last executing test programs: 11.599957153s ago: executing program 4 (id=1155): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@file={0x1, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r5 = openat$binfmt(0xffffffffffffff9c, r4, 0x42, 0x1ff) write$binfmt_script(r5, 0x0, 0x0) close(r5) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) keyctl$update(0x2, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x800) writev(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4b372eaf541d002007000000", @ANYRES32=r6, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) r8 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r9, 0x4020ae46, &(0x7f0000000380)={0x0, 0x40000}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 8.452663899s ago: executing program 4 (id=1165): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x1}) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x70bd27, 0x25dfdbfb, {0x81, 0x0, 0x80, 0x0, 0x1}}, 0x1c}, 0x1, 0x0, 0x0, 0x40080}, 0x0) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsmount(r2, 0x1, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r3, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) recvmmsg(r3, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) 7.798774673s ago: executing program 4 (id=1172): socket$igmp(0x2, 0x3, 0x2) socket$kcm(0x2, 0x200000000000001, 0x106) getpid() r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r5, &(0x7f0000000080)={0x2, 0xe26, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r5, 0x0, 0x48c, &(0x7f0000000300)={0x0, 'ipvlan1\x00', 0x1}, 0x18) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, r4, 0x300000b, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000000c0)={0x4, 0x0, [{0x6, 0x4, 0x8000, 0xc3da, 0x9}, {0x40000000, 0x2835, 0x4772, 0x18, 0x4}, {0x0, 0xa, 0x3ff, 0xbfffffff, 0x5}, {0x80000000, 0x6, 0x3, 0x9, 0x3}]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8d80, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r10, 0x4008ae89, &(0x7f00000003c0)={0x2, 0x0, [{0x40000002, 0x0, 0x6}, {0x40000002}]}) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000080)=@dellinkprop={0x34, 0x6c, 0x1, 0x709d27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x1a, 0x289c}, [@IFLA_ALT_IFNAME={0x14, 0x45, 'netdevsim0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x1c, 0x48001, 0x0, 0xfff, 0x3, 0xfffffe0000000001, 0x4000fa11, 0xffffffff}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 7.376431713s ago: executing program 2 (id=1176): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x4e24, @loopback}, 0x2, 0x0, 0x4}}, 0x2e) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010026bd70000400000005000000080009000200000008000c000300000008000b00000000000600010007"], 0x40}}, 0x20) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) getsockopt(r1, 0x111, 0x7ffffffe, 0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) futex(&(0x7f0000000040)=0x2, 0x6, 0x1, &(0x7f0000000080)={0x77359400}, 0x0, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r5) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r5, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x48, r7, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10091}, 0x90) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) r9 = dup(r8) write$UHID_INPUT(r9, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b2909094bf70e0dd038e7ff7fc6e5539b324c078b089b34383a33350826e0878f0e1ac6e7049b073c959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b33340d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) r10 = syz_open_dev$vivid(&(0x7f0000000000), 0x1, 0x2) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r11 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f00000001c0)) ioctl$PAGEMAP_SCAN(r11, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f000012b000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x9, &(0x7f0000000000), 0x0, 0x400, 0x0, 0x0, 0x0, 0x71}) r12 = syz_open_dev$vim2m(&(0x7f0000000e40), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r12, 0xc0405602, &(0x7f0000000140)={0x3, 0x2, 0x4, "8cc961cbadb476ba432550c2009186c40e588c885066d4e029720374dd51491b", 0x55595659}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r10, 0x4020565a, &(0x7f00000000c0)={0x4, 0xc, 0x2}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000540001002abd5b000200000007000000", @ANYRES32=r6, @ANYBLOB="20000100", @ANYRES32=r6, @ANYBLOB="000002006401010000000000000000000000000086dd0000"], 0x38}, 0x1, 0x0, 0x0, 0x41}, 0x40080c0) 6.952628529s ago: executing program 0 (id=1177): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a000007080002400000"], 0x7c}, 0x1, 0x0, 0x0, 0x8890}, 0x20004450) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000100), 0x4) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x4, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty=0x1000000, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) 6.66011245s ago: executing program 0 (id=1180): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r2, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r3, @ANYBLOB="010026bd7000000000003b00680008000300", @ANYRES32=r2, @ANYBLOB="0600cd00000000006c0033008020090008021100000108021100"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 6.659593237s ago: executing program 4 (id=1181): r0 = socket(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="480000001400030400000000000000000a3f0000", @ANYRES32=r2, @ANYBLOB="14000200ff2300000000000000000000000000011400060000000000060000000000000000000000080008000004"], 0x48}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x29, r2}) r3 = syz_usb_connect$lan78xx(0x0, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000680)={0x1c, &(0x7f0000000080)={0x0, 0x30, 0x1, "91"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000880)={0x1c, &(0x7f0000000040)={0x40, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_MM_EXE_FILE(0x50, 0xd, 0xffffffffffffffff) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000a80)={0x44, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, 0x0) 6.552701709s ago: executing program 0 (id=1182): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x1}) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x70bd27, 0x25dfdbfb, {0x81, 0x0, 0x80, 0x0, 0x1}}, 0x1c}, 0x1, 0x0, 0x0, 0x40080}, 0x0) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) fsmount(r2, 0x1, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r3, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) recvmmsg(r3, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) 6.394357644s ago: executing program 2 (id=1184): socket$inet(0x2, 0x3, 0x4) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000380)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000040), 0x12) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000001c0)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x8, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'netdevsim0\x00'}) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r5, 0x89a2, &(0x7f0000000000)='bridge0\x00') r6 = socket(0x10, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) r8 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) io_setup(0x9, &(0x7f0000000340)=0x0) r10 = socket$xdp(0x2c, 0x3, 0x0) io_submit(r9, 0x2000000000000211, &(0x7f0000000840)=[&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x8, 0x9, r10, 0x0}]) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0x6, 0x5}}, './cgroup/../file0/file0\x00'}) r12 = eventfd(0x6) io_submit(r9, 0x6, &(0x7f0000000a00)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x7, 0x6, r7, &(0x7f0000000280)="d1e8e4894314b8172a434fa177191b701b445b923d9b612ab0c85217996f8f1ba7e324e8ef323fb077c610248fde0ab173a0c53a575c3d81f7ee6ae5d6c7fb7ec890cecb40f32857ba62af8d10f5804d0fb7d603d181d3a9061bf0187db7d7137d19e0fa9ad22fe1d5b1ce95d8450ad5d93755e9a43faee0fa841798cd679ca7e9073a9e1f00cd355020ff441e292d62c023df8bd2b83f93500dec25c8e025e4b1d203b2f29c71a67d1e0e66", 0xac, 0xffffffffffffffff, 0x0, 0x1, r11}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x8, 0x3d, r2, &(0x7f0000000400)="9ff67da6be06cc89ed1bcc638d8173ea55327f7d5c32f37980e710e6ab08c304c2876faf561ff4790d39cdcaaf5b7b412e44fbe14f63ab987ad42ab374b23fa0b438fdd8ff8c3fd0d21efa153fd8dce6e5430ee440637c4cac5d73092e9661f02babb2186040c6742669c74a8d6bd485a2b5d4169aaab14ff572313f101f25169ad21019cca89bcd4c7a1016c8c4f72167e732ce2826a99ec608df5a5850792de48aef0a8abe8d4d96a479ca614a730927a25fa075ebfea380e373bab0e19ceaca734f0d5bb1c859b682330ef9f0eb1469f7865aa6439cac1fb46e01591d8be5e464b18392f158e18373dc5f4f55514df20f77", 0xf3, 0x5, 0x0, 0x2, r12}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x7, 0x0, r7, &(0x7f0000000540)="1717d515d7e0b3eaecbc97683836589da89e9268cfe0f4c564b36e9aeaa10211a20c66296e139df1ab4aec51994945ce171d64eab6c67c222a6859d480225904bd31ed0674cef456d232f59182ecd118719974ba33a953f65f53b90fe6ca8c2ec4ed00f06d8c4db02c6381a9d76e72437d71eee4e5eaa03170a71b09561a727f9fedb9c256e7e90cccf03f673be62c8c82adf8326d6b75482adb42d4679587f8304dae3091d9f408bf9972ee9cf422b661ccb872333a0a217609cc0e04cab53c7cf46a42f7f978d63255e0ce88a460638d75707a50da7907395d8bec110f457f5966ce903812fef56db41c90cbf861079af0f7e0d369", 0xf6, 0x8, 0x0, 0x1}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x6, 0x9, r8, &(0x7f0000000680)="3f1e0ac9fd71d8a703a5e5e89dbec348541f0915734b5cb641fc0ac0b9bf11ce4da7040b9ab135035a9feae2cf40084c9aa10a80b61953fd9515bd8b53fe7e8bf736b1d5175a7afd1ad6f57d013242f10deaa7ae88fd59af72a181fe0bc819f0da5c68d51b2001fff0cd18b9a6b06dfe834e430ddefb29780e568d5e183b5ad6fbeb9916365f15806dbc1ceb1a54476d52f6d361f9b7f9e01daf7df8a87e2f31aa7f432162d1e9142ed63345ffb5c1cb522f1932834a03cf189870b341d2f2dbe51bbb72225252c9506039", 0xcb, 0x3, 0x0, 0x1}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x6, 0xe, r2, &(0x7f00000007c0)="e092577f8fdfd95313d0f4a67a14e163ad6ac16d585f81abd3fc63de20755e539a8374e4e05f80e4be2421a17da65cc02ef85197f45fe8c60a17a039f1e605f8edf245f54ae22e08f3da08b18da234ad676080d352008878a9a93a9022b79d62e741f922097095f596a2cd4b89b6ca4567bab23f2db459cfea8f9f53768e7cc2be63e03b6ba00dd9bcfd4085d7e9b812ac4adc1eb203ec7e841ce839f9d45b1d53e0672a0e81713f1707e9f20de52bb6e8b2634d9fd7eb6cb806c6b1060b4dae5933", 0xc2, 0x507c, 0x0, 0x1, r1}, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x2, 0x568, r1, &(0x7f0000000900)="cce90c79806963669fbd16ecc3d2aab47e2c2d778af9fb827904451b83018fb5e08867dab51f03dab636d0712214be27c866a6d519ed3586f064436d84bfe47233959cf2581f63f98b843da803a5681f71e5317204e5fb65a10ed5c0434436a3e3d1e885f75fb25a6cc159fa5690e82f681541ed1c3494f2e7bca7205c3e6035b4ad9748fa8e72480ca09addeb78a1240a99b5c6c2ea3203bb6da1f52ab1db2664014c20881fbc6c4c35beeef20b381926", 0xb1, 0x1}]) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r13 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) preadv2(r13, &(0x7f0000000340)=[{&(0x7f00000001c0)=""/166, 0xa6}], 0x1, 0x45a, 0x800, 0x0) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000000)={[0x33, 0x790, 0x80000000002, 0x180, 0x400000004, 0xffffffffffffffff, 0xf1, 0x3, 0xfffffffffffffd7e, 0x45, 0x0, 0x3b9, 0xfffffffffffffffe, 0x5, 0x0, 0x8], 0x8000000, 0x385310}) ioctl$KVM_RUN(r8, 0xae80, 0x0) r14 = openat$cgroup_procs(r2, &(0x7f0000000380)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r14, &(0x7f0000000040), 0x12) 5.878295009s ago: executing program 3 (id=1187): r0 = socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e4000000000000000805000400030000000900020073797a3100000000050005000200000014000300686173683a69702c706f72742c6970000500010007"], 0x4c}, 0x1, 0x0, 0x0, 0x20044095}, 0x8042) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) read$FUSE(r4, 0x0, 0x0) close(0x3) r5 = syz_io_uring_setup(0xf00, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x0, 0x187}, &(0x7f00000008c0)=0x0, &(0x7f0000000900)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r5, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r0, &(0x7f0000001380)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x40010000, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 5.743910571s ago: executing program 2 (id=1188): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f00000064c0)=[{{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0x8004}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000001500)=""/4112, 0x1010}, {&(0x7f0000000040)=""/7, 0x7}, {&(0x7f0000000080)=""/82, 0x52}, {&(0x7f0000000180)=""/92, 0x5c}, {&(0x7f0000000200)=""/209, 0xd1}, {&(0x7f0000000300)=""/27, 0x1b}], 0x6, 0x0, 0x0, 0x300}, 0x400000}, {{0x0, 0x0, 0x0}}], 0x4, 0x20000, 0x0) 5.56172747s ago: executing program 2 (id=1189): r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/time_for_children\x00') ioctl$NS_GET_USERNS(r0, 0x8004b709, 0x0) open(&(0x7f0000000280)='.