number 27 [ 323.188727][ T5939] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 323.338262][ T5939] usb 3-1: Using ep0 maxpacket: 32 [ 323.345101][ T5939] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.363132][ T5939] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.435992][ T5939] usb 3-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 323.485448][ T5939] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.510060][ T5939] usb 3-1: config 0 descriptor?? [ 323.576520][T11119] netlink: 4 bytes leftover after parsing attributes in process `syz.0.653'. [ 323.769684][T11114] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 323.803120][T11114] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 323.925260][T11119] bridge0: entered promiscuous mode [ 323.965955][T11119] bridge0: port 1(macvlan2) entered blocking state [ 323.986016][ T5939] usbhid 3-1:0.0: can't add hid device: -71 [ 324.000711][ T5939] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 324.009234][T11119] bridge0: port 1(macvlan2) entered disabled state [ 324.041176][T11119] macvlan2: entered allmulticast mode [ 324.050359][T11119] bridge0: entered allmulticast mode [ 324.082952][ T5939] usb 3-1: USB disconnect, device number 31 [ 324.144301][T11126] netlink: 12 bytes leftover after parsing attributes in process `syz.2.655'. [ 324.173276][T11119] macvlan2: left allmulticast mode [ 324.180014][T11119] bridge0: left allmulticast mode [ 324.207572][T11119] bridge0: left promiscuous mode [ 324.415235][T11126] vlan2: entered promiscuous mode [ 324.554527][T11126] syz_tun: entered promiscuous mode [ 324.597100][T11136] FAULT_INJECTION: forcing a failure. [ 324.597100][T11136] name failslab, interval 1, probability 0, space 0, times 0 [ 324.624307][T11136] CPU: 1 UID: 0 PID: 11136 Comm: syz.0.656 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 324.624329][T11136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 324.624336][T11136] Call Trace: [ 324.624342][T11136] [ 324.624349][T11136] dump_stack_lvl+0x189/0x250 [ 324.624369][T11136] ? __pfx____ratelimit+0x10/0x10 [ 324.624388][T11136] ? __pfx_dump_stack_lvl+0x10/0x10 [ 324.624402][T11136] ? __pfx__printk+0x10/0x10 [ 324.624422][T11136] ? __pfx___might_resched+0x10/0x10 [ 324.624439][T11136] should_fail_ex+0x414/0x560 [ 324.624460][T11136] should_failslab+0xa8/0x100 [ 324.624477][T11136] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 324.624492][T11136] ? __alloc_skb+0x112/0x2d0 [ 324.624508][T11136] __alloc_skb+0x112/0x2d0 [ 324.624526][T11136] netlink_sendmsg+0x5c6/0xb30 [ 324.624547][T11136] ? __pfx_netlink_sendmsg+0x10/0x10 [ 324.624563][T11136] ? aa_sock_msg_perm+0x94/0x160 [ 324.624582][T11136] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 324.624599][T11136] ? __pfx_netlink_sendmsg+0x10/0x10 [ 324.624616][T11136] __sock_sendmsg+0x219/0x270 [ 324.624636][T11136] ____sys_sendmsg+0x505/0x830 [ 324.624654][T11136] ? __pfx_____sys_sendmsg+0x10/0x10 [ 324.624675][T11136] ? import_iovec+0x74/0xa0 [ 324.624691][T11136] ___sys_sendmsg+0x21f/0x2a0 [ 324.624712][T11136] ? __pfx____sys_sendmsg+0x10/0x10 [ 324.624749][T11136] ? __fget_files+0x2a/0x420 [ 324.624764][T11136] ? __fget_files+0x3a0/0x420 [ 324.624786][T11136] __x64_sys_sendmsg+0x19b/0x260 [ 324.624803][T11136] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 324.624824][T11136] ? __pfx_ksys_write+0x10/0x10 [ 324.624837][T11136] ? rcu_is_watching+0x15/0xb0 [ 324.624862][T11136] ? do_syscall_64+0xbe/0x3b0 [ 324.624876][T11136] do_syscall_64+0xfa/0x3b0 [ 324.624886][T11136] ? lockdep_hardirqs_on+0x9c/0x150 [ 324.624904][T11136] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.624916][T11136] ? clear_bhb_loop+0x60/0xb0 [ 324.624930][T11136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.624941][T11136] RIP: 0033:0x7f502198e929 [ 324.624953][T11136] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 324.624964][T11136] RSP: 002b:00007f501f7f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 324.624979][T11136] RAX: ffffffffffffffda RBX: 00007f5021bb5fa0 RCX: 00007f502198e929 [ 324.624988][T11136] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 324.624995][T11136] RBP: 00007f501f7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 324.625003][T11136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 324.625010][T11136] R13: 0000000000000000 R14: 00007f5021bb5fa0 R15: 00007f5021cdfa28 [ 324.625028][T11136] [ 325.554241][T11147] syzkaller1: entered promiscuous mode [ 325.572941][T11147] syzkaller1: entered allmulticast mode [ 327.850569][T11185] netlink: 'syz.4.663': attribute type 21 has an invalid length. [ 327.859012][T11185] netlink: 128 bytes leftover after parsing attributes in process `syz.4.663'. [ 328.056835][T11185] netlink: 'syz.4.663': attribute type 4 has an invalid length. [ 328.064979][T11185] netlink: 3 bytes leftover after parsing attributes in process `syz.4.663'. [ 328.939233][ T5857] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 329.135938][ T5857] usb 4-1: config index 0 descriptor too short (expected 5292, got 77) [ 329.146616][ T5857] usb 4-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 329.228380][ T5857] usb 4-1: config 55 has 0 interfaces, different from the descriptor's value: 20 [ 329.287067][ T5857] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 329.314714][ T5857] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.322945][T11207] netlink: 4 bytes leftover after parsing attributes in process `syz.0.668'. [ 329.346027][ T5857] usb 4-1: Product: syz [ 329.361434][ T5857] usb 4-1: Manufacturer: syz [ 329.448318][ T5857] usb 4-1: SerialNumber: syz [ 329.840633][T11189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.887158][T11189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.070137][ T5857] usb 4-1: USB disconnect, device number 28 [ 330.118642][ T5939] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 330.308709][ T5939] usb 3-1: Using ep0 maxpacket: 16 [ 330.316022][ T5939] usb 3-1: config 0 has no interfaces? [ 330.325332][ T5939] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 330.422637][ T5939] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 330.439880][ T5939] usb 3-1: Manufacturer: syz [ 330.484333][ T5939] usb 3-1: config 0 descriptor?? [ 331.346680][T11235] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 331.396423][T11240] netlink: 'syz.2.669': attribute type 27 has an invalid length. [ 331.419996][ T5939] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 331.500638][T11240] lo: left allmulticast mode [ 331.513837][T11240] tunl0: left allmulticast mode [ 331.536998][ T5939] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 331.561835][T11240] gre0: left allmulticast mode [ 331.659654][T11240] gretap0: left allmulticast mode [ 331.678636][T11240] erspan0: left allmulticast mode [ 331.694721][T11240] ip_vti0: left allmulticast mode [ 331.735879][T11240] ip6_vti0: left allmulticast mode [ 331.803687][T11240] sit0: left allmulticast mode [ 331.870491][T11240] ip6tnl0: left allmulticast mode [ 331.921248][T11240] ip6gre0: left allmulticast mode [ 331.928720][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 331.973929][T11240] syz_tun: left allmulticast mode [ 331.988501][T11240] ip6gretap0: left allmulticast mode [ 332.018472][T11240] bridge0: left allmulticast mode [ 332.023858][T11240] vcan0: left allmulticast mode [ 332.029420][T11240] bond0: left allmulticast mode [ 332.063807][T11240] team0: left allmulticast mode [ 332.104161][T11240] dummy0: left allmulticast mode [ 332.139027][T11240] nlmon0: left allmulticast mode [ 332.144369][T11240] caif0: left allmulticast mode [ 332.151053][T11240] batadv0: left allmulticast mode [ 332.156380][T11240] vxcan0: left allmulticast mode [ 332.235150][T11240] vxcan1: left allmulticast mode [ 332.252326][T11240] veth0: left allmulticast mode [ 332.343169][T11240] veth1: left allmulticast mode [ 332.389244][T11240] wg0: left allmulticast mode [ 332.480676][T11240] wg1: left allmulticast mode [ 332.553179][T11240] wg2: left allmulticast mode [ 332.588219][T11240] veth0_to_bridge: left allmulticast mode [ 332.647414][T11240] bridge_slave_0: left allmulticast mode [ 332.737472][T11240] veth1_to_bridge: left allmulticast mode [ 332.968786][T11240] bridge_slave_1: left allmulticast mode [ 333.118396][T11240] bond_slave_0: left allmulticast mode [ 333.124253][T11240] veth1_to_bond: left allmulticast mode [ 333.132265][T11240] bond_slave_1: left allmulticast mode [ 333.202280][T11240] veth0_to_team: left allmulticast mode [ 333.242317][T11240] team_slave_0: left allmulticast mode [ 333.273455][T11240] veth1_to_team: left allmulticast mode [ 333.312674][T11240] team_slave_1: left allmulticast mode [ 333.335706][T11240] veth0_to_batadv: left allmulticast mode [ 333.350984][T11240] batadv_slave_0: left allmulticast mode [ 333.377329][T11240] veth1_to_batadv: left allmulticast mode [ 333.797152][T11240] batadv_slave_1: left allmulticast mode [ 333.824659][T11240] xfrm0: left allmulticast mode [ 333.847378][T11240] veth0_to_hsr: left allmulticast mode [ 333.933285][T11240] veth1_to_hsr: left allmulticast mode [ 333.958653][T11240] hsr0: left allmulticast mode [ 333.963891][T11240] hsr_slave_0: left allmulticast mode [ 333.995496][T11240] hsr_slave_1: left allmulticast mode [ 334.201136][T11240] veth1_virt_wifi: left allmulticast mode [ 334.252474][T11240] veth0_virt_wifi: left allmulticast mode [ 334.263315][T11240] net veth1_virt_wifi virt_wifi0: left allmulticast mode [ 334.289894][T11240] veth1_vlan: left allmulticast mode [ 334.314634][T11240] vlan0: left allmulticast mode [ 334.347818][T11240] vlan1: left allmulticast mode [ 334.372077][T11240] macvlan0: left allmulticast mode [ 334.691162][T11240] macvlan1: left allmulticast mode [ 334.783705][T11240] ipvlan0: left allmulticast mode [ 334.814810][T11240] ipvlan1: left allmulticast mode [ 334.845573][T11240] veth0_vlan: left allmulticast mode [ 334.866542][T11240] veth1_macvtap: left allmulticast mode [ 334.907987][T11240] veth0_macvtap: left allmulticast mode [ 334.933574][T11240] macvtap0: left allmulticast mode [ 334.947733][T11240] macsec0: left allmulticast mode [ 334.964776][T11240] geneve0: left allmulticast mode [ 334.984756][T11240] geneve1: left allmulticast mode [ 334.997973][T11240] netdevsim netdevsim2 netdevsim0: left allmulticast mode [ 335.027423][T11240] netdevsim netdevsim2 netdevsim1: left allmulticast mode [ 335.061393][T11240] netdevsim netdevsim2 netdevsim2: left allmulticast mode [ 335.093526][T11240] netdevsim netdevsim2 netdevsim3: left allmulticast mode [ 335.137710][T11240] mac80211_hwsim hwsim10 wlan0: left allmulticast mode [ 335.180734][T11240] mac80211_hwsim hwsim11 wlan1: left allmulticast mode [ 335.202160][T11240] syztnl1: left allmulticast mode [ 335.227647][T11240] bond1: left allmulticast mode [ 335.247223][T11240] veth2: left allmulticast mode [ 335.312312][T11240] veth3: left allmulticast mode [ 335.317967][T11240] bond2: left promiscuous mode [ 335.323591][T11240] bond2: left allmulticast mode [ 335.341631][T11240] bond3: left promiscuous mode [ 335.346652][T11240] bond3: left allmulticast mode [ 335.413118][ T55] usb 3-1: USB disconnect, device number 32 [ 336.024738][T11275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.682'. [ 336.698609][ T5857] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 336.888437][ T5857] usb 4-1: Using ep0 maxpacket: 16 [ 337.094726][ T5857] usb 4-1: config 0 has no interfaces? [ 337.305655][ T5857] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 337.321388][ T5857] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 337.331273][ T5857] usb 4-1: Manufacturer: syz [ 337.380646][ T5857] usb 4-1: config 0 descriptor?? [ 337.486364][T11295] netlink: 36 bytes leftover after parsing attributes in process `syz.0.688'. [ 337.789491][T11277] netlink: 'syz.3.683': attribute type 27 has an invalid length. [ 338.282368][T11301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.337081][T11301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.798715][T11300] netlink: 'syz.4.689': attribute type 27 has an invalid length. [ 339.812678][T11309] mmap: syz.1.691 (11309) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 339.892506][T11310] pim6reg: entered allmulticast mode [ 340.096217][ T55] usb 4-1: USB disconnect, device number 29 [ 341.331150][T11325] batadv_slave_1: entered promiscuous mode [ 341.872964][T11325] trusted_key: syz.1.696 sent an empty control message without MSG_MORE. [ 342.050205][T11336] loop6: detected capacity change from 0 to 524287999 [ 342.398624][T11330] batadv_slave_1: left promiscuous mode [ 342.878171][ T55] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 343.041086][ T55] usb 2-1: config 0 has an invalid interface number: 187 but max is 0 [ 343.058427][ T55] usb 2-1: config 0 has no interface number 0 [ 343.118930][ T55] usb 2-1: config 0 interface 187 altsetting 0 endpoint 0x6 has invalid maxpacket 36863, setting to 1024 [ 343.181154][ T55] usb 2-1: config 0 interface 187 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1024 [ 343.201790][ T55] usb 2-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=22.4e [ 343.250489][ T55] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.272675][ T55] usb 2-1: Product: syz [ 343.286005][ T55] usb 2-1: Manufacturer: syz [ 343.295905][ T55] usb 2-1: SerialNumber: syz [ 343.315642][ T55] usb 2-1: config 0 descriptor?? [ 343.324547][T11343] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 345.726315][ T55] usb 2-1: USB disconnect, device number 28 [ 345.964242][T11365] netlink: 36 bytes leftover after parsing attributes in process `syz.1.704'. [ 347.077606][ T847] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 347.338244][ T847] usb 1-1: Using ep0 maxpacket: 16 [ 349.830852][T11408] FAULT_INJECTION: forcing a failure. [ 349.830852][T11408] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 349.896477][T11408] CPU: 1 UID: 0 PID: 11408 Comm: syz.4.716 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 349.896508][T11408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 349.896520][T11408] Call Trace: [ 349.896529][T11408] [ 349.896538][T11408] dump_stack_lvl+0x189/0x250 [ 349.896569][T11408] ? __pfx____ratelimit+0x10/0x10 [ 349.896599][T11408] ? __pfx_dump_stack_lvl+0x10/0x10 [ 349.896623][T11408] ? __pfx__printk+0x10/0x10 [ 349.896665][T11408] should_fail_ex+0x414/0x560 [ 349.896700][T11408] _copy_to_user+0x31/0xb0 [ 349.896727][T11408] simple_read_from_buffer+0xe1/0x170 [ 349.896758][T11408] proc_fail_nth_read+0x1df/0x250 [ 349.896798][T11408] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 349.896829][T11408] ? rw_verify_area+0x258/0x650 [ 349.896851][T11408] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 349.896881][T11408] vfs_read+0x200/0x980 [ 349.896910][T11408] ? __pfx___mutex_lock+0x10/0x10 [ 349.896931][T11408] ? __pfx_vfs_read+0x10/0x10 [ 349.896955][T11408] ? __fget_files+0x2a/0x420 [ 349.896986][T11408] ? __fget_files+0x3a0/0x420 [ 349.897010][T11408] ? __fget_files+0x2a/0x420 [ 349.897046][T11408] ksys_read+0x145/0x250 [ 349.897068][T11408] ? __fget_files+0x3a0/0x420 [ 349.897095][T11408] ? __pfx_ksys_read+0x10/0x10 [ 349.897124][T11408] ? do_syscall_64+0xbe/0x3b0 [ 349.897148][T11408] do_syscall_64+0xfa/0x3b0 [ 349.897166][T11408] ? lockdep_hardirqs_on+0x9c/0x150 [ 349.897193][T11408] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.897213][T11408] ? clear_bhb_loop+0x60/0xb0 [ 349.897237][T11408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.897256][T11408] RIP: 0033:0x7f10fe78d33c [ 349.897274][T11408] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 349.897291][T11408] RSP: 002b:00007f10ff66f030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 349.897314][T11408] RAX: ffffffffffffffda RBX: 00007f10fe9b5fa0 RCX: 00007f10fe78d33c [ 349.897328][T11408] RDX: 000000000000000f RSI: 00007f10ff66f0a0 RDI: 0000000000000004 [ 349.897341][T11408] RBP: 00007f10ff66f090 R08: 0000000000000000 R09: 0000000000000000 [ 349.897353][T11408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 349.897363][T11408] R13: 0000000000000000 R14: 00007f10fe9b5fa0 R15: 00007f10feadfa28 [ 349.897389][T11408] [ 350.414836][ T55] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 350.459074][ T847] usb 1-1: unable to get BOS descriptor or descriptor too short [ 350.473332][ T847] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 350.492944][ T847] usb 1-1: can't read configurations, error -71 [ 350.590171][ T55] usb 2-1: Using ep0 maxpacket: 16 [ 350.601413][ T55] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 350.629950][ T55] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 350.803247][ T55] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 350.839557][T11429] IPVS: length: 24 != 792 [ 350.904976][ T55] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 350.920937][ T55] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 350.945130][ T55] usb 2-1: config 0 descriptor?? [ 351.491448][ T55] HID 045e:07da: Invalid code 65791 type 1 [ 351.509547][ T55] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.000B/input/input12 [ 351.631755][T11410] netlink: 132 bytes leftover after parsing attributes in process `syz.1.717'. [ 351.657541][ T55] microsoft 0003:045E:07DA.000B: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 352.123502][ T5857] usb 2-1: USB disconnect, device number 29 [ 353.518586][ T5940] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 353.734781][T11465] netlink: 'syz.1.731': attribute type 1 has an invalid length. [ 353.752685][T11461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.824016][T11461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 353.888181][ T5940] usb 4-1: device descriptor read/64, error -71 [ 353.909865][ T5925] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 354.150428][T11465] 8021q: adding VLAN 0 to HW filter on device bond5 [ 354.182382][ T5925] usb 3-1: Using ep0 maxpacket: 8 [ 354.194576][ T5925] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 354.240781][ T5925] usb 3-1: config 0 has no interface number 0 [ 354.259954][ T5925] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 354.288080][ T5925] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 354.298011][ T5925] usb 3-1: config 0 interface 2 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 354.321242][T11467] bond5: (slave veth5): Enslaving as an active interface with a down link [ 354.358643][ T5940] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 354.374612][ T5925] usb 3-1: config 0 interface 2 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 354.407884][ T5925] usb 3-1: New USB device found, idVendor=05da, idProduct=0099, bcdDevice=d5.82 [ 354.416049][T11468] bond5: (slave veth0_to_bond): making interface the new active one [ 354.429054][T11468] veth0_to_bond: entered promiscuous mode [ 354.446973][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.464071][T11468] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 354.477221][ T5925] usb 3-1: Product: syz [ 354.499630][ T5940] usb 4-1: device descriptor read/64, error -71 [ 354.519150][ T5925] usb 3-1: Manufacturer: syz [ 354.537232][ T5925] usb 3-1: SerialNumber: syz [ 354.561347][T11472] vlan0: entered allmulticast mode [ 354.573092][ T5925] usb 3-1: config 0 descriptor?? [ 354.579385][T11472] veth0_to_bond: entered allmulticast mode [ 354.608754][ T5940] usb usb4-port1: attempt power cycle [ 354.626386][T11472] bond5: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 354.821665][ T5925] microtek usb (rev 0.4.3): can only deal with bulk endpoints; endpoint 2 is not bulk. [ 354.839342][ T5925] microtek usb (rev 0.4.3): can only deal with bulk endpoints; endpoint 6 is not bulk. [ 354.856269][ T5925] microtek usb (rev 0.4.3): couldn't find two input bulk endpoints. Bailing out. [ 354.917124][ T5925] usb 3-1: USB disconnect, device number 33 [ 354.959097][ T5940] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 355.752064][ T5940] usb 4-1: device descriptor read/8, error -71 [ 356.118254][ T5940] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 356.861643][ T5940] usb 4-1: device descriptor read/8, error -71 [ 357.002149][ T5940] usb usb4-port1: unable to enumerate USB device [ 357.941411][T11511] No such timeout policy "syz1" [ 359.328210][ T847] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 359.571767][ T847] usb 2-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 359.595656][ T847] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 359.627691][ T847] usb 2-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice= 0.9c [ 359.657381][ T847] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.698262][ T847] usb 2-1: Product: syz [ 359.708715][ T847] usb 2-1: Manufacturer: syz [ 359.740103][ T847] usb 2-1: SerialNumber: syz [ 359.762426][ T847] usb 2-1: config 0 descriptor?? [ 359.770998][ T847] ims_pcu 2-1:0.0: Missing CDC union descriptor [ 359.777526][ T847] ims_pcu 2-1:0.0: probe with driver ims_pcu failed with error -22 [ 360.170323][ T5857] usb 2-1: USB disconnect, device number 30 [ 360.788259][ T9] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 360.963556][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 361.234044][T11555] usb usb8: usbfs: process 11555 (syz.2.754) did not claim interface 0 before use [ 361.878413][ T847] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 362.051701][ T847] usb 2-1: config 0 has an invalid interface number: 197 but max is 8 [ 362.061957][T11568] netlink: 52 bytes leftover after parsing attributes in process `syz.4.758'. [ 362.080691][ T847] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 362.109606][ T847] usb 2-1: config 0 has no interface number 0 [ 362.124266][T11568] netlink: 12 bytes leftover after parsing attributes in process `syz.4.758'. [ 362.134211][T11568] netlink: 48 bytes leftover after parsing attributes in process `syz.4.758'. [ 362.155624][T11568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 362.168011][T11568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.193048][ T847] usb 2-1: New USB device found, idVendor=0bda, idProduct=f192, bcdDevice=d1.c4 [ 362.247652][ T847] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.292961][ T847] usb 2-1: config 0 descriptor?? [ 362.523484][ T5857] usb 2-1: USB disconnect, device number 31 [ 362.822486][T11570] mmap: syz.4.759 (11570): VmData 37449728 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 363.255509][T11574] netlink: 24 bytes leftover after parsing attributes in process `syz.4.760'. [ 363.405573][T11574] block device autoloading is deprecated and will be removed. [ 363.446015][T11574] syz.4.760: attempt to access beyond end of device [ 363.446015][T11574] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 363.948343][ T5956] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 364.181534][ T5956] usb 2-1: Using ep0 maxpacket: 16 [ 364.309481][ T5956] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 364.381934][ T5956] usb 2-1: config 0 has no interface number 0 [ 364.520975][ T5956] usb 2-1: config 0 interface 41 has no altsetting 0 [ 364.666186][ T5956] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 364.704769][ T5956] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.730356][ T5956] usb 2-1: Product: syz [ 364.758134][ T5956] usb 2-1: Manufacturer: syz [ 364.763003][ T5956] usb 2-1: SerialNumber: syz [ 364.794503][ T5956] usb 2-1: config 0 descriptor?? [ 364.849992][ T5956] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -22 [ 364.899238][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 364.989507][ T24] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 365.028408][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 365.057076][ T9] usb 4-1: can't read configurations, error -71 [ 365.196292][ T24] usb 3-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 365.224700][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.242488][T11594] erspan0: entered promiscuous mode [ 365.253742][ T24] usb 3-1: Product: syz [ 365.304394][T11594] erspan0: left promiscuous mode [ 365.338598][ T24] usb 3-1: Manufacturer: syz [ 365.343423][ T24] usb 3-1: SerialNumber: syz [ 365.694930][ T24] usb 3-1: config 0 descriptor?? [ 366.077689][T11606] program syz.0.771 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 366.363816][ T24] usb 3-1: f81604_read: reg: 105 failed: -EPIPE [ 366.370549][ T24] f81604 3-1:0.0: Setting termination of CH#1 failed: -EPIPE [ 366.378168][ T24] f81604 3-1:0.0: probe with driver f81604 failed with error -32 [ 366.444557][T11610] netlink: 'syz.4.773': attribute type 1 has an invalid length. [ 366.659165][T11610] 8021q: adding VLAN 0 to HW filter on device bond2 [ 366.781779][T11613] bond2: (slave veth3): Enslaving as an active interface with a down link [ 366.794036][T11614] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 366.826561][T11610] vlan0: entered allmulticast mode [ 366.832375][T11610] veth0_to_bond: entered allmulticast mode [ 366.840661][T11610] veth0_to_bond: entered promiscuous mode [ 366.855629][T11610] veth0_to_bond: left promiscuous mode [ 366.881453][T11610] veth0_to_bond: entered promiscuous mode [ 366.890405][T11610] bond2: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 366.930098][T11610] veth0_to_bond: left promiscuous mode [ 367.168382][ T2901] veth0_to_bond: left promiscuous mode [ 367.302904][ T5956] usb 2-1: USB disconnect, device number 32 [ 367.470696][T11627] capability: warning: `syz.1.776' uses 32-bit capabilities (legacy support in use) [ 367.598739][T11628] futex_wake_op: syz.0.772 tries to shift op by -33; fix this program [ 367.656738][ T9] usb 3-1: USB disconnect, device number 34 [ 367.768723][ T5956] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 367.805591][ T30] audit: type=1326 audit(1752162264.011:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 367.906785][ T30] audit: type=1326 audit(1752162264.011:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 367.936746][T11629] fuse: blksize only supported for fuseblk [ 368.150697][ T5956] usb 2-1: unable to get BOS descriptor or descriptor too short [ 368.193105][ T5956] usb 2-1: config 0 has no interfaces? [ 368.235765][ T30] audit: type=1326 audit(1752162264.061:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=332 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 368.259988][ T5956] usb 2-1: New USB device found, idVendor=0af0, idProduct=d357, bcdDevice= 0.00 [ 368.288276][ T5956] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.295613][T11636] netlink: 4 bytes leftover after parsing attributes in process `syz.2.778'. [ 368.299293][ T5956] usb 2-1: Product: syz [ 368.326154][ T5956] usb 2-1: Manufacturer: syz [ 368.333317][ T30] audit: type=1326 audit(1752162264.061:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 368.492948][ T5956] usb 2-1: SerialNumber: syz [ 368.504242][ T30] audit: type=1326 audit(1752162264.061:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 368.532246][ T30] audit: type=1326 audit(1752162264.061:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 368.555965][ T30] audit: type=1326 audit(1752162264.061:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 368.558941][ T5956] usb 2-1: config 0 descriptor?? [ 368.579852][ T30] audit: type=1326 audit(1752162264.061:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 368.607598][ T30] audit: type=1326 audit(1752162264.061:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 368.630824][ T30] audit: type=1326 audit(1752162264.061:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11630 comm="syz.2.778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feaa938e929 code=0x7ffc0000 [ 368.665087][T11636] netlink: 12 bytes leftover after parsing attributes in process `syz.2.778'. [ 368.986701][T11642] (unnamed net_device) (uninitialized): up delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 369.498331][T11649] netlink: 8 bytes leftover after parsing attributes in process `syz.3.783'. [ 369.539536][T11644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.553375][T11644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.699090][T11655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.709998][T11655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.731157][T11655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.741682][T11655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.854606][T11657] netlink: 16 bytes leftover after parsing attributes in process `syz.3.784'. [ 369.868418][ T5956] usb 2-1: USB disconnect, device number 33 [ 369.951201][T11657] netlink: 16 bytes leftover after parsing attributes in process `syz.3.784'. [ 370.063261][T11659] netlink: 12 bytes leftover after parsing attributes in process `syz.1.785'. [ 370.400066][T11666] netlink: 216 bytes leftover after parsing attributes in process `syz.3.788'. [ 370.548360][ T5956] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 370.688160][ T24] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 370.718455][ T5956] usb 2-1: Using ep0 maxpacket: 16 [ 370.729193][ T5956] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 370.737977][ T5956] usb 2-1: config 0 has no interface number 0 [ 370.768716][ T5956] usb 2-1: config 0 interface 41 has no altsetting 0 [ 370.812243][ T5956] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 370.825753][ T5956] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 370.834576][ T5956] usb 2-1: Product: syz [ 370.842117][ T5956] usb 2-1: Manufacturer: syz [ 370.848613][ T5956] usb 2-1: SerialNumber: syz [ 370.855158][ T5956] usb 2-1: config 0 descriptor?? [ 370.868938][ T5956] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -22 [ 370.889194][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 370.905742][ T24] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 370.921747][ T24] usb 4-1: config 1 has no interface number 1 [ 370.934090][ T24] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 370.997685][T11672] FAULT_INJECTION: forcing a failure. [ 370.997685][T11672] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 371.017916][T11672] CPU: 1 UID: 0 PID: 11672 Comm: syz.0.790 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 371.017936][T11672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 371.017948][T11672] Call Trace: [ 371.017954][T11672] [ 371.017959][T11672] dump_stack_lvl+0x189/0x250 [ 371.017980][T11672] ? __pfx____ratelimit+0x10/0x10 [ 371.018001][T11672] ? __pfx_dump_stack_lvl+0x10/0x10 [ 371.018016][T11672] ? __pfx__printk+0x10/0x10 [ 371.018042][T11672] ? __might_fault+0xb0/0x130 [ 371.018076][T11672] should_fail_ex+0x414/0x560 [ 371.018110][T11672] _copy_from_user+0x2d/0xb0 [ 371.018134][T11672] generic_map_update_batch+0x572/0x7f0 [ 371.018167][T11672] ? __pfx_generic_map_update_batch+0x10/0x10 [ 371.018182][T11672] ? __fget_files+0x2a/0x420 [ 371.018203][T11672] ? __pfx_generic_map_update_batch+0x10/0x10 [ 371.018218][T11672] bpf_map_do_batch+0x369/0x5f0 [ 371.018234][T11672] __sys_bpf+0x384/0x860 [ 371.018247][T11672] ? __pfx___sys_bpf+0x10/0x10 [ 371.018266][T11672] ? ksys_write+0x22a/0x250 [ 371.018281][T11672] ? __pfx_ksys_write+0x10/0x10 [ 371.018293][T11672] ? rcu_is_watching+0x15/0xb0 [ 371.018311][T11672] __x64_sys_bpf+0x7c/0x90 [ 371.018329][T11672] do_syscall_64+0xfa/0x3b0 [ 371.018340][T11672] ? lockdep_hardirqs_on+0x9c/0x150 [ 371.018357][T11672] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.018369][T11672] ? clear_bhb_loop+0x60/0xb0 [ 371.018383][T11672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.018395][T11672] RIP: 0033:0x7f502198e929 [ 371.018407][T11672] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 371.018418][T11672] RSP: 002b:00007f501f7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 371.018432][T11672] RAX: ffffffffffffffda RBX: 00007f5021bb5fa0 RCX: 00007f502198e929 [ 371.018442][T11672] RDX: 0000000000000038 RSI: 0000200000000200 RDI: 000000000000001a [ 371.018452][T11672] RBP: 00007f501f7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 371.018459][T11672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 371.018466][T11672] R13: 0000000000000000 R14: 00007f5021bb5fa0 R15: 00007f5021cdfa28 [ 371.018485][T11672] [ 371.293702][ T24] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 371.304601][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.312720][ T24] usb 4-1: Product: syz [ 371.316943][ T24] usb 4-1: Manufacturer: syz [ 371.321638][ T24] usb 4-1: SerialNumber: syz [ 371.618376][T11675] vlan0: entered promiscuous mode [ 371.797931][ T24] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 371.809222][ T24] usb 4-1: 2:1 : sample bitwidth 243 in over sample bytes 3 [ 371.857306][ T24] usb 4-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 371.881161][ T24] usb 4-1: 2:1 : invalid channels 0 [ 371.986944][ T24] usb 4-1: USB disconnect, device number 36 [ 372.080969][ T6049] udevd[6049]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 374.078375][ T5857] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 374.210801][ T5956] usb 2-1: USB disconnect, device number 34 [ 374.318256][ T5857] usb 3-1: Using ep0 maxpacket: 16 [ 374.433727][T11702] vivid-000: disconnect [ 375.149508][T11698] vivid-000: reconnect [ 377.960390][ T5857] usb 3-1: unable to get BOS descriptor or descriptor too short [ 377.994486][ T5857] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 378.012544][ T5857] usb 3-1: can't read