\x00', 0xa902, 0x131) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(r1, 0x8, &(0x7f00000002c0)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000300)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x7, @remote, 0xf03}, {0xa, 0x4e23, 0x6, @local, 0x7fffffff}}}, 0x48) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r6], 0x68}}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000080)=0x31a, 0x4) write(0xffffffffffffffff, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe004681000000078a151f75080039000500", 0x27) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x20000880) r8 = socket(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) 5.557851049s ago: executing program 0 (id=1190): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x40, 0x7fff0000}]}) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x75) (async) link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 5.420395273s ago: executing program 0 (id=1191): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0xb4, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x80, 0x2, [@TCA_MATCHALL_ACT={0x7c, 0x2, [@m_tunnel_key={0x78, 0x1, 0x0, 0x0, {{0xf}, {0x48, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @empty}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @empty}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x8, 0x4, 0x7fff, 0x7}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8080}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000140)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000000)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f00000004c0)="f058050000007f8f", 0x8}], 0x2, 0x0, 0x0, 0x4000}, 0x5) 5.180848546s ago: executing program 3 (id=1192): r0 = socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}}, 0x24000840) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000020101020000000000000000030000011400188008000340a9a5865208000140388a2a1704"], 0x2c}}, 0x24000881) (async) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="680000000101010200000000000000000a00000908001a4000010000080015400000496d0c001880080003400000397d38"], 0x68}, 0x1, 0x0, 0x0, 0x4800}, 0x4) (async) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001d008104e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) syz_usb_connect(0x3, 0x196, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x5d, 0xe4, 0x78, 0x8, 0x4b4, 0x931d, 0x9394, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x184, 0x1, 0x0, 0xc, 0x10, 0x17, "", [{{0x9, 0x4, 0x80, 0x1, 0x2, 0xde, 0xc5, 0x4f, 0x4, [@generic={0xb2, 0x3, "1db8510efe1bc5e0d381efae0af6ccbecbe9501d0a08176c923123ebf0f9b624a670638cf63087e9bb494dbb5260daa6b5dfa8944a3430beed99e5881a9633b2af78614483afe1ea71d58243f3f9a1033bc79d8ab9a1a7a204b13769c7b842c14a5290b0082d8541765add4fd8cd8b1a702dceb70fc371898b63de6290424c81b14fc00ccf3bc393d6137db17d18993d0d44d9f83508545afffeead08edd434e6d1d17daa4b5f05671034d60780641d0"}, @generic={0x61, 0xb, "40d0deb33ecef8d5ae6fd2324731a7c5f56e7baae58098c03e71dd93ff96101897d50c06c82fa4e3cb8bb3e64e275e804d7d762d50dcb2fe7008176de964e4e2306e15bb069d7abf9a7a08dae27f939e065a876771cc71b54df2d0747e5047"}], [{{0x9, 0x5, 0x5, 0x0, 0x400, 0x1, 0x9, 0x0, [@generic={0x46, 0x6, "b32eb40018004ad474e6c6a9858ba70b9ac9a02e1f683686ff8b900256d7fdffa11d9d0d73920bf1c384bfc6fc358751b59b06bba927b00c08f557a821d4a56f40a57a08"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x400, 0x0, 0x0, 0xdb, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x2d, 0x40}]}}]}}]}}]}}, 0x0) 4.012817557s ago: executing program 3 (id=1193): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x3) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) r2 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0xa) fchdir(r3) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r4, 0x7, 0x2) getdents64(r4, 0x0, 0x4f) sendmsg$nl_route(r1, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f0000001300)=@mpls_getnetconf={0x1c, 0x52, 0x60b, 0x70bd29, 0x25dfdbfc, {}, [@NETCONFA_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000080)=ANY=[@ANYBLOB="6000000010000d052abd70000000000000040000", @ANYRES32=0x0, @ANYBLOB="a4000600400000002c0012800c0001006d6163766c616e001c0002800800030003000000100005800a000400aaaaaaaaaaaa0000140035006d6163766c616e3000"], 0x60}, 0x1, 0x0, 0x0, 0x8840}, 0x8000) 3.583795493s ago: executing program 4 (id=1194): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x1123102, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x2afb, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x10000, 0x2, 0x15e, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x8, 0x3, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e6}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfffb, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r9, &(0x7f0000000040)=ANY=[], 0xffffff6a) splice(r8, 0x0, r0, 0x0, 0x40010003, 0x0) symlinkat(0x0, 0xffffffffffffff9c, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1b) listns(&(0x7f0000000040)={0x20, 0x0, 0x2, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r11, 0x11c, 0x3, 0x0, &(0x7f0000000000)=0xff5e) r12 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r12, 0x1, 0x2, &(0x7f0000000080)=0x1, 0x4) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f00000007c0)=ANY=[@ANYBLOB="120110030000004035120782400001020301090269000301053009080b0001010c208c0904000000010120000924010040040900070904010000010220"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x2c, 0x41, 0x107, 0xfffff7fe, 0xfffffffe, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x10, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x4, 0x1, 0x0, 0x0, @binary}]}, @nested={0x4, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048001}, 0x488c1) socket$pppl2tp(0x18, 0x1, 0x1) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r14 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r14, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r14, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)={0x34, r13, 0x8de13c6b70ae92c3, 0x41003, 0x0, {{}, {@val={0x8, 0x3, r15}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0xffffff22, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x12}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r10, &(0x7f0000000700)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000006c0)={&(0x7f0000000500)={0x148, r13, 0x2, 0x4, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r16}, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x8001}, @NL80211_ATTR_FRAME_TYPE={0x6}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x2}, @NL80211_ATTR_FRAME_MATCH={0xbd, 0x5b, "53b132399cd744e8e0cb9325dfe55a1ef589074ae266259d3620003d0bd8fe5078f24d9095c54ba1df479cf55dc8d75838bf8052adac8ae1d4df587fda7cc5c7c7d1de154edffde1f49474657da1ed6e0d1436b365c9ad1031eddd5a66d728f2be43135523e07c8932de0d00b103e1ff514bb9d535a3c3d92b6de1b2b665fc6381ac99dbc846a88e4ec6dc6720713d5df22c31b6b645defe0bf54bdfef3d1d0939bf32802d013fee77e31f8dc37cec33ac2f0da298e17bc25f"}, @NL80211_ATTR_FRAME_MATCH={0x23, 0x5b, "95b41e6be8b9ef0968a0ec8368d7345bcde3beb43826cdb2684c5192736bc3"}, @NL80211_ATTR_FRAME_TYPE={0x6}, @NL80211_ATTR_FRAME_MATCH={0x1f, 0x5b, "4d51aed76c1a0b1001057816e0207c96ab5c9126f8e89abfe614dc"}]}, 0x148}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) r17 = openat$vimc2(0xffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_SEND(0xffffffffffffffff, 0x40449426, &(0x7f0000000080)={{r17}, 0x6, &(0x7f0000000000)=[0x400, 0x8, 0x9, 0x3, 0x4, 0x4], 0x4, 0x2}) 3.097621187s ago: executing program 1 (id=1195): r0 = socket(0x840000000002, 0x3, 0xff) (async) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) unshare(0x2c020400) (async) tee(r1, r0, 0x2000002f, 0x7) syz_usb_connect(0x3, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00"], 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r3, &(0x7f0000001140)={0x0, 0x2, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x0, 0x808e}, 0x40000100) (async) write$cgroup_devices(r2, &(0x7f00000005c0)=ANY=[], 0xfffffeff) (async) recvmsg$unix(r3, &(0x7f0000000c40)={0x0, 0x0, 0x0}, 0x10003) ioctl$SOUND_MIXER_READ_DEVMASK(0xffffffffffffffff, 0x80044dfe, &(0x7f0000000000)) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r5) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a340000000c0a000000000a0000060900020073797a310000000014000380100000800c0800000000000000000000fa84bde6152eb4d900000000000000000100000a"], 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a000006"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 2.904786573s ago: executing program 1 (id=1196): iopl(0x0) socket$packet(0x11, 0x2, 0x300) r0 = socket(0x1d, 0x2, 0x6) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000500)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000040)="02042700ea0e0000000000001eafbcf706e105000000000000001104ee1606d4b8bf4a828bda305775c43824cee8440000", 0x31}, {&(0x7f0000000800)="126873159fca3fa38fb198e9a6b363ceb3e6d803ab766b7a38e451d14e0b3457474fe6a51671e4124fcea96a873b10996816e100ed8a93b0a9053db57d60973369f58551c3091cb88d3b", 0x4a}, {&(0x7f0000000880)="088d85d1f427cc11b21caca442b2a4af8e69b0c132387b8de793ab327e16f27134fe420c1f7a15898389a825d4f2f511bf0fecfd95e2206e7eaa54d08feafc4e009b7ad23f7c18a49c875b5b7266fc799ed90a099cedfe0c57000000000000000000000000000000003c4627b2367d6c49fc1dd9a9139362968da8e19f9886862c9e2841033c91633d5f77d6a6e3b589c7", 0x91}, {&(0x7f0000000100)="d83bf6fffffffd03ce3e01df4c000000009e7af9e172000000aa", 0x1a}, {&(0x7f0000000940)="b72abab9439ca41f5cf14d6435575ba774ee5f5c23ff2f5176f5773d08a15668ec280cfe4ea416cf769dbf978a8191bbe006e0da50029176c0f24e3ff4d3e895a2afbf52cef2fe1ca31edd842b126ec4be67e6e3624b9ddf806fc146c645ec1d37fe7e3b025c156d5d520104b53f7fb2af436201cfd5dca170edea5a190e4786bfaac544b60f514d7ef420526c467f14790dcfa5ab915d7dbcdf2765bbcad014c991f8b829c79f53586de79f0b987ad796f9de4a6e53136a07a39ab1f5a2ce30aded70a9b72d1beff7e8b6405fd6331e5635ee71e809be2d58f412dcd7b2e856d692dbfed19045ff13244acce351b6e450395568063569c71ea80a04f83fbe6ad1d0862fb97f816576c4844da65d751ee1fdc522ae1158670de297cdb2117bc0adc1486e016a6bcc922a162fce6a9ecc8c42b0c44c566004eda037864e5f339bbb0998cdaf2b8e49ae003659bc033668f7c8e550197ed95c420461254ba1883dbd9403672d579cee85c37f103ee9a350a768286017158784baeb063c8c684b91b022b0db2238b679092a1f6909f0cd9228500e088f5cc7bac4c0dc56e80fedac93554aec79715ce02e8bf3fcbd70382f619bfe3dcf06890d8542022ee58bdfb075d319c9fc8474cadc8de5c3dd3f682d3f68324d0af7a727064053ad84c94643eef190783c616467628f84620044c084b80e3e57bfcdf293c9c36b4474a52398b35e49e2ad4a4ac090bffc5cd27d3c69b4ae5f841d5b0766ccd36d25eb58d8f01621a05744b79ede39019ab9d7a1946353d8f3b7f833ce1a102a8c97a9e3f32138ffafd305448f2518ccdb7eef594a890eaeaff3f876f742fec22669a97085ed93b18228ecbe9e354e8f69967ca749fd2b1cf026665ca912e3fc0188b294519078b46676052de4fe22798290bd1e232c9791fc01ddb4ae776b5769143df2867042e8a3ddfa8e786bd8a244076956d4ab137939ad381650dd4fefd2b942a98d6f2edfd7019ae473e7608647b86d643e8ff3d7d4e89ed826e4b8c6e8fed224c528d805ade85c5b45261b2692c0f403dec050bd973b0999df214689f4402dd1598a16b0c7671e5e204a00b06376ddee7cb99292a8b835c0b451642b71f2ffa1aeea56255817b2384bfe4f8213ccfc1f762f250592896102e5f6d34cdd726bc0f86af52fd7c4483d32e23e5af770e960c7445b8e67b6086f0cadcd22d0d4bdadc31b5a94dd687379dc6e078210ccc71f8e67eb58d330394425ab17e55d1ca8f868f6bf738af291d2293c3dfa2ccff25061ded22878b3cc6532d19e5a00d1f0f1b9de35305fac2c6cfd5d77a2b02618735b7d392738bd5cd3eabb7039c790a9f193913f16e06605d405d6a0cf0011a2e5f935d8563fef1722692dd266c3d320b9f5eeb2a4b2f72155522f0ed72ff1efa0b6ee78e70d3d45241609e7f87d7bcfe1af71159baa11ad667a0ead3986b2b06500ba2615ee966ea86ca68d02de4802bd9ef18dac5ba53ca98b90df49ef4e3268ceee538973620e5a60513ea330989642626420b67dceebc569478657aedeb62c45b079348796923ad1fba5a99e6b150cf97ba2a570150053309c6dca7fa352fa1678c9b919fbc47ae0a84175a7fc25a00fa5888cb017e8d8225fadb29e34bd3c5bbccfb22a83255fec3967c991d5b3e6719ade82fb7ef85c8a4b9e7ad8ef2a3a7bc78de424572224affb1f9e0c5a969e61ee2ebb4f247bfa09384bdad04438f2efbfae303d47c3afe7e8d3a157b2a6f37572ea3ecc441dfb208ba755f781f144e58d80aea590abcfccbe8678ec6de47511f9d61cc408cbbe90eeab2cffe6d1a48dc3eb4e48e228fd43cafd7ff2c85c3ed52e99fe16887be28fcd2cd4ba4cac414c92c96294fa7d628e4356c748c173f790a7f30071d0bd53817c78d163249c7402b222b8f28668cae7afd17b97dbaf10b75b61409ca6f5b285d1ab09207c5a91c68b0d4b5da6d6b5a495c8debd7f4400e56d9e22d1cc330f782f2b5441a31b9ccf35aa1a151219cdcff5ab8b240af5b5a751eca67773c057412a935e3a7a367b2bcd28463904ee040a586d6f4f969cee56d55b6b4d97d1fe93b67e2f6bd47925054c4702ec8969a1a6211ea8f6783ca0e8ae333922ce19eceb24e2ff714a0208d2489a62f299aa50cdbfe5a826e872ab231bbddf5bd2fca92d4460379e05e13ff34a200fd921dcb67a002873bda8d86536cddaccb54eb72dd4e399fe9195ad5574ad85d9ed2eaae4106234f0a8db05a230ff377b59b54fd0919d1b86b938622ae6098f003db7f4d45d6874f54c33064ce6184dccc99fece2d994e9572d4840b0cbdd704fd70b4f625912d48a512339f883533768f09a4f614583dfb72defe713ee38f61184df279461b7d35becd8e67d01f0ec27e901d88215554d5a69db373a662085733d09ad9153e7d432c94f872ff7cd72995b3a581ea17722ed13a191b366208f75661112b1a7d42c252c907488ca8dd8f819d4618b0053d4bcddb3b5975cb8615ebc472e052552ee74d5253174a2b0cb96e1eaf6349b6c39be975123ee72b0ffe1367df7aba54de26c9135a3422d21067034551be5efc5daf8b8f59bc725e4fd171378fd9f16a785f1b0378823c85eec521e0b2aca70b7b72b719a20eb2fb0addc0b05851c8e181607f49dad7323bc255309097584c2099574db1ed7940fd16796aef19d30acd714dc1f898716df64db87d852eddf2f86e78fd7fd64868b4cb6cc626efcdea49c4a2779a0e777bbe23968e14233a810d9883680894de93023a8deae51ccbf32e6d1e53618ebee95c761221a33bc3263fff0f5ae23e14dba0418cf3f31effcb36956e06c57a17620044260419a208ae1d2296ec9472d44be74a8ed0a33a23181acdef8c7d2695ce9485ed8d17d9f6f30b9b128ee0ba15c42cbf6059bcfef008c09db8855343f79c3ce1c4d79077c8a62237d4e400a5aa88e7424f2f99df6c2a062758a070d6ed071f4968376581e20e52d64e9c4f8a6f73bb33f5b6b62c1deecc85bf789565fde14e4454306ed8f09af08afb360ee4fb40dd5dca0be43ccff75e5c0ef85ea7c521cb4840d61e99e1ce4661e721446d5a571cddffbc3643ec9b58237fd416376906bdca09485c2c80f82b23e8e7bbf22035fdbcacd804ae3771fd616901184ced46987d533017eef717e9b34a5531c3efe2d77c9b6cb0617382d69951545378a4118e71c64a1f16d096a8f933580922083d0538d90ae1715c63f682e8241b42e1646b0c52e34aa9c91efe2b6b787ce0747d4ff0dd07d6ebc9ce27e0ef35705eb7b78763a9829b464523ff3ed9078aff6ee29e6e7a59a5243825e8bb9235f8e49a9dfb5932536666c3dc75b29e515dbca4c84268cf23cd7b6da6814328a3cb26d7b1d6c28e20b36f9a2c9e2fcf663c314f72f37d2b8f405cfc686a6b35400435be0eab01709c2c4b3005491cbb0b560e33547b77ba9f25f01b194e20534199a3786ddfaf0a75aafb65cd4df4da7b5f98fe72a8bc7d045339fd41508cecca791c717a10d4fed8aa69eec80955bd899a6f8aaf3411be40568149e631ccbe17c68f85e87b58da81ba78def8b1a48c49b2dc7613f7d6ea8b158bed077666d37d1caba9a22b7cb2772e780f70872113e5bcaebaf9f9499f651dc894be3bba1e99d58b33d60c0eda397df91d7cf9fb072f247fa9a9f59c4f59c4284a3832ff0a1f9dc8f6346cb5c08a9dcb2851c7f169af688fc13f00cf9519ade547671698caaa3f4d4921fee83753b9ab0875707836343eddb5b87bec86aae023c9571b8e389ff3f4c692b6fb19686105249ce033116777d919ceb4559a67ee6b6ad9d4b53d2be24315429de3bf201107fe7dff9cbc92dbf9173391d555b0a1b8ea3252fd7d7fd15d8a3cc70cecdbdd43c4edcc4bb2fbbf646d5ec7dad0d3156a513d14184e0c316f8155e774f7dcea485f904828edf28510d692b66b1500c5a704371c2188a2812bd323d79674082b5f5e9f7f4ce1a75ed854b71555e9fcd1f0322c22a9e543674c79a74404e08e61860f505dc56e1b52977b9a9af18be4064b5f6aa7c891382bbbe65e70a4cee33176570341a525fb6b25c0b20bfa3f2ee4a01584f259f43c3b63a2dfc376f435827211379ab3ca8912cbe01e4f837920666fbda682f6954d1c156f21e12547b885f485c38f62e765013144be8ca92b1d4878f0ceb247e08c64268ad8970b57bb6d077c9b8ebe7fb1183087c9a3baee06100609204be588621253b9b120c08db9f28c2d38c9bc3f59018bb7216d73186048770d1e556faa49df23a40a64b40cdda2041dccf5619db09b7a7795fd7eb631c0e0bffc3b64422bf6acd84b7fae8bd05b057260a4d7c4851829c7bbf0b6f27c5db0ff10f42df3528f79dc9bbd591965259cd0389deb124b1fadc5dfd3ade9742d29261379ea3d98929512371dec991f0636fbda5dac355a04e363beeb4751781d9cef3a0b6ac65008900223ad43ed75cac8b0a868253fffa10bf6c2de99c687fd056e075cf0632b6d8ed2263ca08ad95b6f335a3b6d8ab7801422ac8597441ac1bbe289b50af31eb221d19a2d3177d4ad1056d616295e89471e65d811b8fa4fe2c0c12793f43ef7e75c7f657f6c26ca9cbae63ce99301069ab257ae77c38778d35afd326d569c626a68f3904b2c376dfaa05568892f346f86fb05e71fb751e09cd22525cb63512a7d2e4670bd31109b87818278e66dc73fa9667e35c5bc6588cd36d2b62592a4103803d93c194f8edd5d20c6597231321b909bbb3c1d13408e5cf27728883e333b391222e6b6665454892dfedd17a1066f1145163e1a31ba9a3e3cee925e55d794b8d462a0a092a639ccd4a24514083cb68224c87c18f0bb39ff721cc598e686b5fef169bc30f9ec6df397905f8340f6ae7ad826aac774cc46bfb9dfe8192e9ef10e8355d7c2810269eb73c7ecb8d3ffa33437142b8e596cdb778cd3cdda5bbbd09a8ea919929adbc63ff1004490c45a9ea59def65fabc884c39beac1b74a218f59c5e31ba85dcc4b8bd81d7a66d8aaf0edb64b505f760442e16fb7f07a069aba88601c3ace27762cef8196da3d44b14796b04e7fa3ba0000000000000000", 0xe18}, {&(0x7f0000000280)="c2f6aac64f849ece2d0d299cf2b00229025a081ec12dd5a7128ad08f18c9f01625", 0x21}], 0x6}, 0x40080) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {r2}}, './file1/file0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x700, 0x8000, 0x1, 0x8, {{0x16, 0x4, 0x3, 0x2, 0x58, 0x64, 0x0, 0x9, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0xb}, @dev={0xac, 0x14, 0x14, 0x3f}, {[@timestamp_addr={0x44, 0x44, 0x12, 0x1, 0x9, [{@local, 0x7}, {@remote, 0x100}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@empty, 0x30}, {@private=0xa010101, 0xfffffffe}, {@broadcast, 0x9}, {@loopback, 0x9}, {@dev={0xac, 0x14, 0x14, 0x3b}, 0xed5}]}]}}}}}) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x54}, 0x1, 0x0, 0x0, 0x20040050}, 0x20008000) r5 = socket$unix(0x1, 0x1, 0x0) bind$unix(r5, &(0x7f0000000140)=@file={0x1, './file1\x00'}, 0x2) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1070bd26, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xffff}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x20048884) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r12, {}, {0xffff, 0xffff}, {0x2, 0x2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x200400dc}, 0x0) r13 = socket(0x400000000010, 0x3, 0x0) r14 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2b, 0xfffff000, {0x0, 0x0, 0x0, r15, {0xf000, 0xffff}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x0, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) 1.633752718s ago: executing program 0 (id=1197): ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000040)={[{0x3, 0xff, 0x7f, 0x6, 0x8, 0xff, 0x1, 0x7f, 0x16, 0x7f, 0x82, 0x0, 0x8000}, {0x2, 0x1, 0x1, 0x8, 0x7, 0x8, 0x6, 0xa1, 0xfc, 0x9, 0xfe, 0xff, 0x800}, {0x6, 0x9, 0x3, 0xf8, 0x3, 0x40, 0x7, 0x2, 0x4, 0xa3, 0xeb, 0xb, 0x1}], 0xa31}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000100)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x5, 0x7fc00007}]}) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x14b302, 0x8c) r0 = openat$kvm(0xffffff9c, &(0x7f00000003c0), 0xa00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x6, 0xeeee0000, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000000)={[{0x80000000, 0x8, 0xc2, 0x4f, 0x40, 0x44, 0x80, 0x53, 0x5e, 0x44, 0x8, 0xfd, 0x100000000009}, {0xb, 0xa6f3, 0x4, 0x8, 0x9, 0x60, 0x24, 0x3, 0xa, 0x7f, 0x7, 0x8, 0xfffffffffffffffb}, {0x2, 0x1, 0xd, 0x10, 0x25, 0x9, 0x8, 0xfb, 0x7, 0x15, 0x0, 0x2, 0x200000000008}], 0x9}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x10679, 0x6, 0xf3b8, 0x11de, 0x51, 0x400, 0x4002004c4, 0x1000, 0xfffffffffffffffd, 0x97, 0x10, 0x0, 0x3, 0x4, 0x0, 0x5], 0x2000, 0x400}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003ac9bcc20d118af1ebb5a0102030109022400010700800b0904bb06023ae504000905070020000508ce090503"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000e80)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB="400d02000000e2"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b0000000000"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x820) bind$inet6(r5, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x50, &(0x7f0000000240)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}, @val={@void}, {@ipv6={0x86dd, @udp={0x0, 0x6, "910100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, '\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) syz_usb_control_io$lan78xx(r3, &(0x7f00000011c0)={0xc, &(0x7f0000001580)=ANY=[@ANYBLOB="0008ae000000ae24fb957390eff1c40eca8603ecfc4fb4ed617027e9f1e443493bdc3d274a5e38327e09004f1dbcba9a306fbc1cc0d597d353686af2517ad2f4a30609ab987714bb7fbabd26da140e6da3a54de3c43db988459a4573cea96966878d771dd070319b6fb19b4df043593eb6c717b382cb4e4c1a0f8986a33eebc82e167e0e9a235e361b0e1c1108370d8fbe5a84fdf4867620017b26819131c1f7edc102f96751506c3753e50100010000000000b68f5d16ff7392a115b7719b3eb49d674605c543ef260a85cf7f8a0ac4"], &(0x7f0000001180)=ANY=[@ANYBLOB="00030410000004030a28"]}, &(0x7f0000001140)={0x1c, &(0x7f0000001680)={0x40, 0x30, 0xf5, "2dc3b9834cb134900740389c1f06470cb4210fe6783f5e57f037be915784ee30b3f3bbae42f031cbbe9e31c7d7990e970a796a81a1caaa2e155b8da01d534b10e82070b16b5d795d20fa0db0914cb29ef19f552f9cc014f9cabdc994b6c95dd01d3be9a58e2a543c5ff4ef7d4e8ddf2dcf8a59ac00c019b9f8dfa3b692a0ee996e2321771380be38c4bcc8a2a6c9c30f90688cdf24584d080b4491486ba362218143077588ff8150a1874275093434f13ab923a54d61247de6487c30666a40bb97c6323d6b6f1340bb8648b04d5af44df8ceff0c69b05a279c8671f6a8805b397158fc75640a36477ebafd9f9fc491309e96a88572"}, &(0x7f00000010c0)={0x0, 0xa, 0x1, 0xd7}, &(0x7f0000001100)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000001480)={0xc0, 0xa1, 0x4, 0x800}, 0x0, &(0x7f0000001500)={0xc0, 0xa2, 0x2f, "17d567b09ad0d7ca010e7d7746d6724f9b33fe2c3ffa1587d4de64ff8a72e2e85c9ef7dc42e7865ef80bcaa872638d"}}) r8 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000400)={'veth1_to_bond\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x6, 0x2}}}]}, 0x38}}, 0xc840) sendmsg$nl_route_sched(r8, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x6, 0xf}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_UDP_SRC_PORT={0x4}, @TCA_FLOWER_KEY_ENC_IP_TTL={0x5, 0x52, 0x2}]}}]}, 0x44}}, 0x24040084) socket(0x2, 0x80805, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="010000000b0000003c49000005"], 0x50) 1.582086379s ago: executing program 3 (id=1198): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[], 0x7c}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r2, @ANYBLOB="020003000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 1.504865159s ago: executing program 1 (id=1199): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc020000000000000000000000000000140004"], 0x84}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000100001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40090) r1 = socket(0x10, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r2, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') move_mount(r4, &(0x7f0000000180)='./mnt\x00', r4, &(0x7f00000002c0)='./mnt\x00', 0x110) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x34, 0x41, 0x1, 0x80002, 0x4, {0x1}, [@nested={0x4, 0xcb}, @nested={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x10, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x5}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r5, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xf822}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x1) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r7, &(0x7f0000000680)={0x2020}, 0x2020) 1.341761392s ago: executing program 3 (id=1200): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = syz_io_uring_setup(0x6756, &(0x7f0000000200)={0x0, 0xcfca, 0x1040, 0x0, 0x1000001}, &(0x7f0000000280), &(0x7f0000000040), &(0x7f0000000000)) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r4, &(0x7f0000001500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001400)=[@dstaddrv6={0x1c, 0x84, 0x8, @empty}, @sndinfo={0x1c, 0x84, 0x2, {0xe0, 0x8002, 0xf, 0x9}}], 0x38, 0x10}, 0x4c010) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r3, 0x7, &(0x7f0000000380)=r5, 0x1) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@delchain={0x24, 0x66, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x9, 0xd}, {0x1, 0xfff1}, {0xc, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x24000881}, 0x49090) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001680)={0x24, r8, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}]}, 0x24}}, 0x44) r10 = socket$inet6_udp(0xa, 0x2, 0x0) r11 = openat$audio1(0xffffffffffffff9c, &(0x7f00000003c0), 0x440, 0x0) readv(r11, &(0x7f0000001400)=[{&(0x7f0000001440)=""/4082, 0xff2}], 0x1) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000000c0)={'geneve0\x00'}) sendmmsg$inet6(r10, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x1ff, @loopback, 0x7ff}, 0x1c, 0x0}}, {{&(0x7f0000000380)={0xa, 0x4e21, 0x0, @empty, 0xfffffffe}, 0xc, 0x0, 0x0, &(0x7f0000000500)=[@dstopts={{0x14, 0x29, 0x37, {0x62}}}, @hoplimit_2292={{0x10, 0x29, 0x8, 0x81}}, @hopopts_2292={{0x14, 0x29, 0x36, {0x2}}}], 0x38}}], 0x2, 0x4084) 1.316136002s ago: executing program 1 (id=1201): openat$ttynull(0xffffff9c, 0x0, 0x203, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x47d, @loopback}}) r1 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) read$nci(r1, 0x0, 0x0) write$nci(r1, 0x0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x20008040) ioctl$KDDISABIO(r1, 