configurations, error -71 [ 378.678237][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.694509][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.983809][T11748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 379.041453][T11748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.635867][T11780] ptrace attach of "./syz-executor exec"[5866] was attempted by "./syz-executor exec"[11780] [ 381.824001][T11778] netlink: 'syz.4.813': attribute type 41 has an invalid length. [ 382.826046][ T3026] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.059940][ T3026] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.277593][ T3026] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.550270][ T3026] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.429187][ T3026] bridge_slave_1: left allmulticast mode [ 384.429279][ T3026] bridge_slave_1: left promiscuous mode [ 384.431042][ T3026] bridge0: port 2(bridge_slave_1) entered disabled state [ 384.510317][ T3026] bridge_slave_0: left allmulticast mode [ 384.510359][ T3026] bridge_slave_0: left promiscuous mode [ 384.510605][ T3026] bridge0: port 1(bridge_slave_0) entered disabled state [ 384.731860][ T3026] bond_slave_0: left promiscuous mode [ 384.732041][ T3026] bond_slave_1: left promiscuous mode [ 384.860823][ T5862] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 384.864352][ T5862] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 384.865244][ T5862] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 384.866578][ T5862] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 384.867400][ T5862] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 385.735018][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 385.735046][ T30] audit: type=1326 audit(1752162281.931:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11826 comm="syz.0.826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f502198e929 code=0x7ffc0000 [ 385.765070][ T30] audit: type=1326 audit(1752162281.931:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11826 comm="syz.0.826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f502198e929 code=0x7ffc0000 [ 386.045012][ T30] audit: type=1326 audit(1752162281.981:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11826 comm="syz.0.826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f502198e929 code=0x7ffc0000 [ 386.163913][ T30] audit: type=1326 audit(1752162281.981:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11826 comm="syz.0.826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f502198e929 code=0x7ffc0000 [ 386.302954][ T30] audit: type=1326 audit(1752162281.981:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11826 comm="syz.0.826" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f502198e929 code=0x0 [ 386.339257][ T30] audit: type=1326 audit(1752162282.071:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11826 comm="syz.0.826" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f502198e929 code=0x0 [ 386.866475][ T3026] bond0 (unregistering): left allmulticast mode [ 386.873671][ T3026] bond_slave_0: left allmulticast mode [ 386.879416][ T3026] bond_slave_1: left allmulticast mode [ 386.890001][ T5855] Bluetooth: hci1: command tx timeout [ 386.937821][ T3026] team0: Port device macvlan4 removed [ 386.949805][ T3026] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 386.962612][ T3026] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 386.974734][ T3026] bond0 (unregistering): Released all slaves [ 387.092962][ T3026] bond1 (unregistering): Released all slaves [ 387.149173][ T24] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 387.224976][ T3026] bond2 (unregistering): Released all slaves [ 387.302818][ T24] usb 3-1: device descriptor read/64, error -71 [ 387.355257][ T3026] bond3 (unregistering): Released all slaves [ 387.490638][ T3026] bond4 (unregistering): Released all slaves [ 387.552986][ T24] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 387.622584][ T3026] bond5 (unregistering): Released all slaves [ 387.691564][ T24] usb 3-1: device descriptor read/64, error -71 [ 387.798901][ T24] usb usb3-port1: attempt power cycle [ 388.194098][ T24] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 388.240569][ T24] usb 3-1: device descriptor read/8, error -71 [ 388.489578][ T24] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 388.590548][ T24] usb 3-1: device descriptor read/8, error -71 [ 388.713587][ T3026] hsr_slave_0: left promiscuous mode [ 388.721683][ T24] usb usb3-port1: unable to enumerate USB device [ 388.746686][ T3026] hsr_slave_1: left promiscuous mode [ 388.799039][ T9] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 388.817184][ T3026] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 388.957821][ T3026] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 388.968159][ T5855] Bluetooth: hci1: command tx timeout [ 388.980539][ T9] usb 2-1: config index 0 descriptor too short (expected 5292, got 77) [ 388.996981][ T9] usb 2-1: config 55 has an invalid descriptor of length 0, skipping remainder of the config [ 389.016806][ T3026] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 389.029778][ T3026] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 389.057096][ T9] usb 2-1: config 55 has 0 interfaces, different from the descriptor's value: 20 [ 389.157725][ T9] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 389.169722][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.177969][ T9] usb 2-1: Product: syz [ 389.183425][ T9] usb 2-1: Manufacturer: syz [ 389.191177][ T9] usb 2-1: SerialNumber: syz [ 389.200600][ T3026] veth1_macvtap: left promiscuous mode [ 389.213881][ T3026] veth0_macvtap: left promiscuous mode [ 389.240873][ T3026] veth1_vlan: left promiscuous mode [ 389.464945][T11851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 389.476493][T11851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 391.062543][ T5855] Bluetooth: hci1: command tx timeout [ 391.668545][ T3026] team0 (unregistering): Port device team_slave_1 removed [ 391.750120][ T3026] team0 (unregistering): Port device team_slave_0 removed [ 392.872042][T11882] dvmrp0: entered allmulticast mode [ 392.877720][T11882] dvmrp0: left allmulticast mode [ 392.952225][T11805] chnl_net:caif_netlink_parms(): no params data found [ 393.072273][ T5857] usb 2-1: USB disconnect, device number 35 [ 393.096293][T11891] openvswitch: netlink: IP tunnel TTL not specified. [ 393.129269][ T5855] Bluetooth: hci1: command tx timeout [ 393.769682][T11805] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.796789][T11805] bridge0: port 1(bridge_slave_0) entered disabled state [ 393.818996][T11805] bridge_slave_0: entered allmulticast mode [ 393.850104][T11805] bridge_slave_0: entered promiscuous mode [ 393.888416][T11805] bridge0: port 2(bridge_slave_1) entered blocking state [ 393.908486][T11805] bridge0: port 2(bridge_slave_1) entered disabled state [ 393.932091][T11805] bridge_slave_1: entered allmulticast mode [ 393.955355][T11805] bridge_slave_1: entered promiscuous mode [ 394.325902][T11921] lo: entered allmulticast mode [ 394.343225][T11921] tunl0: entered allmulticast mode [ 394.375957][T11921] gre0: entered allmulticast mode [ 394.399898][T11921] gretap0: entered allmulticast mode [ 394.424858][T11921] erspan0: entered allmulticast mode [ 394.445102][T11921] ip_vti0: entered allmulticast mode [ 394.483787][T11921] ip6_vti0: entered allmulticast mode [ 394.499011][T11921] sit0: entered allmulticast mode [ 394.504499][T11921] ip6tnl0: entered allmulticast mode [ 394.530729][T11921] ip6gre0: entered allmulticast mode [ 394.700044][T11921] syz_tun: entered allmulticast mode [ 394.705616][T11921] ip6gretap0: entered allmulticast mode [ 394.720196][T11921] bridge0: entered allmulticast mode [ 394.725997][T11921] vcan0: entered allmulticast mode [ 394.735434][T11921] bond0: entered allmulticast mode [ 394.743985][T11921] team0: entered allmulticast mode [ 394.755223][T11921] dummy0: entered allmulticast mode [ 394.767328][T11921] nlmon0: entered allmulticast mode [ 394.779773][T11921] caif0: entered allmulticast mode [ 394.803142][T11921] batadv0: entered allmulticast mode [ 394.848319][T11921] vxcan0: entered allmulticast mode [ 394.853776][T11921] vxcan1: entered allmulticast mode [ 394.861840][T11921] veth0: entered allmulticast mode [ 394.876761][T11921] veth1: entered allmulticast mode [ 