0x4b37) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000200), 0x20100) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r3, 0xc0605345, &(0x7f0000000040)={0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x401}}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpriority(0x1, 0x0, 0x1) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, @fallback=0x22}, 0x94) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="010000000c0000002f4900007f00000001000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000000000000000000000000000488a7a3888e3d2fae0224e282e8323fbe3a6d2bbd410e49004db5031e8a63398af85ca9e650deaf5034f84311111fab9381a0101ea0da05847d93f119c394d29b186b99ba5ec15da336f971b09402645db00be4a99f81d65d9b8c17664463af46b2ca1c35cf23cb882d3808f43fef4d6c458b5d6b2de67fe7641a8e967c5b04c45d1bf69a5", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r6}, 0x38) ioctl$EVIOCGPROP(r5, 0x40047438, &(0x7f0000000180)=""/246) writev(r5, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x1) 1.22010755s ago: executing program 2 (id=1202): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) r0 = creat(&(0x7f0000000000)='./bus\x00', 0x1) ioctl$FS_IOC_SETFLAGS(r0, 0x40046602, &(0x7f0000001400)=0x80) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x10000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x26aadf42, 0x0) 1.032451202s ago: executing program 1 (id=1203): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x1}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x482, &(0x7f0000000600)) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000016c0)={0x29, 0x0, [{0x2, 0x28, &(0x7f0000000080)=""/40}, {0xd100828e98ba2273, 0xef, &(0x7f00000015c0)=""/239}]}) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0xec, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x2, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x30}}, 0xec}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001c00"], 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x7, 0xe, 0x0, &(0x7f0000000ac0)='GPL\x00', 0x8000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000000c0)={0x0, 0x0, 0x4}, 0x10}, 0x94) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000000080)) 441.894493ms ago: executing program 3 (id=1204): r0 = syz_open_dev$loop(&(0x7f00000009c0), 0x8, 0xe00c1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="588bede21efddd247e000000000000f492fd132a000000000014000780080011010006000000050100000a00000005000400000000000900020073797a310000000c000300330d68fa"], 0x58}}, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000002d00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r3, &(0x7f0000002e00)={0x0, 0x0, &(0x7f0000002dc0)={&(0x7f0000000080)={0x2c, r4, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x1}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0xc}]}, 0x2c}}, 0x10) syz_emit_ethernet(0x7a, &(0x7f0000000000)={@multicast, @local, @void, {@x25={0x805, {0x0, 0x9d, 0xf7, "37c59e28fe034e06b2727fbe59f536c8e6bcc9bed599b0df5ff60bc711ee663f1432952b5c8d344e1a2c62a361655cbb9a34cb86d48644c65a4e90950ef1ee5a18c9eff6be43cd09135668b9855685edd056c63a16b906aa5a50124b742310b26943756b7e11489e20"}}}}, &(0x7f0000000080)={0x10000000, 0x1, [0xe2d, 0x9fe, 0x22b, 0xd41]}) r6 = openat$rfkill(0xffffff9c, &(0x7f0000000100), 0x1, 0x0) write$rfkill(r6, &(0x7f0000000180)={0x5, 0x1, 0x3, 0x1}, 0x8) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYRESDEC=r7, @ANYRES32=r0, @ANYRES64], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) syz_usb_connect$uac2(0x3, 0x8d, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e04003040000102030109027b000301068001080b0102010420020904000000010120000924010800011500050c2403020203fa020405000909040100000103200009040101"], 0x0) setsockopt$sock_void(r7, 0x1, 0x24, 0x0, 0x0) 409.402071ms ago: executing program 4 (id=1205): syz_open_dev$media(0x0, 0x8, 0x80c00) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, 0x0, 0x0) r2 = semget$private(0x0, 0x4000, 0x0) semctl$SETALL(r2, 0x0, 0x14, &(0x7f0000000000)=[0x4]) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x40000000, 0x0, 0x0, 0x0, 0x0, 0x80000100], 0x0, 0x0, 0x0}, 0xdf) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0700000004000000000100000400000008000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000005000000000000000000000100"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x0, 0x0, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800150000fcffff0800090000000000080011000000000008000e00800000000800", @ANYRES64=r4], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000840)=ANY=[@ANYBLOB="80010000100001ffffffff0000000000fc000000000700000000000000000001e00000020000000000000000000000004e24000000e900"/64, @ANYRES32=0x0, @ANYRES16, @ANYBLOB="ffffffff000000000000000000000000000004d46c000000fe8000000000000000000000000000bb000000000000000000000000000000000000000000000000feffffffffffffff0000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000080000000000000010000000000000000000000000000000a00010040000000480003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004800020065636228626c6f77666973682900"/308], 0x180}}, 0x40000) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, 0x0, 0x0, 0x0) syz_open_dev$loop(0x0, 0x2, 0x2c0000) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) msgctl$IPC_RMID(0x0, 0x0) write$binfmt_misc(r7, 0x0, 0x0) r8 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f0000000040)={0xc0, 0x1, 0x4, 0x0, 0x9}) ioctl$vim2m_VIDIOC_ENUM_FMT(r8, 0xc0405668, &(0x7f0000000140)={0x9, 0x1, 0x1, "0000087aba10fdfffffbe30b51751bc53051a30000160000000008ebffffff00", 0x34565559}) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40000, 0x0, 0x0) prctl$PR_SET_THP_DISABLE(0x51, 0x0) 260.878187ms ago: executing program 1 (id=1206): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00', 0xa3e}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x3, 0x2, 0x0, 0x2, 0x3}, 0x4}) write$sndseq(r1, &(0x7f0000000140)=[{0x1f, 0x0, 0x0, 0xfd, @tick, {}, {}, @raw32={[0x0, 0x1f00]}}], 0x1c) 0s ago: executing program 2 (id=1207): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r2, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000380)={[0x8000000000000000, 0x100000000, 0x0, 0x20, 0x0, 0x0, 0x2004c9, 0x7000, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x4000000000000004, 0x2], 0xffff1000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_SET_CONFIG(r5, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x88041011}, 0xc, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="2b74d9ab939a6069a779fc200283e17000ffdbdf250c00000008000500020000001c000280080005000600000005000d00014fd1dc066712b9df6f97400b35a56c995a66ee02afedd6e6bdcb7309d8d4ea0b18b592571886b083a55e64b05fe00027ebb2863f6a900d0f0e3e3166fc32984e884db280eaad2af801a879167f9e9504c469a46112e3061439a36f084dbbe47834f3792206b4db5264222f7f94f00980b56727a2d0f9b0e2175dc43e4ff245cf2df4e8f1ac8336ae01ea4527ffb0a90fa11db459f12da45a68a20b374cbeceaf2f580efe"], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004819) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(r6, 0xc01c64a3, &(0x7f0000000100)={0x0, 0x0, 0x8000, 0xd, 0x3, 0x4, 0x9}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000050000000900020073797a310000000108000440000000000900010073797a30000000000800034000000005520800001100"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, 0x0, 0x0) recvmmsg(r2, &(0x7f00000031c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f00000008c0)=""/135, 0x87}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000980)=""/146, 0x92}, {&(0x7f0000000080)=""/43, 0x2b}, {&(0x7f0000000a80)=""/242, 0xf2}, {&(0x7f0000000b80)=""/143, 0x8f}], 0x4}, 0x1}], 0x2, 0x22, 0x0) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) r9 = openat$null(0xffffffffffffff9c, &(0x7f0000000680), 0x51ad96a181f630bf, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000002880)=@generic={0x0, r9}, 0x18) kernel console output (not intermixed with test programs): f/0x550 [ 202.425781][ T7890] ? trace_irq_disable+0x3b/0x140 [ 202.425803][ T7890] do_fast_syscall_32+0x33/0x70 [ 202.425819][ T7890] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 202.425838][ T7890] RIP: 0023:0xf709f0ec [ 202.425852][ T7890] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 202.425864][ T7890] RSP: 002b:00000000f546c50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 202.425880][ T7890] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001100 [ 202.425890][ T7890] RDX: 0000000000000001 RSI: 0000000000004010 RDI: 0000000000000000 [ 202.425899][ T7890] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 202.425908][ T7890] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 202.425916][ T7890] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 202.425939][ T7890] [ 202.885911][ T7893] netlink: 8 bytes leftover after parsing attributes in process `syz.2.754'. [ 203.024447][ T7895] netlink: 4 bytes leftover after parsing attributes in process `syz.4.755'. [ 204.116965][ T7899] Set syz1 is full, maxelem 65536 reached [ 204.325432][ T5726] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 204.436401][ T7933] netlink: 8 bytes leftover after parsing attributes in process `syz.3.767'. [ 204.511686][ T5726] usb 1-1: Using ep0 maxpacket: 32 [ 204.525645][ T5726] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 204.553627][ T5726] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.575628][ T5726] usb 1-1: Product: syz [ 204.585229][ T5726] usb 1-1: Manufacturer: syz [ 204.597596][ T5726] usb 1-1: SerialNumber: syz [ 204.617405][ T5726] usb 1-1: config 0 descriptor?? [ 204.622858][ T7938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.769'. [ 204.863765][ T5726] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: version d4.15 found at bus 001 address 020 [ 205.688658][ T7956] Set syz1 is full, maxelem 65536 reached [ 205.710580][ T5711] usb 1-1: USB disconnect, device number 20 [ 206.324263][ T7974] netlink: 4 bytes leftover after parsing attributes in process `syz.1.781'. [ 206.335659][ T7975] netlink: 8 bytes leftover after parsing attributes in process `syz.0.780'. [ 206.432094][ T5711] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 206.595036][ T5711] usb 4-1: Using ep0 maxpacket: 32 [ 206.608662][ T5711] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 206.619208][ T5711] usb 4-1: config 0 has no interface number 0 [ 206.626263][ T5711] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 206.639573][ T5711] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 206.650460][ T5711] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.660574][ T5711] usb 4-1: Product: syz [ 206.666173][ T5711] usb 4-1: Manufacturer: syz [ 206.671031][ T5711] usb 4-1: SerialNumber: syz [ 206.679888][ T5711] usb 4-1: config 0 descriptor?? [ 206.704239][ T5711] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 206.716524][ T5711] em28xx 4-1:0.132: Video interface 132 found: [ 206.966128][ T5711] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 206.990825][ T7989] FAULT_INJECTION: forcing a failure. [ 206.990825][ T7989] name failslab, interval 1, probability 0, space 0, times 0 [ 207.018061][ T7989] CPU: 1 UID: 0 PID: 7989 Comm: syz.0.786 Not tainted syzkaller #0 PREEMPT(full) [ 207.018091][ T7989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 207.018103][ T7989] Call Trace: [ 207.018112][ T7989] [ 207.018121][ T7989] dump_stack_lvl+0xe8/0x150 [ 207.018158][ T7989] should_fail_ex+0x40c/0x560 [ 207.018190][ T7989] should_failslab+0xa8/0x100 [ 207.018224][ T7989] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 207.018248][ T7989] ? __do_fast_syscall_32+0x23e/0x6f0 [ 207.018272][ T7989] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.018298][ T7989] ? fuse_get_req+0x8ee/0xd40 [ 207.018316][ T7989] ? fuse_get_req+0x8ee/0xd40 [ 207.018343][ T7989] fuse_get_req+0x8ee/0xd40 [ 207.018374][ T7989] ? __pfx_fuse_get_req+0x10/0x10 [ 207.018425][ T7989] fuse_chan_send+0x2cf/0x1ac0 [ 207.018461][ T7989] ? __kmalloc_noprof+0x396/0x720 [ 207.018488][ T7989] ? __kmalloc_noprof+0x1ad/0x720 [ 207.018513][ T7989] ? get_create_ext+0x2f5/0xd20 [ 207.018558][ T7989] ? from_kgid+0x1c6/0x660 [ 207.018580][ T7989] ? __pfx_fuse_chan_send+0x10/0x10 [ 207.018607][ T7989] ? __pfx_from_kgid+0x10/0x10 [ 207.018626][ T7989] ? get_create_ext+0x8f3/0xd20 [ 207.018650][ T7989] ? pid_nr_ns+0xcb/0x140 [ 207.018675][ T7989] ? fuse_req_prep+0x5cc/0x9b0 [ 207.018699][ T7989] ? __fuse_simple_request+0x7a/0xb0 [ 207.018717][ T7989] create_new_entry+0x2c1/0x7c0 [ 207.018746][ T7989] ? __pfx_create_new_entry+0x10/0x10 [ 207.018787][ T7989] fuse_mknod+0x36e/0x4a0 [ 207.018814][ T7989] ? __pfx_fuse_mknod+0x10/0x10 [ 207.018856][ T7989] ? bpf_lsm_inode_mknod+0x9/0x20 [ 207.018872][ T7989] ? security_inode_mknod+0xc2/0x330 [ 207.018895][ T7989] vfs_mknod+0x441/0x600 [ 207.018916][ T7989] filename_mknodat+0x3cb/0x660 [ 207.018937][ T7989] ? __pfx_filename_mknodat+0x10/0x10 [ 207.018951][ T7989] ? strncpy_from_user+0x150/0x2c0 [ 207.018973][ T7989] ? do_getname+0x151/0x250 [ 207.018994][ T7989] __se_sys_mknodat+0x3b/0x150 [ 207.019013][ T7989] __do_fast_syscall_32+0x23e/0x6f0 [ 207.019033][ T7989] ? do_fast_syscall_32+0x33/0x70 [ 207.019049][ T7989] ? lockdep_hardirqs_on+0x7a/0x110 [ 207.019064][ T7989] ? asm_int80_emulation+0x1a/0x20 [ 207.019080][ T7989] ? do_int80_emulation+0x29f/0x550 [ 207.019096][ T7989] ? trace_irq_disable+0x3b/0x140 [ 207.019120][ T7989] do_fast_syscall_32+0x33/0x70 [ 207.019138][ T7989] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.019158][ T7989] RIP: 0023:0xf70bf0ec [ 207.019174][ T7989] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 207.019187][ T7989] RSP: 002b:00000000f54ad50c EFLAGS: 00000206 ORIG_RAX: 0000000000000129 [ 207.019205][ T7989] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 207.019216][ T7989] RDX: 00000000ffffc000 RSI: 0000000000000103 RDI: 0000000000000000 [ 207.019226][ T7989] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 207.019236][ T7989] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 207.019245][ T7989] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 207.019268][ T7989] [ 207.350533][ T5711] em28xx 4-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 207.362889][ T5711] em28xx 4-1:0.132: board has no eeprom [ 207.441709][ T5711] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 207.449792][ T5711] em28xx 4-1:0.132: analog set to bulk mode. [ 207.456763][ T1238] em28xx 4-1:0.132: Registering V4L2 extension [ 207.490961][ T5711] usb 4-1: USB disconnect, device number 27 [ 207.516356][ T5711] em28xx 4-1:0.132: Disconnecting em28xx [ 207.681678][ T5726] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 207.713788][ T1238] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 207.766760][ T1238] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 207.802722][ T1238] em28xx 4-1:0.132: No AC97 audio processor [ 207.856637][ T5726] usb 3-1: config 2 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 207.884723][ T8005] FAULT_INJECTION: forcing a failure. [ 207.884723][ T8005] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 207.915022][ T5726] usb 3-1: config 2 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 207.954734][ T8005] CPU: 1 UID: 0 PID: 8005 Comm: syz.0.790 Not tainted syzkaller #0 PREEMPT(full) [ 207.954763][ T8005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 207.954775][ T8005] Call Trace: [ 207.954783][ T8005] [ 207.954791][ T8005] dump_stack_lvl+0xe8/0x150 [ 207.954826][ T8005] should_fail_ex+0x40c/0x560 [ 207.954855][ T8005] _copy_to_user+0x31/0xb0 [ 207.954889][ T8005] mctp_ioctl+0x8f3/0x9e0 [ 207.954920][ T8005] ? __pfx_mctp_ioctl+0x10/0x10 [ 207.954949][ T8005] ? hook_file_ioctl_compat+0x1f0/0x5f0 [ 207.954994][ T8005] compat_sock_ioctl+0x179/0xcc0 [ 207.955027][ T8005] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 207.955055][ T8005] ? __fget_files+0x3a2/0x420 [ 207.955081][ T8005] ? __fget_files+0x2a/0x420 [ 207.955109][ T8005] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 207.955138][ T8005] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 207.955164][ T8005] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 207.955186][ T8005] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 207.955209][ T8005] ? __fget_files+0x3a2/0x420 [ 207.955242][ T8005] ? fput+0xa0/0xd0 [ 207.955268][ T8005] ? ksys_write+0x242/0x270 [ 207.955311][ T8005] __do_fast_syscall_32+0x23e/0x6f0 [ 207.955334][ T8005] ? do_fast_syscall_32+0x33/0x70 [ 207.955355][ T8005] ? lockdep_hardirqs_on+0x7a/0x110 [ 207.955373][ T8005] ? asm_int80_emulation+0x1a/0x20 [ 207.955392][ T8005] ? do_int80_emulation+0x29f/0x550 [ 207.955412][ T8005] ? trace_irq_disable+0x3b/0x140 [ 207.955448][ T8005] do_fast_syscall_32+0x33/0x70 [ 207.955470][ T8005] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.955494][ T8005] RIP: 0023:0xf70bf0ec [ 207.955513][ T8005] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 207.955529][ T8005] RSP: 002b:00000000f54ad50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 207.955551][ T8005] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000000089e0 [ 207.955564][ T8005] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 207.955576][ T8005] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 207.955587][ T8005] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 207.955598][ T8005] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 207.955628][ T8005] [ 207.957576][ T5726] usb 3-1: config 2 interface 0 has no altsetting 0 [ 208.288250][ T8010] netlink: 4 bytes leftover after parsing attributes in process `syz.0.792'. [ 208.395677][ T1238] usb 4-1: Decoder not found [ 208.409258][ T1238] em28xx 4-1:0.132: failed to create media graph [ 208.426426][ T1238] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 208.470721][ T5726] usb 3-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 208.508029][ T5726] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.540159][ T1238] em28xx 4-1:0.132: Remote control support is not available for this card. [ 208.560326][ T7994] Set syz1 is full, maxelem 65536 reached [ 208.578734][ T5711] em28xx 4-1:0.132: Closing input extension [ 208.615381][ T8014] netlink: 8 bytes leftover after parsing attributes in process `syz.3.794'. [ 208.769171][ T5711] em28xx 4-1:0.132: Freeing device [ 208.787253][ T7996] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.832451][ T7996] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.103976][ T5726] elo 0003:04E7:0009.0008: hidraw0: USB HID vff.ff Device [HID 04e7:0009] on usb-dummy_hcd.2-1/input0 [ 209.205060][ T8030] fuse: Bad value for 'fd' [ 209.288651][ T5711] usb 3-1: USB disconnect, device number 15 [ 209.415333][ T8035] kAFS: unable to lookup cell 'ÿ' [ 209.771726][ T1238] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 209.932035][ T1238] usb 1-1: Using ep0 maxpacket: 16 [ 209.964756][ T1238] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 209.984437][ T1238] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 210.010987][ T1238] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 210.043392][ T1238] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 210.094251][ T1238] usb 1-1: SerialNumber: syz [ 210.163680][ T1238] usb 1-1: 0:2 : does not exist [ 210.169387][ T8045] netlink: 4 bytes leftover after parsing attributes in process `syz.1.803'. [ 211.141821][ T1238] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 211.323282][ T1238] usb 2-1: Using ep0 maxpacket: 8 [ 211.346406][ T1238] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 211.391003][ T1238] usb 2-1: config 179 has no interface number 0 [ 211.419703][ T1238] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 211.458110][ T1238] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 211.500092][ T1238] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 211.542730][ T1238] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 211.592161][ T1238] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 211.635782][ T8052] Set syz1 is full, maxelem 65536 reached [ 211.651258][ T1238] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 211.682234][ T1238] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.724137][ T8059] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 211.845704][ T8061] netlink: 8 bytes leftover after parsing attributes in process `syz.3.808'. [ 212.309109][ T1238] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input10 [ 212.751559][ T8074] syzkaller0: entered promiscuous mode [ 212.772307][ T8074] syzkaller0: entered allmulticast mode [ 212.813440][ T8074] tipc: Enabled bearer , priority 0 [ 212.842382][ T8073] tipc: Resetting bearer [ 212.865530][ T5711] usb 2-1: USB disconnect, device number 15 [ 212.865594][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 212.865657][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 212.932850][ T8073] tipc: Disabling bearer [ 213.050958][ T1238] usb 1-1: USB disconnect, device number 21 [ 213.472815][ T9] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 213.506385][ T8083] netlink: 4 bytes leftover after parsing attributes in process `syz.0.817'. [ 213.633313][ T9] usb 3-1: config index 0 descriptor too short (expected 39, got 27) [ 213.664376][ T9] usb 3-1: config 0 interface 0 altsetting 251 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 213.702910][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 213.726608][ T9] usb 3-1: New USB device found, idVendor=045e, idProduct=0000, bcdDevice= 0.00 [ 213.751665][ T9] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 213.780343][ T9] usb 3-1: Product: syz [ 213.786977][ T9] usb 3-1: Manufacturer: syz [ 213.803540][ T9] usb 3-1: SerialNumber: syz [ 213.817299][ T9] usb 3-1: config 0 descriptor?? [ 213.841254][ T9] hub 3-1:0.0: bad descriptor, ignoring hub [ 213.870812][ T9] hub 3-1:0.0: probe with driver hub failed with error -5 [ 213.907826][ T8096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.821'. [ 214.078060][ T8078] netlink: 40 bytes leftover after parsing attributes in process `syz.2.815'. [ 214.275504][ T8105] kAFS: unable to lookup cell '(,Ì' [ 214.402691][ T8086] Set syz1 is full, maxelem 65536 reached [ 214.575066][ T8111] kAFS: unable to lookup cell 'ÿ' [ 214.918307][ T8120] FAULT_INJECTION: forcing a failure. [ 214.918307][ T8120] name failslab, interval 1, probability 0, space 0, times 0 [ 214.933094][ T8120] CPU: 1 UID: 0 PID: 8120 Comm: syz.1.828 Not tainted syzkaller #0 PREEMPT(full) [ 214.933122][ T8120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 214.933134][ T8120] Call Trace: [ 214.933142][ T8120] [ 214.933149][ T8120] dump_stack_lvl+0xe8/0x150 [ 214.933180][ T8120] should_fail_ex+0x40c/0x560 [ 214.933204][ T8120] should_failslab+0xa8/0x100 [ 214.933230][ T8120] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 214.933251][ T8120] ? __d_lookup+0x66/0x790 [ 214.933276][ T8120] ? __d_alloc+0x37/0x6f0 [ 214.933297][ T8120] ? __d_alloc+0x37/0x6f0 [ 214.933324][ T8120] __d_alloc+0x37/0x6f0 [ 214.933352][ T8120] d_alloc+0x4b/0x190 [ 214.933376][ T8120] ? lookup_one_qstr_excl+0xc4/0x360 [ 214.933401][ T8120] lookup_one_qstr_excl+0xd8/0x360 [ 214.933424][ T8120] ? lookup_noperm_common+0x245/0x430 [ 214.933448][ T8120] start_dirop+0x5c/0x90 [ 214.933469][ T8120] simple_start_creating+0xcc/0x110 [ 214.933494][ T8120] ? __pfx_simple_start_creating+0x10/0x10 [ 214.933518][ T8120] ? do_raw_spin_unlock+0xf5/0x210 [ 214.933536][ T8120] ? mntput+0x65/0xc0 [ 214.933556][ T8120] debugfs_start_creating+0xdb/0x1a0 [ 214.933575][ T8120] __debugfs_create_file+0x6f/0x400 [ 214.933593][ T8120] debugfs_create_file_full+0x3f/0x60 [ 214.933612][ T8120] ref_tracker_dir_debugfs+0x197/0x360 [ 214.933634][ T8120] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 214.933697][ T8120] ? __kvmalloc_node_noprof+0x55a/0x860 [ 214.933723][ T8120] ? __kvmalloc_node_noprof+0x35c/0x860 [ 214.933753][ T8120] ? __raw_spin_lock_init+0x45/0x100 [ 214.933774][ T8120] alloc_netdev_mqs+0x275/0x12b0 [ 214.933793][ T8120] ? __pfx_snprintf+0x10/0x10 [ 214.933815][ T8120] ? __pfx_macsec_setup+0x10/0x10 [ 214.933846][ T8120] rtnl_create_link+0x321/0xd70 [ 214.933872][ T8120] rtnl_newlink_create+0x25f/0xb00 [ 214.933897][ T8120] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 214.933917][ T8120] ? __pfx___mutex_lock+0x10/0x10 [ 214.933943][ T8120] ? ns_capable+0x89/0xe0 [ 214.933965][ T8120] rtnl_newlink+0x167f/0x1bd0 [ 214.934003][ T8120] ? __pfx_rtnl_newlink+0x10/0x10 [ 214.934026][ T8120] ? __do_fast_syscall_32+0x23e/0x6f0 [ 214.934044][ T8120] ? do_fast_syscall_32+0x33/0x70 [ 214.934060][ T8120] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 214.934109][ T8120] ? kasan_quarantine_put+0xbb/0x1f0 [ 214.934129][ T8120] ? lockdep_hardirqs_on+0x7a/0x110 [ 214.934148][ T8120] ? nlmon_xmit+0xb0/0x100 [ 214.934173][ T8120] ? kmem_cache_free+0x182/0x650 [ 214.934204][ T8120] ? __lock_acquire+0x683/0x2cf0 [ 214.934230][ T8120] ? __dev_queue_xmit+0x29b/0x3820 [ 214.934252][ T8120] ? __local_bh_enable_ip+0xd0/0x130 [ 214.934271][ T8120] ? lockdep_hardirqs_on+0x7a/0x110 [ 214.934286][ T8120] ? __dev_queue_xmit+0x29b/0x3820 [ 214.934303][ T8120] ? __local_bh_enable_ip+0xd0/0x130 [ 214.934321][ T8120] ? __dev_queue_xmit+0x29b/0x3820 [ 214.934345][ T8120] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 214.934383][ T8120] ? __pfx_rtnl_newlink+0x10/0x10 [ 214.934407][ T8120] rtnetlink_rcv_msg+0x802/0xc00 [ 214.934435][ T8120] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 214.934460][ T8120] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 214.934484][ T8120] ? ref_tracker_free+0x689/0x830 [ 214.934507][ T8120] ? __pfx_ref_tracker_free+0x10/0x10 [ 214.934528][ T8120] ? __asan_memcpy+0x40/0x70 [ 214.934546][ T8120] ? __skb_clone+0x5c/0x6c0 [ 214.934569][ T8120] netlink_rcv_skb+0x226/0x4a0 [ 214.934587][ T8120] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 214.934614][ T8120] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 214.934642][ T8120] ? netlink_deliver_tap+0x2e/0x1b0 [ 214.934664][ T8120] ? netlink_deliver_tap+0x2e/0x1b0 [ 214.934686][ T8120] netlink_unicast+0x7bb/0x940 [ 214.934721][ T8120] netlink_sendmsg+0x813/0xb40 [ 214.934747][ T8120] ? __pfx_netlink_sendmsg+0x10/0x10 [ 214.934768][ T8120] ? aa_sock_msg_perm+0xf1/0x1b0 [ 214.934791][ T8120] ? __pfx_netlink_sendmsg+0x10/0x10 [ 214.934808][ T8120] sock_sendmsg_nosec+0x13a/0x180 [ 214.934832][ T8120] ____sys_sendmsg+0x54e/0x850 [ 214.934854][ T8120] ? __pfx_____sys_sendmsg+0x10/0x10 [ 214.934884][ T8120] ___sys_sendmsg+0x2a5/0x360 [ 214.934900][ T8120] ? __lock_acquire+0x683/0x2cf0 [ 214.934926][ T8120] ? __pfx____sys_sendmsg+0x10/0x10 [ 214.934943][ T8120] ? get_pid_task+0x20/0x1f0 [ 214.934966][ T8120] ? get_pid_task+0x20/0x1f0 [ 214.934987][ T8120] ? get_pid_task+0x20/0x1f0 [ 214.935034][ T8120] ? __fget_files+0x2a/0x420 [ 214.935055][ T8120] ? __fget_files+0x3a2/0x420 [ 214.935086][ T8120] __sys_sendmsg+0x177/0x240 [ 214.935104][ T8120] ? __pfx___sys_sendmsg+0x10/0x10 [ 214.935154][ T8120] __do_fast_syscall_32+0x23e/0x6f0 [ 214.935173][ T8120] ? do_fast_syscall_32+0x33/0x70 [ 214.935190][ T8120] ? lockdep_hardirqs_on+0x7a/0x110 [ 214.935205][ T8120] ? asm_int80_emulation+0x1a/0x20 [ 214.935221][ T8120] ? do_int80_emulation+0x29f/0x550 [ 214.935238][ T8120] ? trace_irq_disable+0x3b/0x140 [ 214.935262][ T8120] do_fast_syscall_32+0x33/0x70 [ 214.935280][ T8120] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 214.935301][ T8120] RIP: 0023:0xf6fff0ec [ 214.935316][ T8120] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 214.935331][ T8120] RSP: 002b:00000000f53ed50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 214.935348][ T8120] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000080 [ 214.935360][ T8120] RDX: 0000000000000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 214.935370][ T8120] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 214.935380][ T8120] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 214.935390][ T8120] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 214.935414][ T8120] [ 215.819319][ T8125] netlink: 4 bytes leftover after parsing attributes in process `syz.1.830'. [ 216.354148][ T8135] netlink: 8 bytes leftover after parsing attributes in process `syz.1.834'. [ 216.414913][ T9] usb 3-1: USB disconnect, device number 16 [ 216.687071][ T8140] syzkaller0: entered promiscuous mode [ 216.697284][ T8140] syzkaller0: entered allmulticast mode [ 216.715262][ T8140] tipc: Started in network mode [ 216.722781][ T8140] tipc: Node identity eeecf433348a, cluster identity 4711 [ 216.737552][ T8140] tipc: Enabled bearer , priority 0 [ 216.754582][ T8139] tipc: Resetting bearer [ 216.828902][ T8139] tipc: Disabling bearer [ 217.633421][ T8142] Set syz1 is full, maxelem 65536 reached [ 217.682612][ T8155] syz_tun: entered allmulticast mode [ 217.815388][ T8154] syz_tun: left allmulticast mode [ 217.882062][ T8160] netlink: 4 bytes leftover after parsing attributes in process `syz.0.843'. [ 218.120077][ T8168] netlink: 8 bytes leftover after parsing attributes in process `syz.4.847'. [ 218.211721][ T5697] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 218.306781][ T8174] syzkaller0: entered promiscuous mode [ 218.312930][ T8174] syzkaller0: entered allmulticast mode [ 218.351919][ T6825] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 218.384218][ T5697] usb 3-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 218.412769][ T5697] usb 3-1: config 1 interface 0 has no altsetting 0 [ 218.430661][ T5697] usb 3-1: string descriptor 0 read error: -22 [ 218.441185][ T5697] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.40 [ 218.461036][ T5697] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.505848][ T6825] usb 1-1: unable to get BOS descriptor or descriptor too short [ 218.520245][ T6825] usb 1-1: config index 0 descriptor too short (expected 198, got 134) [ 218.529083][ T8177] netlink: 'syz.4.851': attribute type 10 has an invalid length. [ 218.540709][ T6825] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 218.553124][ T6825] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 218.562822][ T8177] syz_tun: entered promiscuous mode [ 218.569276][ T6825] usb 1-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 218.586911][ T6825] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.607247][ T6825] usb 1-1: Product: syz [ 218.607620][ T8177] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 218.624043][ T6825] usb 1-1: Manufacturer: syz [ 218.633630][ T6825] usb 1-1: SerialNumber: syz [ 218.668507][ T6825] usb 1-1: 0:1 : does not exist [ 218.677366][ T6825] usb 1-1: unit 0 not found! [ 218.898462][ T5697] hid_parser_main: 67 callbacks suppressed [ 218.898487][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 218.907479][ T1238] usb 1-1: USB disconnect, device number 22 [ 218.936688][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 218.948487][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 218.960758][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 218.988382][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 219.001926][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 219.009636][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 219.031754][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 219.039041][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 219.046771][ T5697] lenovo 0003:17EF:6047.0009: unknown main item tag 0x0 [ 219.114140][ T8162] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 219.153196][ T5697] lenovo 0003:17EF:6047.0009: hidraw0: USB HID v0.01 Device [HID 17ef:6047] on usb-dummy_hcd.2-1/input0 [ 219.182176][ T5697] lenovo 0003:17EF:6047.0009: Failed to switch F7/9/11 mode: -71 [ 219.202676][ T5697] lenovo 0003:17EF:6047.0009: Failed to switch middle button: -71 [ 219.224862][ T5697] lenovo 0003:17EF:6047.0009: Fn-lock setting failed: -71 [ 219.257657][ T5697] lenovo 0003:17EF:6047.0009: Sensitivity setting failed: -71 [ 219.305756][ T5697] usb 3-1: USB disconnect, device number 17 [ 219.375353][ T8188] fido_id[8188]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 219.500681][ T8182] Set syz1 is full, maxelem 65536 reached [ 219.527563][ T8193] netlink: 4 bytes leftover after parsing attributes in process `syz.0.857'. [ 219.760331][ T8204] netlink: 8 bytes leftover after parsing attributes in process `syz.0.861'. [ 219.997867][ T8208] netlink: 4 bytes leftover after parsing attributes in process `syz.1.860'. [ 220.035002][ T8208] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 220.123277][ T8208] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 220.787178][ T8226] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 220.930060][ T8227] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 221.022046][ T8231] netlink: 4 bytes leftover after parsing attributes in process `syz.3.868'. [ 221.042780][ T8229] netlink: 64102 bytes leftover after parsing attributes in process `syz.0.867'. [ 221.230827][ T8239] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_to_hsr, syncid = 4, id = 0 [ 221.287847][ T8237] syzkaller0: entered promiscuous mode [ 221.294009][ T8237] syzkaller0: entered allmulticast mode [ 221.319272][ T8237] tipc: Started in network mode [ 221.325741][ T8237] tipc: Node identity 2202627c69c9, cluster identity 4711 [ 221.345986][ T8237] tipc: Enabled bearer , priority 0 [ 221.376145][ T8236] tipc: Resetting bearer [ 221.434507][ T8236] tipc: Disabling bearer [ 221.623555][ T8234] Set syz1 is full, maxelem 65536 reached [ 221.732247][ T1238] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 221.908430][ T1238] usb 1-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 221.942190][ T1238] usb 1-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 221.977720][ T1238] usb 1-1: Product: syz [ 222.000271][ T1238] usb 1-1: Manufacturer: syz [ 222.012210][ T5697] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 222.021699][ T1238] usb 1-1: SerialNumber: syz [ 222.063000][ T1238] usb 1-1: config 0 descriptor?? [ 222.191664][ T5697] usb 4-1: Using ep0 maxpacket: 8 [ 222.210982][ T5697] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 222.234320][ T5697] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 222.247919][ T5697] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.256096][ T5697] usb 4-1: Product: syz [ 222.263055][ T5697] usb 4-1: Manufacturer: syz [ 222.267748][ T5697] usb 4-1: SerialNumber: syz [ 222.292982][ T5697] usb 4-1: config 0 descriptor?? [ 222.317628][ T5697] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 222.339184][ T5697] usb 4-1: setting power ON [ 222.348767][ T5697] dvb-usb: bulk message failed: -22 (2/0) [ 222.399992][ T5697] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 222.433875][ T5697] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 222.472494][ T5697] usb 4-1: media controller created [ 222.512853][ T1238] usb 1-1: USB disconnect, device number 23 [ 222.547766][ T8263] netlink: 4 bytes leftover after parsing attributes in process `syz.1.880'. [ 222.575660][ T5697] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 222.703151][ T5697] usb 4-1: selecting invalid altsetting 6 [ 222.727439][ T5697] usb 4-1: digital interface selection failed (-22) [ 222.763762][ T5697] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 222.781415][ T5697] usb 4-1: setting power OFF [ 222.789745][ T5697] dvb-usb: bulk message failed: -22 (2/0) [ 222.797534][ T5697] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 222.814665][ T5697] (NULL device *): no alternate interface [ 222.945502][ T5697] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 223.013315][ T5697] usb 4-1: USB disconnect, device number 28 [ 223.305960][ T5624] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 223.471731][ T5624] usb 1-1: Using ep0 maxpacket: 8 [ 223.480298][ T5624] usb 1-1: config 0 has an invalid interface number: 6 but max is 2 [ 223.494062][ T5624] usb 1-1: config 0 has an invalid interface number: 176 but max is 2 [ 223.524154][ T5624] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 223.551490][ T5624] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 223.587172][ T8283] FAULT_INJECTION: forcing a failure. [ 223.587172][ T8283] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 223.596460][ T5624] usb 1-1: config 0 has no interface number 0 [ 223.641216][ T8283] CPU: 1 UID: 0 PID: 8283 Comm: syz.1.885 Not tainted syzkaller #0 PREEMPT(full) [ 223.641243][ T8283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 223.641254][ T8283] Call Trace: [ 223.641261][ T8283] [ 223.641269][ T8283] dump_stack_lvl+0xe8/0x150 [ 223.641302][ T8283] should_fail_ex+0x40c/0x560 [ 223.641342][ T8283] _copy_to_user+0x31/0xb0 [ 223.641375][ T8283] simple_read_from_buffer+0xe1/0x170 [ 223.641406][ T8283] proc_fail_nth_read+0x1bb/0x230 [ 223.641440][ T8283] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 223.641472][ T8283] ? rw_verify_area+0x24a/0x4c0 [ 223.641503][ T8283] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 223.641529][ T8283] vfs_read+0x213/0xa80 [ 223.641570][ T8283] ? __pfx___mutex_lock+0x10/0x10 [ 223.641593][ T8283] ? __pfx_vfs_read+0x10/0x10 [ 223.641627][ T8283] ? __fget_files+0x2a/0x420 [ 223.641658][ T8283] ? __fget_files+0x3a2/0x420 [ 223.641684][ T8283] ? __fget_files+0x2a/0x420 [ 223.641721][ T8283] ksys_read+0x150/0x270 [ 223.641756][ T8283] ? __pfx_ksys_read+0x10/0x10 [ 223.641793][ T8283] ? asm_int80_emulation+0x1a/0x20 [ 223.641820][ T8283] do_int80_emulation+0x19a/0x550 [ 223.641843][ T8283] ? trace_irq_disable+0x3b/0x140 [ 223.641868][ T8283] ? asm_int80_emulation+0x1a/0x20 [ 223.641887][ T8283] ? clear_bhb_loop+0x40/0x90 [ 223.641908][ T8283] ? clear_bhb_loop+0x40/0x90 [ 223.641933][ T8283] asm_int80_emulation+0x1a/0x20 [ 223.641954][ T8283] RIP: 0023:0xf71372eb [ 223.641974][ T8283] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 223.641992][ T8283] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 223.642014][ T8283] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53ed5d0 [ 223.642029][ T8283] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 223.642041][ T8283] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 223.642053][ T8283] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 223.642067][ T8283] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 223.642096][ T8283] [ 223.643569][ T5624] usb 1-1: config 0 has no interface number 1 [ 223.985230][ T5624] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 223.994707][ T5624] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.037918][ T8287] FAULT_INJECTION: forcing a failure. [ 224.037918][ T8287] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 224.088425][ T8287] CPU: 1 UID: 0 PID: 8287 Comm: syz.1.888 Not tainted syzkaller #0 PREEMPT(full) [ 224.088455][ T8287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 224.088469][ T8287] Call Trace: [ 224.088478][ T8287] [ 224.088487][ T8287] dump_stack_lvl+0xe8/0x150 [ 224.088525][ T8287] should_fail_ex+0x40c/0x560 [ 224.088556][ T8287] _copy_to_user+0x31/0xb0 [ 224.088592][ T8287] simple_read_from_buffer+0xe1/0x170 [ 224.088627][ T8287] proc_fail_nth_read+0x1bb/0x230 [ 224.088659][ T8287] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 224.088693][ T8287] ? rw_verify_area+0x24a/0x4c0 [ 224.088727][ T8287] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 224.088756][ T8287] vfs_read+0x213/0xa80 [ 224.088793][ T8287] ? __pfx___mutex_lock+0x10/0x10 [ 224.088816][ T8287] ? __pfx_vfs_read+0x10/0x10 [ 224.088850][ T8287] ? __fget_files+0x2a/0x420 [ 224.088881][ T8287] ? __fget_files+0x3a2/0x420 [ 224.088908][ T8287] ? __fget_files+0x2a/0x420 [ 224.088945][ T8287] ksys_read+0x150/0x270 [ 224.088979][ T8287] ? __pfx_ksys_read+0x10/0x10 [ 224.089014][ T8287] ? asm_int80_emulation+0x1a/0x20 [ 224.089042][ T8287] do_int80_emulation+0x19a/0x550 [ 224.089064][ T8287] ? trace_irq_disable+0x3b/0x140 [ 224.089090][ T8287] ? asm_int80_emulation+0x1a/0x20 [ 224.089110][ T8287] ? clear_bhb_loop+0x40/0x90 [ 224.089132][ T8287] ? clear_bhb_loop+0x40/0x90 [ 224.089158][ T8287] asm_int80_emulation+0x1a/0x20 [ 224.089178][ T8287] RIP: 0023:0xf71372eb [ 224.089197][ T8287] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 224.089215][ T8287] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 224.089237][ T8287] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53ed5d0 [ 224.089258][ T8287] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 224.089270][ T8287] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 224.089286][ T8287] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 224.089299][ T8287] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 224.089329][ T8287] [ 224.345148][ T5624] usb 1-1: config 0 descriptor?? [ 224.362206][ T8294] netlink: 4 bytes leftover after parsing attributes in process `syz.3.891'. [ 224.377461][ T5624] usb 1-1: unknown number of interfaces: 2 [ 224.739148][ T8310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 224.752190][ T8309] FAULT_INJECTION: forcing a failure. [ 224.752190][ T8309] name failslab, interval 1, probability 0, space 0, times 0 [ 224.783397][ T8309] CPU: 1 UID: 0 PID: 8309 Comm: syz.4.895 Not tainted syzkaller #0 PREEMPT(full) [ 224.783423][ T8309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 224.783434][ T8309] Call Trace: [ 224.783442][ T8309] [ 224.783449][ T8309] dump_stack_lvl+0xe8/0x150 [ 224.783481][ T8309] should_fail_ex+0x40c/0x560 [ 224.783512][ T8309] should_failslab+0xa8/0x100 [ 224.783546][ T8309] __kmalloc_cache_noprof+0xa8/0x660 [ 224.783572][ T8309] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 224.783603][ T8309] ? __kmalloc_cache_noprof+0x150/0x660 [ 224.783630][ T8309] ? sctp_add_bind_addr+0x8c/0x370 [ 224.783659][ T8309] ? sctp_add_bind_addr+0x8c/0x370 [ 224.783697][ T8309] sctp_add_bind_addr+0x8c/0x370 [ 224.783733][ T8309] sctp_copy_local_addr_list+0x31a/0x4e0 [ 224.783778][ T8309] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 224.783810][ T8309] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 224.783843][ T8309] ? sctp_v6_is_any+0x64/0x80 [ 224.783878][ T8309] ? sctp_copy_one_addr+0x93/0x360 [ 224.783913][ T8309] sctp_bind_addr_copy+0xb3/0x3c0 [ 224.783945][ T8309] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 224.783977][ T8309] sctp_connect_new_asoc+0x2ff/0x6b0 [ 224.784005][ T8309] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 224.784036][ T8309] ? __local_bh_enable_ip+0xd0/0x130 [ 224.784060][ T8309] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 224.784084][ T8309] ? security_sctp_bind_connect+0x7e/0x2c0 [ 224.784119][ T8309] sctp_sendmsg+0x159b/0x2d00 [ 224.784158][ T8309] ? __pfx_sctp_sendmsg+0x10/0x10 [ 224.784188][ T8309] ? aa_sk_perm+0x6d5/0x900 [ 224.784229][ T8309] ? __might_fault+0xaf/0x130 [ 224.784258][ T8309] ? sock_rps_record_flow+0x19/0x350 [ 224.784294][ T8309] ? inet_sendmsg+0x298/0x320 [ 224.784328][ T8309] ? __pfx_inet_sendmsg+0x10/0x10 [ 224.784357][ T8309] sock_sendmsg_nosec+0x10e/0x180 [ 224.784388][ T8309] __sys_sendto+0x408/0x5a0 [ 224.784428][ T8309] ? __pfx___sys_sendto+0x10/0x10 [ 224.784473][ T8309] ? __fget_files+0x3a2/0x420 [ 224.784513][ T8309] ? ksys_write+0x242/0x270 [ 224.784553][ T8309] __ia32_sys_sendto+0xdd/0x100 [ 224.784590][ T8309] __do_fast_syscall_32+0x23e/0x6f0 [ 224.784614][ T8309] ? do_fast_syscall_32+0x33/0x70 [ 224.784636][ T8309] ? lockdep_hardirqs_on+0x7a/0x110 [ 224.784655][ T8309] ? asm_int80_emulation+0x1a/0x20 [ 224.784676][ T8309] ? do_int80_emulation+0x29f/0x550 [ 224.784698][ T8309] ? trace_irq_disable+0x3b/0x140 [ 224.784729][ T8309] do_fast_syscall_32+0x33/0x70 [ 224.784759][ T8309] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 224.784786][ T8309] RIP: 0023:0xf706f0ec [ 224.784811][ T8309] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 224.784830][ T8309] RSP: 002b:00000000f545d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 224.784854][ T8309] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080847fff [ 224.784869][ T8309] RDX: 0000000000034000 RSI: 00000000000000e0 RDI: 000000008005ffe4 [ 224.784883][ T8309] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 224.784896][ T8309] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 224.784909][ T8309] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 224.784941][ T8309] [ 224.825446][ T8310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.504824][ T8322] netlink: 48 bytes leftover after parsing attributes in process `syz.4.901'. [ 225.980631][ T9] usb 1-1: USB disconnect, device number 24 [ 226.374024][ T8339] netlink: 4 bytes leftover after parsing attributes in process `syz.3.905'. [ 226.452289][ T8337] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 226.471815][ T5697] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 226.478333][ T8342] loop5: detected capacity change from 0 to 7 [ 226.500454][ T8342] Dev loop5: unable to read RDB block 7 [ 226.506987][ T8342] loop5: AHDI p4 [ 226.511941][ T8342] loop5: partition table partially beyond EOD, truncated [ 226.644260][ T5697] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 226.666375][ T5697] usb 2-1: config 0 has no interface number 0 [ 226.693713][ T5697] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 226.716940][ T5697] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.735690][ T5697] usb 2-1: Product: syz [ 226.745811][ T5697] usb 2-1: Manufacturer: syz [ 226.755997][ T5697] usb 2-1: SerialNumber: syz [ 226.770256][ T5697] usb 2-1: config 0 descriptor?? [ 226.911691][ T9] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 226.937289][ T8348] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 226.950786][ T8348] ALSA: mixer_oss: invalid OSS volume 'topo_order[0]' [ 226.958145][ T8348] ALSA: mixer_oss: invalid OSS volume 'subprog#0:' [ 226.965067][ T8348] ALSA: mixer_oss: invalid OSS volume 'subprog#0:' [ 226.974731][ T8348] ALSA: mixer_oss: invalid OSS volume '0:' [ 226.981003][ T8348] ALSA: mixer_oss: invalid OSS volume '2:' [ 226.996315][ T8348] ALSA: mixer_oss: invalid OSS volume '3:' [ 227.005587][ T8348] ALSA: mixer_oss: invalid OSS volume '' [ 227.072135][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 227.089762][ T9] usb 4-1: config 0 has no interfaces? [ 227.101478][ T9] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 227.121300][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.145700][ T9] usb 4-1: config 0 descriptor?? [ 227.461773][ T9] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 227.635984][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 227.659873][ T9] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 210, changing to 7 [ 227.685147][ T9] usb 1-1: New USB device found, idVendor=041e, idProduct=3040, bcdDevice= 0.40 [ 227.708337][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.731424][ T9] usb 1-1: Product: syz [ 227.742036][ T9] usb 1-1: Manufacturer: syz [ 227.751007][ T9] usb 1-1: SerialNumber: syz [ 227.988161][ T9] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 228.009083][ T9] usb 1-1: unit 1 not found! [ 228.022356][ T9] usb 1-1: unit 8 not found! [ 228.167589][ T9] usb 1-1: USB disconnect, device number 25 [ 228.719208][ T5697] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 228.747303][ T8372] netlink: 4 bytes leftover after parsing attributes in process `syz.4.916'. [ 228.757233][ T5697] asix 2-1:0.251 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 228.773583][ T5697] asix 2-1:0.251: probe with driver asix failed with error -71 [ 228.800094][ T5697] usb 2-1: USB disconnect, device number 17 [ 228.931843][ T6821] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 229.094788][ T6821] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 229.106792][ T6821] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 229.128132][ T6821] usb 1-1: config 220 has no interface number 2 [ 229.141077][ T6821] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 229.168364][ T6821] usb 1-1: config 220 interface 0 has no altsetting 0 [ 229.180595][ T6821] usb 1-1: config 220 interface 76 has no altsetting 0 [ 229.192104][ T6821] usb 1-1: config 220 interface 1 has no altsetting 0 [ 229.205585][ T6821] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 229.225568][ T6821] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.244604][ T6821] usb 1-1: Product: syz [ 229.252280][ T6821] usb 1-1: Manufacturer: syz [ 229.263253][ T6821] usb 1-1: SerialNumber: syz [ 229.500205][ T6821] uvcvideo 1-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 229.527364][ T6821] uvcvideo 1-1:220.0: No valid video chain found. [ 229.551546][ T6821] usb 1-1: selecting invalid altsetting 0 [ 229.590357][ T6821] usb 1-1: selecting invalid altsetting 0 [ 229.613906][ T6821] usbtest 1-1:220.1: probe with driver usbtest failed with error -22 [ 229.652849][ T6821] usb 1-1: USB disconnect, device number 26 [ 229.985406][ T6821] usb 4-1: USB disconnect, device number 29 [ 230.001785][ T5697] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 230.191448][ T5697] usb 3-1: Using ep0 maxpacket: 32 [ 230.219322][ T5697] usb 3-1: New USB device found, idVendor=0499, idProduct=2002, bcdDevice= 0.40 [ 230.241900][ T5697] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.251216][ T5697] usb 3-1: Product: Ђ [ 230.256531][ T5697] usb 3-1: Manufacturer: ⾰멜휣왈╵掲规ìªïžäš›î–½î†žî‚练ﶼ초âŒï¬¸é¥¯î¿²ç€«äŠŠáŸä¥ã…¸îª«â¿Œá°¸ì‚ºíŠ¼ïŠè’§ï‚¦åž±ï®µî±¾È¼ì©€è¦¬ç”©ï—ªçž©ä½€æ´‘髫⫾樎ټ㪛éƒâ¡¿âœ¯ãŠ€å³Œå“·â‚ç’Šä‘œã¨ë«¹æ¬™ë±”í•žî–盨æ™è«î‚âŸì¥ ï…µí„£ï‘§î Ÿç¶²çŽ¾å¼¹ìª¡â•Œêºˆâ¢´â‹Ÿï¦¢ã’©à¤¡åºšä„¤ëµ„茖㟸௅鰇쇡♥ㅭᔹ䩮嶞뫤鶂긒Ḥ￥㿭￀⺙㉴渓ä‰æ³‘乄ﳭ꾺ᅨⲙ鹒葉䢜㌢ [ 230.303608][ T5697] usb 3-1: SerialNumber: syz [ 230.538886][ T5697] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 230.561721][ T6821] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 230.575207][ T5697] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 230.598116][ T8402] netlink: 4 bytes leftover after parsing attributes in process `syz.1.927'. [ 230.601960][ T6825] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 230.618528][ T5697] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 230.634287][ T5697] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 230.749638][ T6821] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 