394.895139][T11921] wg0: entered allmulticast mode [ 394.906270][T11921] wg1: entered allmulticast mode [ 394.927946][T11921] wg2: entered allmulticast mode [ 394.951443][T11921] veth0_to_bridge: entered allmulticast mode [ 394.993529][T11921] bridge_slave_0: entered allmulticast mode [ 395.005212][T11921] veth1_to_bridge: entered allmulticast mode [ 395.011726][T11921] bridge_slave_1: entered allmulticast mode [ 395.017940][T11921] bond_slave_0: entered allmulticast mode [ 395.024619][T11921] veth1_to_bond: entered allmulticast mode [ 395.033302][T11921] bond_slave_1: entered allmulticast mode [ 395.039551][T11921] veth0_to_team: entered allmulticast mode [ 395.045580][T11921] team_slave_0: entered allmulticast mode [ 395.051824][T11921] veth1_to_team: entered allmulticast mode [ 395.057871][T11921] team_slave_1: entered allmulticast mode [ 395.072962][T11921] veth0_to_batadv: entered allmulticast mode [ 395.083983][T11921] batadv_slave_0: entered allmulticast mode [ 395.092073][T11921] veth1_to_batadv: entered allmulticast mode [ 395.105469][T11921] batadv_slave_1: entered allmulticast mode [ 395.112042][T11921] xfrm0: entered allmulticast mode [ 395.117750][T11921] veth0_to_hsr: entered allmulticast mode [ 395.126519][T11921] hsr_slave_0: entered allmulticast mode [ 395.132933][T11921] veth1_to_hsr: entered allmulticast mode [ 395.144018][T11921] hsr_slave_1: entered allmulticast mode [ 395.154145][T11921] hsr0: entered allmulticast mode [ 395.188386][T11921] veth1_virt_wifi: entered allmulticast mode [ 395.211025][T11921] veth0_virt_wifi: entered allmulticast mode [ 395.230851][T11921] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 395.255676][T11921] veth1_vlan: entered allmulticast mode [ 395.275971][T11921] veth0_vlan: entered allmulticast mode [ 395.330044][T11921] vlan0: entered allmulticast mode [ 395.335645][T11921] vlan1: entered allmulticast mode [ 395.348288][T11921] macvlan0: entered allmulticast mode [ 395.355883][T11921] macvlan1: entered allmulticast mode [ 395.378513][T11921] ipvlan0: entered allmulticast mode [ 395.392935][T11921] ipvlan1: entered allmulticast mode [ 395.424936][T11921] veth1_macvtap: entered allmulticast mode [ 395.436828][T11921] veth0_macvtap: entered allmulticast mode [ 395.480866][T11921] macvtap0: entered allmulticast mode [ 395.486700][T11921] macsec0: entered allmulticast mode [ 395.529317][T11921] geneve0: entered allmulticast mode [ 395.558929][T11921] geneve1: entered allmulticast mode [ 395.564539][T11921] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 395.617885][T11921] netdevsim netdevsim2 netdevsim1: entered allmulticast mode [ 395.664777][T11921] netdevsim netdevsim2 netdevsim2: entered allmulticast mode [ 395.698502][T11921] netdevsim netdevsim2 netdevsim3: entered allmulticast mode [ 395.706348][T11921] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 395.728951][T11921] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 395.736550][T11921] syztnl1: entered allmulticast mode [ 395.748444][T11921] bond1: entered allmulticast mode [ 395.759732][T11921] veth2: entered allmulticast mode [ 395.765228][T11921] veth3: entered allmulticast mode [ 395.775932][T11921] bond2: entered allmulticast mode [ 395.781818][T11921] ip6gretap1: entered allmulticast mode [ 395.787697][T11921] bond3: entered allmulticast mode [ 395.798673][T11921] bridge1: entered allmulticast mode [ 395.937222][T11805] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 396.101254][T11933] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 396.115889][T11805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 396.420133][T11940] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 396.487542][T11805] team0: Port device team_slave_0 added [ 396.531800][T11805] team0: Port device team_slave_1 added [ 396.730364][T11944] FAULT_INJECTION: forcing a failure. [ 396.730364][T11944] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 396.778328][T11944] CPU: 1 UID: 0 PID: 11944 Comm: syz.2.850 Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 396.778361][T11944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 396.778373][T11944] Call Trace: [ 396.778381][T11944] [ 396.778390][T11944] dump_stack_lvl+0x189/0x250 [ 396.778432][T11944] ? __pfx____ratelimit+0x10/0x10 [ 396.778462][T11944] ? __pfx_dump_stack_lvl+0x10/0x10 [ 396.778507][T11944] ? __pfx__printk+0x10/0x10 [ 396.778533][T11944] ? __might_fault+0xb0/0x130 [ 396.778568][T11944] should_fail_ex+0x414/0x560 [ 396.778599][T11944] _copy_from_user+0x2d/0xb0 [ 396.778624][T11944] generic_map_update_batch+0x572/0x7f0 [ 396.778676][T11944] ? __pfx_generic_map_update_batch+0x10/0x10 [ 396.778701][T11944] ? __fget_files+0x2a/0x420 [ 396.778734][T11944] ? __pfx_generic_map_update_batch+0x10/0x10 [ 396.778757][T11944] bpf_map_do_batch+0x369/0x5f0 [ 396.778785][T11944] __sys_bpf+0x384/0x860 [ 396.778806][T11944] ? __pfx___sys_bpf+0x10/0x10 [ 396.778837][T11944] ? ksys_write+0x22a/0x250 [ 396.778863][T11944] ? __pfx_ksys_write+0x10/0x10 [ 396.778882][T11944] ? rcu_is_watching+0x15/0xb0 [ 396.778912][T11944] __x64_sys_bpf+0x7c/0x90 [ 396.778942][T11944] do_syscall_64+0xfa/0x3b0 [ 396.778960][T11944] ? lockdep_hardirqs_on+0x9c/0x150 [ 396.778987][T11944] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.779005][T11944] ? clear_bhb_loop+0x60/0xb0 [ 396.779030][T11944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.779048][T11944] RIP: 0033:0x7feaa938e929 [ 396.779067][T11944] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 396.779084][T11944] RSP: 002b:00007feaaa16b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 396.779106][T11944] RAX: ffffffffffffffda RBX: 00007feaa95b5fa0 RCX: 00007feaa938e929 [ 396.779120][T11944] RDX: 0000000000000038 RSI: 0000200000000200 RDI: 000000000000001a [ 396.779133][T11944] RBP: 00007feaaa16b090 R08: 0000000000000000 R09: 0000000000000000 [ 396.779145][T11944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 396.779157][T11944] R13: 0000000000000000 R14: 00007feaa95b5fa0 R15: 00007feaa96dfa28 [ 396.779189][T11944] [ 397.036621][T11805] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 397.044268][T11805] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 397.071420][T11805] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 397.091259][T11805] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 397.098873][T11805] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 397.125871][T11805] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 397.535110][T11805] hsr_slave_0: entered promiscuous mode [ 397.559011][T11805] hsr_slave_1: entered promiscuous mode [ 397.584169][T11962] loop6: detected capacity change from 0 to 524287999 [ 397.609542][T11805] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 397.620463][T11805] Cannot create hsr debugfs directory [ 398.158470][ T30] audit: type=1326 audit(1752162294.361:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fab8612ab19 code=0x7ffc0000 [ 398.252969][ T30] audit: type=1326 audit(1752162294.411:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fab8612ab19 code=0x7ffc0000 [ 398.473411][ T30] audit: type=1326 audit(1752162294.411:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab8618e929 code=0x7ffc0000 [ 398.658107][ T30] audit: type=1326 audit(1752162294.411:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab8618e929 code=0x7ffc0000 [ 398.798126][ T30] audit: type=1326 audit(1752162294.411:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab8618e929 code=0x7ffc0000 [ 398.885733][ T30] audit: type=1326 audit(1752162294.411:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fab8612ab19 code=0x7ffc0000 [ 399.006108][ T30] audit: type=1326 audit(1752162294.411:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab8618e929 code=0x7ffc0000 [ 399.069598][ T30] audit: type=1326 audit(1752162294.411:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fab8612ab19 code=0x7ffc0000 [ 399.078706][T11988] bridge3: entered promiscuous mode [ 399.129062][ T30] audit: type=1326 audit(1752162294.411:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab8618e929 code=0x7ffc0000 [ 399.171408][T11988] bridge3: entered allmulticast mode [ 399.198092][ T30] audit: type=1326 audit(1752162294.411:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11967 comm="syz.1.857" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fab8612ab19 code=0x7ffc0000 [ 399.287535][T11988] team0: Port device bridge3 added [ 401.861213][T11805] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 401.883874][T12029] netlink: 12 bytes leftover after parsing attributes in process `syz.1.870'. [ 401.944509][T11805] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 401.995367][T11805] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 402.018393][T12034] netlink: 28 bytes leftover after parsing attributes in process `syz.4.872'. [ 402.019499][T11805] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 402.158153][ T5925] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 402.368621][ T5925] usb 3-1: Using ep0 maxpacket: 16 [ 402.381071][ T5925] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 402.390476][ T5925] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 402.403461][ T5925] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 402.537573][ T5925] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 402.594479][ T5925] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 402.678565][ T5925] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 402.689021][ T5925] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.734154][ T5925] usb 3-1: Product: syz [ 402.759627][ T5925] usb 3-1: Manufacturer: syz [ 402.788120][ T5925] usb 3-1: SerialNumber: syz [ 402.897487][T11805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 402.996115][T11805] 8021q: adding VLAN 0 to HW filter on device team0 [ 403.065628][ T5925] usb 3-1: USB disconnect, device number 41 [ 403.104961][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.112267][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 403.459021][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.466306][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 404.477954][T11805] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 404.773029][T11805] veth0_vlan: entered promiscuous mode [ 404.801390][T11805] veth1_vlan: entered promiscuous mode [ 405.145994][T11805] veth0_macvtap: entered promiscuous mode [ 405.285146][T11805] veth1_macvtap: entered promiscuous mode [ 405.496372][T11805] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 405.595783][T12086] (unnamed net_device) (uninitialized): peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 405.810187][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 405.810208][ T30] audit: type=1326 audit(1752162301.961:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12088 comm="syz.4.879" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f10fe78e929 code=0x0 [ 405.906376][T12086] bond4: entered promiscuous mode [ 405.911696][T12086] bond4: entered allmulticast mode [ 405.923789][T12086] 8021q: adding VLAN 0 to HW filter on device bond4 [ 406.215844][T11805] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 406.283679][T11805] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.352385][T11805] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.382941][T11805] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 406.412628][T11805] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 407.194811][ T198] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 407.268232][ T198] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 407.388282][ T3000] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 407.397892][ T3000] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 407.588132][ T5925] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 407.795180][ T5925] usb 2-1: config 0 has no interfaces? [ 407.813771][ T5925] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 407.848630][ T5925] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.900421][ T5925] usb 2-1: Product: syz [ 407.952188][ T5925] usb 2-1: Manufacturer: syz [ 408.013195][ T5925] usb 2-1: SerialNumber: syz [ 408.090179][T12121] xt_NFQUEUE: number of total queues is 0 [ 408.138964][ T5925] usb 2-1: config 0 descriptor?? [ 408.609114][T12132] binder: 12131:12132 unknown command 0 [ 408.614912][T12132] binder: 12131:12132 ioctl c0306201 200000000080 returned -22 [ 408.640115][T12132] netlink: 'syz.2.886': attribute type 4 has an invalid length. [ 408.661161][T12132] netlink: 'syz.2.886': attribute type 4 has an invalid length. [ 409.481146][T12154] netlink: 56 bytes leftover after parsing attributes in process `syz.2.891'. [ 410.313079][T12191] syz.4.896: attempt to access beyond end of device [ 410.313079][T12191] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 410.648688][ T31] INFO: task kworker/1:3:5912 blocked for more than 143 seconds. [ 410.674370][ T31] Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 [ 410.733273][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 410.782459][ T31] task:kworker/1:3 state:D stack:20712 pid:5912 tgid:5912 ppid:2 task_flags:0x4288060 flags:0x00004000 [ 410.847460][ T31] Workqueue: usb_hub_wq hub_event [ 410.877825][ T31] Call Trace: [ 410.892137][ T31] [ 410.901879][ T31] __schedule+0x16f5/0x4d00 [ 410.921952][ T31] ? schedule+0x165/0x360 [ 410.940377][ T31] ? __pfx___schedule+0x10/0x10 [ 410.972145][ T31] ? try_to_wake_up+0x7e5/0x1290 [ 410.997424][ T31] ? schedule+0x91/0x360 [ 411.023364][ T31] schedule+0x165/0x360 [ 411.044370][ T31] schedule_timeout+0x9a/0x270 [ 411.074992][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 411.105100][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 411.136457][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 411.170823][ T31] ? wait_for_completion+0x267/0x5d0 [ 411.194025][ T31] wait_for_completion+0x2bf/0x5d0 [ 411.217907][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 411.254311][ T31] i2c_del_adapter+0x581/0x6e0 [ 411.300017][ T31] ? up_write+0x1c4/0x420 [ 411.319232][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 411.407263][ T31] ? __pfx_cp2112_remove+0x10/0x10 [ 411.472981][ T31] ? sysfs_remove_group+0x23d/0x2c0 [ 411.501883][ T31] ? __pfx_cp2112_remove+0x10/0x10 [ 411.524045][ T31] cp2112_remove+0x5b/0x100 [ 411.540318][ T31] hid_device_remove+0x225/0x370 [ 411.568854][ T31] ? __pfx_hid_device_remove+0x10/0x10 [ 411.603860][ T31] device_release_driver_internal+0x46f/0x7c0 [ 411.660211][ T31] bus_remove_device+0x34d/0x410 [ 411.718116][ T31] device_del+0x511/0x8e0 [ 411.725062][ T31] ? __pfx_device_del+0x10/0x10 [ 411.744081][ T31] hid_destroy_device+0x6b/0x1b0 [ 411.762310][ T31] usbhid_disconnect+0x9f/0xc0 [ 411.767189][ T31] usb_unbind_interface+0x26b/0x8f0 [ 411.774838][ T31] ? __pfx_usb_unbind_interface+0x10/0x10 [ 411.786123][ T31] device_release_driver_internal+0x4d9/0x7c0 [ 411.792374][ T31] bus_remove_device+0x34d/0x410 [ 411.811897][ T31] device_del+0x511/0x8e0 [ 411.825652][ T31] ? kfree+0x18e/0x440 [ 411.840456][ T31] ? __pfx_device_del+0x10/0x10 [ 411.854701][ T31] ? kobject_put+0x446/0x480 [ 411.864968][ T31] usb_disable_device+0x3e9/0x8a0 [ 411.876353][ T31] usb_disconnect+0x330/0x950 [ 411.893151][ T31] hub_event+0x1cdb/0x4a00 [ 411.901938][ T31] ? do_raw_spin_lock+0x121/0x290 [ 411.921288][ T31] ? register_lock_class+0x51/0x320 [ 411.989993][ T9] usb 2-1: USB disconnect, device number 36 [ 412.029089][ T31] ? __pfx_hub_event+0x10/0x10 [ 412.050903][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 412.139176][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 412.248729][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 412.273448][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 412.312823][ T31] process_scheduled_works+0xae1/0x17b0 [ 412.333486][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 412.398427][ T31] worker_thread+0x8a0/0xda0 [ 412.469466][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 412.565158][ T31] ? __kthread_parkme+0x7b/0x200 [ 412.612100][ T31] kthread+0x70e/0x8a0 [ 412.616295][ T31] ? __pfx_worker_thread+0x10/0x10 [ 412.679008][ T31] ? __pfx_kthread+0x10/0x10 [ 412.736604][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 412.779009][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 412.794526][ T31] ? __pfx_kthread+0x10/0x10 [ 412.920695][ T31] ret_from_fork+0x3f9/0x770 [ 412.925909][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 412.936848][ T31] ? __switch_to_asm+0x39/0x70 [ 412.951040][ T31] ? __switch_to_asm+0x33/0x70 [ 412.968831][ T31] ? __pfx_kthread+0x10/0x10 [ 412.976282][ T31] ret_from_fork_asm+0x1a/0x30 [ 412.988691][ T31] [ 413.006796][ T31] [ 413.006796][ T31] Showing all locks held in the system: [ 413.033809][ T31] 1 lock held by pool_workqueue_/3: [ 413.243424][ T31] #0: ffffffff8e144c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 413.274010][ T31] 1 lock held by khungtaskd/31: [ 413.319343][ T31] #0: ffffffff8e13f160 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 413.343056][ T31] 2 locks held by kworker/u8:4/72: [ 413.351991][ T31] 2 locks held by getty/5610: [ 413.362032][ T31] #0: ffff88814d4280a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 413.401623][ T31] #1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 413.448512][ T31] 6 locks held by kworker/1:3/5912: [ 413.465832][ T31] #0: ffff8881442b6548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 413.478620][ T31] #1: ffffc90004c5fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 413.498667][ T31] #2: ffff8880287a3198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 413.508353][ T31] #3: ffff888078653198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xf8/0x950 [ 413.517812][ T31] #4: ffff88805932e160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x7c0 [ 413.536001][ T31] #5: ffff88807e24da20 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x7c0 [ 413.555443][ T31] 1 lock held by dhcpcd-run-hook/12217: [ 413.571477][ T31] #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 413.586744][ T31] 1 lock held by dhcpcd-run-hook/12226: [ 413.593424][ T31] [ 413.595900][ T31] ============================================= [ 413.595900][ T31] [ 413.652779][ T31] NMI backtrace for cpu 1 [ 413.652803][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 413.652828][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 413.652839][ T31] Call Trace: [ 413.652847][ T31] [ 413.652856][ T31] dump_stack_lvl+0x189/0x250 [ 413.652884][ T31] ? __wake_up_klogd+0xd9/0x110 [ 413.652915][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 413.652944][ T31] ? __pfx__printk+0x10/0x10 [ 413.652984][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 413.653014][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 413.653037][ T31] ? _printk+0xcf/0x120 [ 413.653067][ T31] ? __pfx__printk+0x10/0x10 [ 413.653096][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 413.653119][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 413.653148][ T31] watchdog+0xfee/0x1030 [ 413.653170][ T31] ? watchdog+0x1de/0x1030 [ 413.653197][ T31] kthread+0x70e/0x8a0 [ 413.653228][ T31] ? __pfx_watchdog+0x10/0x10 [ 413.653246][ T31] ? __pfx_kthread+0x10/0x10 [ 413.653275][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 413.653301][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 413.653328][ T31] ? __pfx_kthread+0x10/0x10 [ 413.653354][ T31] ret_from_fork+0x3f9/0x770 [ 413.653379][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 413.653405][ T31] ? __switch_to_asm+0x39/0x70 [ 413.653428][ T31] ? __switch_to_asm+0x33/0x70 [ 413.653451][ T31] ? __pfx_kthread+0x10/0x10 [ 413.653479][ T31] ret_from_fork_asm+0x1a/0x30 [ 413.653520][ T31] [ 413.653564][ T31] Sending NMI from CPU 1 to CPUs 0: [ 413.814992][ C0] NMI backtrace for cpu 0 [ 413.815010][ C0] CPU: 0 UID: 0 PID: 12228 Comm: dhcpcd-run-hook Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 413.815029][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 413.815039][ C0] RIP: 0010:strnlen+0x4/0x90 [ 413.815062][ C0] Code: c4 31 c0 5b 41 5c 41 5e 41 5f 5d e9 16 e9 06 00 cc 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 41 57 41 56 41 55 41 54 53 48 89 f8 48 85 f6 74 5e 4c 8d 34 37 [ 413.815076][ C0] RSP: 0000:ffffc9000b28f398 EFLAGS: 00000246 [ 413.815091][ C0] RAX: 00000060594b4d4f RBX: ffff88801cdba8f8 RCX: ffff88802ba61e00 [ 413.815103][ C0] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ffff88802ba626c0 [ 413.815114][ C0] RBP: ffff88801cdba8f0 R08: 0000000000000000 R09: ffffffff822d059a [ 413.815124][ C0] R10: ffff88802ba626c0 R11: ffffffff81acf3a0 R12: 0000000000000000 [ 413.815135][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 413.815146][ C0] FS: 00007fd588695c80(0000) GS:ffff888125c1b000(0000) knlGS:0000000000000000 [ 413.815159][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 413.815170][ C0] CR2: 0000561a293f3768 CR3: 0000000034012000 CR4: 00000000003526f0 [ 413.815186][ C0] Call Trace: [ 413.815193][ C0] [ 413.815198][ C0] __update_page_owner_handle+0x2a7/0x570 [ 413.815221][ C0] ? __update_page_owner_handle+0x5a/0x570 [ 413.815243][ C0] __set_page_owner+0x10b/0x4a0 [ 413.815263][ C0] ? __pfx___set_page_owner+0x10/0x10 [ 413.815285][ C0] post_alloc_hook+0x240/0x2a0 [ 413.815315][ C0] get_page_from_freelist+0x21e4/0x22c0 [ 413.815336][ C0] ? __lock_acquire+0xab9/0xd20 [ 413.815371][ C0] ? __pfx_get_page_from_freelist+0x10/0x10 [ 413.815394][ C0] ? prepare_alloc_pages+0x213/0x610 [ 413.815418][ C0] __alloc_frozen_pages_noprof+0x181/0x370 [ 413.815441][ C0] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 413.815467][ C0] ? policy_nodemask+0x27c/0x720 [ 413.815487][ C0] alloc_pages_mpol+0x232/0x4a0 [ 413.815508][ C0] vma_alloc_folio_noprof+0xe4/0x200 [ 413.815528][ C0] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 413.815553][ C0] folio_prealloc+0x30/0x180 [ 413.815572][ C0] do_wp_page+0x1231/0x5800 [ 413.815598][ C0] ? __pfx_do_wp_page+0x10/0x10 [ 413.815613][ C0] ? do_raw_spin_lock+0x121/0x290 [ 413.815635][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 413.815661][ C0] __handle_mm_fault+0x1144/0x5620 [ 413.815676][ C0] ? __lock_acquire+0xab9/0xd20 [ 413.815700][ C0] ? __pfx___handle_mm_fault+0x10/0x10 [ 413.815717][ C0] ? lock_vma_under_rcu+0xf8/0x710 [ 413.815740][ C0] ? lock_vma_under_rcu+0xf8/0x710 [ 413.815758][ C0] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 413.815781][ C0] handle_mm_fault+0x40a/0x8e0 [ 413.815802][ C0] do_user_addr_fault+0xa81/0x1390 [ 413.815821][ C0] ? rcu_is_watching+0x15/0xb0 [ 413.815840][ C0] ? trace_page_fault_user+0x84/0x1e0 [ 413.815855][ C0] exc_page_fault+0x76/0xf0 [ 413.815878][ C0] asm_exc_page_fault+0x26/0x30 [ 413.815893][ C0] RIP: 0033:0x7fd5887f7fd6 [ 413.815905][ C0] Code: 1d 87 e2 13 00 48 39 5f 08 0f 84 fe 00 00 00 42 0f b7 34 72 48 3b 35 31 72 13 00 48 89 f0 0f 83 80 00 00 00 48 89 f9 83 c0 01 <48> 89 5f 08 48 c1 e9 0c 4a 33 8c f2 80 00 00 00 48 89 0f 4a 89 bc [ 413.815918][ C0] RSP: 002b:00007ffeeadc3630 EFLAGS: 00010202 [ 413.815936][ C0] RAX: 0000000000000002 RBX: 28f8d1897beafda3 RCX: 0000561a293f3760 [ 413.815947][ C0] RDX: 0000561a293f1010 RSI: 0000000000000001 RDI: 0000561a293f3760 [ 413.815957][ C0] RBP: 0000561a293f3750 R08: 0000000000000090 R09: 0000000000000000 [ 413.815967][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: ffffffffffffff88 [ 413.815978][ C0] R13: 0000000000000002 R14: 0000000000000007 R15: 00007fd58892fac0 [ 413.815995][ C0] [ 413.817307][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 414.194153][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc5-syzkaller-00053-g8c2e52ebbe88 #0 PREEMPT(full) [ 414.206058][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 414.216301][ T31] Call Trace: [ 414.219596][ T31] [ 414.222537][ T31] dump_stack_lvl+0x99/0x250 [ 414.227315][ T31] ? __asan_memcpy+0x40/0x70 [ 414.231918][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 414.237155][ T31] ? __pfx__printk+0x10/0x10 [ 414.241905][ T31] panic+0x2db/0x790 [ 414.245850][ T31] ? __pfx_panic+0x10/0x10 [ 414.250295][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 414.256132][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 414.261521][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 414.267785][ T31] watchdog+0x102d/0x1030 [ 414.272131][ T31] ? watchdog+0x1de/0x1030 [ 414.276564][ T31] kthread+0x70e/0x8a0 [ 414.280660][ T31] ? __pfx_watchdog+0x10/0x10 [ 414.285351][ T31] ? __pfx_kthread+0x10/0x10 [ 414.289990][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 414.295236][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 414.300568][ T31] ? __pfx_kthread+0x10/0x10 [ 414.305205][ T31] ret_from_fork+0x3f9/0x770 [ 414.309840][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 414.314991][ T31] ? __switch_to_asm+0x39/0x70 [ 414.319776][ T31] ? __switch_to_asm+0x33/0x70 [ 414.324559][ T31] ? __pfx_kthread+0x10/0x10 [ 414.329228][ T31] ret_from_fork_asm+0x1a/0x30 [ 414.334044][ T31] [ 414.337234][ T31] Kernel Offset: disabled [ 414.341576][ T31] Rebooting in 86400 seconds..