230.767563][ T5697] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 230.774679][ T6825] usb 4-1: device descriptor read/64, error -71 [ 230.781013][ T6821] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 230.793784][ T6821] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 230.803772][ T6821] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.883103][ T8399] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 231.006044][ T6821] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 231.013345][ T5697] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 231.033040][ T6825] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 231.062327][ T5697] usb 3-1: USB disconnect, device number 18 [ 231.176429][ T6612] udevd[6612]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 231.301947][ T6825] usb 4-1: device descriptor read/64, error -71 [ 231.512929][ T6825] usb usb4-port1: attempt power cycle [ 231.853835][ T8412] faux_driver vgem: [drm] Unknown color mode 55545; guessing buffer size. [ 231.881720][ T6825] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 231.934522][ T6825] usb 4-1: device descriptor read/8, error -71 [ 232.191930][ T6825] usb 4-1: new full-speed USB device number 33 using dummy_hcd [ 232.403798][ T6825] usb 4-1: device descriptor read/8, error -71 [ 232.484003][ T8426] FAULT_INJECTION: forcing a failure. [ 232.484003][ T8426] name failslab, interval 1, probability 0, space 0, times 0 [ 232.522097][ T8426] CPU: 0 UID: 0 PID: 8426 Comm: syz.4.932 Not tainted syzkaller #0 PREEMPT(full) [ 232.522119][ T8426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 232.522129][ T8426] Call Trace: [ 232.522135][ T8426] [ 232.522141][ T8426] dump_stack_lvl+0xe8/0x150 [ 232.522169][ T8426] should_fail_ex+0x40c/0x560 [ 232.522192][ T8426] should_failslab+0xa8/0x100 [ 232.522217][ T8426] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 232.522237][ T8426] ? skb_clone+0x212/0x3a0 [ 232.522252][ T8426] ? skb_clone+0x212/0x3a0 [ 232.522272][ T8426] skb_clone+0x212/0x3a0 [ 232.522295][ T8426] __netlink_deliver_tap+0x413/0x860 [ 232.522321][ T8426] ? netlink_deliver_tap+0x2e/0x1b0 [ 232.522338][ T8426] netlink_deliver_tap+0x19c/0x1b0 [ 232.522355][ T8426] netlink_unicast+0x77f/0x940 [ 232.522387][ T8426] netlink_sendmsg+0x813/0xb40 [ 232.522417][ T8426] ? __pfx_netlink_sendmsg+0x10/0x10 [ 232.522436][ T8426] ? aa_sock_msg_perm+0xf1/0x1b0 [ 232.522457][ T8426] ? __pfx_netlink_sendmsg+0x10/0x10 [ 232.522472][ T8426] sock_sendmsg_nosec+0x13a/0x180 [ 232.522495][ T8426] ____sys_sendmsg+0x54e/0x850 [ 232.522515][ T8426] ? __pfx_____sys_sendmsg+0x10/0x10 [ 232.522543][ T8426] ___sys_sendmsg+0x2a5/0x360 [ 232.522557][ T8426] ? __lock_acquire+0x683/0x2cf0 [ 232.522582][ T8426] ? __pfx____sys_sendmsg+0x10/0x10 [ 232.522598][ T8426] ? get_pid_task+0x20/0x1f0 [ 232.522619][ T8426] ? get_pid_task+0x20/0x1f0 [ 232.522638][ T8426] ? get_pid_task+0x20/0x1f0 [ 232.522681][ T8426] ? __fget_files+0x2a/0x420 [ 232.522701][ T8426] ? __fget_files+0x3a2/0x420 [ 232.522729][ T8426] __sys_sendmsg+0x177/0x240 [ 232.522746][ T8426] ? __pfx___sys_sendmsg+0x10/0x10 [ 232.522776][ T8426] __do_fast_syscall_32+0x23e/0x6f0 [ 232.522794][ T8426] ? do_fast_syscall_32+0x33/0x70 [ 232.522810][ T8426] ? lockdep_hardirqs_on+0x7a/0x110 [ 232.522824][ T8426] ? asm_int80_emulation+0x1a/0x20 [ 232.522839][ T8426] ? do_int80_emulation+0x29f/0x550 [ 232.522858][ T8426] do_fast_syscall_32+0x33/0x70 [ 232.522875][ T8426] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 232.522894][ T8426] RIP: 0023:0xf706f0ec [ 232.522911][ T8426] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 232.522924][ T8426] RSP: 002b:00000000f545d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 232.522940][ T8426] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 232.522951][ T8426] RDX: 000000002004c800 RSI: 0000000000000000 RDI: 0000000000000000 [ 232.522960][ T8426] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 232.522969][ T8426] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 232.522978][ T8426] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 232.523000][ T8426] [ 232.654486][ T6825] usb usb4-port1: unable to enumerate USB device [ 232.938307][ T8428] input: syz1 as /devices/virtual/input/input11 [ 233.044461][ T8432] FAULT_INJECTION: forcing a failure. [ 233.044461][ T8432] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 233.078685][ T8432] CPU: 1 UID: 0 PID: 8432 Comm: syz.4.933 Not tainted syzkaller #0 PREEMPT(full) [ 233.078714][ T8432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 233.078727][ T8432] Call Trace: [ 233.078736][ T8432] [ 233.078745][ T8432] dump_stack_lvl+0xe8/0x150 [ 233.078780][ T8432] should_fail_ex+0x40c/0x560 [ 233.078811][ T8432] _copy_from_user+0x2d/0xb0 [ 233.078844][ T8432] input_event_from_user+0xfe/0x290 [ 233.078875][ T8432] ? __pfx_input_event_from_user+0x10/0x10 [ 233.078916][ T8432] uinput_write+0x281/0xfe0 [ 233.078959][ T8432] ? __pfx_uinput_write+0x10/0x10 [ 233.078991][ T8432] ? bpf_lsm_file_permission+0x9/0x20 [ 233.079015][ T8432] ? security_file_permission+0x75/0x260 [ 233.079046][ T8432] ? rw_verify_area+0x203/0x4c0 [ 233.079080][ T8432] ? __pfx_uinput_write+0x10/0x10 [ 233.079108][ T8432] vfs_write+0x296/0xba0 [ 233.079148][ T8432] ? __pfx_vfs_write+0x10/0x10 [ 233.079182][ T8432] ? __fget_files+0x2a/0x420 [ 233.079212][ T8432] ? __fget_files+0x2a/0x420 [ 233.079238][ T8432] ? __fget_files+0x3a2/0x420 [ 233.079265][ T8432] ? __fget_files+0x2a/0x420 [ 233.079302][ T8432] ksys_write+0x150/0x270 [ 233.079337][ T8432] ? __pfx_ksys_write+0x10/0x10 [ 233.079385][ T8432] __do_fast_syscall_32+0x23e/0x6f0 [ 233.079409][ T8432] ? do_fast_syscall_32+0x33/0x70 [ 233.079431][ T8432] ? lockdep_hardirqs_on+0x7a/0x110 [ 233.079450][ T8432] ? asm_int80_emulation+0x1a/0x20 [ 233.079470][ T8432] ? do_int80_emulation+0x29f/0x550 [ 233.079491][ T8432] ? trace_irq_disable+0x3b/0x140 [ 233.079520][ T8432] do_fast_syscall_32+0x33/0x70 [ 233.079544][ T8432] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 233.079570][ T8432] RIP: 0023:0xf706f0ec [ 233.079588][ T8432] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 233.079606][ T8432] RSP: 002b:00000000f543c50c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 233.079628][ T8432] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 233.079642][ T8432] RDX: 000000000000fe4f RSI: 0000000000000000 RDI: 0000000000000000 [ 233.079655][ T8432] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 233.079667][ T8432] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 233.079679][ T8432] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 233.079709][ T8432] [ 233.348779][ T9] usb 1-1: USB disconnect, device number 27 [ 233.862087][ T1238] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 234.026767][ T8458] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 234.052813][ T1238] usb 3-1: Using ep0 maxpacket: 32 [ 234.056796][ T1238] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.056824][ T1238] usb 3-1: config 0 has no interfaces? [ 234.059306][ T1238] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 234.059339][ T1238] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.059361][ T1238] usb 3-1: Product: syz [ 234.059378][ T1238] usb 3-1: Manufacturer: syz [ 234.059396][ T1238] usb 3-1: SerialNumber: syz [ 234.064138][ T1238] usb 3-1: config 0 descriptor?? [ 234.155832][ T8454] syzkaller0: entered promiscuous mode [ 234.155863][ T8454] syzkaller0: entered allmulticast mode [ 234.394041][ T8467] netlink: 8 bytes leftover after parsing attributes in process `syz.1.945'. [ 234.649585][ T8440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.678694][ T8440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.718864][ T8477] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 234.718864][ T8477] Please contact the netfilter-devel mailing list or update your nftables rules. [ 234.822047][ T6825] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 235.029392][ T6825] usb 4-1: unable to get BOS descriptor or descriptor too short [ 235.040456][ T6825] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 235.054708][ T6825] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 235.065180][ T6825] usb 4-1: config 1 has no interface number 0 [ 235.074252][ T6825] usb 4-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice= 0.40 [ 235.093877][ T6825] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.102513][ T6825] usb 4-1: Product: syz [ 235.106763][ T6825] usb 4-1: Manufacturer: syz [ 235.111396][ T6825] usb 4-1: SerialNumber: syz [ 236.115313][ T808] usb 3-1: USB disconnect, device number 19 [ 236.630474][ T6825] usb 4-1: us122l: couldn't allocate write buffer [ 236.648172][ T6825] snd-usb-us122l 4-1:1.1: probe with driver snd-usb-us122l failed with error -22 [ 236.917588][ T8474] netlink: 8 bytes leftover after parsing attributes in process `syz.1.947'. [ 237.130628][ T6825] usb 4-1: USB disconnect, device number 34 [ 237.241109][ T8499] FAULT_INJECTION: forcing a failure. [ 237.241109][ T8499] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 237.266909][ T8499] CPU: 1 UID: 0 PID: 8499 Comm: syz.0.952 Tainted: G L syzkaller #0 PREEMPT(full) [ 237.266946][ T8499] Tainted: [L]=SOFTLOCKUP [ 237.266955][ T8499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 237.266979][ T8499] Call Trace: [ 237.266992][ T8499] [ 237.267001][ T8499] dump_stack_lvl+0xe8/0x150 [ 237.267050][ T8499] should_fail_ex+0x40c/0x560 [ 237.267083][ T8499] _copy_from_iter+0x1d3/0x1660 [ 237.267114][ T8499] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 237.267152][ T8499] ? __pfx_policy_nodemask+0x10/0x10 [ 237.267185][ T8499] ? unwind_next_frame+0x8f/0x2550 [ 237.267209][ T8499] ? __pfx__copy_from_iter+0x10/0x10 [ 237.267242][ T8499] ? alloc_pages_mpol+0x24a/0x380 [ 237.267284][ T8499] copy_page_from_iter+0x219/0x2d0 [ 237.267325][ T8499] tun_get_user+0x1bf1/0x4370 [ 237.267358][ T8499] ? tun_get_user+0x6e7/0x4370 [ 237.267404][ T8499] ? aa_file_perm+0x4ed/0x15f0 [ 237.267429][ T8499] ? __pfx_tun_get_user+0x10/0x10 [ 237.267458][ T8499] ? __lock_acquire+0x683/0x2cf0 [ 237.267498][ T8499] ? ref_tracker_alloc+0x341/0x4b0 [ 237.267522][ T8499] ? ktime_get+0x45/0x220 [ 237.267547][ T8499] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 237.267574][ T8499] ? tun_get+0x1c/0x2f0 [ 237.267600][ T8499] ? tun_get+0x1c/0x2f0 [ 237.267631][ T8499] ? tun_get+0x1c/0x2f0 [ 237.267660][ T8499] ? tun_get+0x1c/0x2f0 [ 237.267692][ T8499] tun_chr_write_iter+0x113/0x200 [ 237.267724][ T8499] vfs_write+0x612/0xba0 [ 237.267765][ T8499] ? __pfx_vfs_write+0x10/0x10 [ 237.267806][ T8499] ? __fget_files+0x2a/0x420 [ 237.267835][ T8499] ksys_write+0x150/0x270 [ 237.267863][ T8499] ? __pfx_ksys_write+0x10/0x10 [ 237.267893][ T8499] ? asm_int80_emulation+0x1a/0x20 [ 237.267915][ T8499] do_int80_emulation+0x19a/0x550 [ 237.267935][ T8499] ? asm_int80_emulation+0x1a/0x20 [ 237.267952][ T8499] ? clear_bhb_loop+0x40/0x90 [ 237.267971][ T8499] ? clear_bhb_loop+0x40/0x90 [ 237.267993][ T8499] asm_int80_emulation+0x1a/0x20 [ 237.268010][ T8499] RIP: 0023:0xf71f72eb [ 237.268038][ T8499] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 237.268054][ T8499] RSP: 002b:00000000f54ad44c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 237.268073][ T8499] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 00000000800000c0 [ 237.268085][ T8499] RDX: 0000000000000052 RSI: 0000000000000000 RDI: 0000000000000000 [ 237.268095][ T8499] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 237.268105][ T8499] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 237.268114][ T8499] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 237.268139][ T8499] [ 237.693786][ T8503] netlink: 8 bytes leftover after parsing attributes in process `syz.2.954'. [ 237.891376][ T8512] netlink: 8 bytes leftover after parsing attributes in process `syz.4.957'. [ 237.901215][ T8509] netlink: 36 bytes leftover after parsing attributes in process `syz.1.953'. [ 238.019732][ T8509] libceph: resolve '0..' (ret=-3): failed [ 238.522463][ T8525] IPv6: Can't replace route, no match found [ 238.734125][ T8535] netlink: 8 bytes leftover after parsing attributes in process `syz.3.965'. [ 239.051765][ T1238] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 239.067902][ T8546] netlink: 8 bytes leftover after parsing attributes in process `syz.2.967'. [ 239.231731][ T1238] usb 1-1: Using ep0 maxpacket: 8 [ 239.248839][ T1238] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x81 has an invalid bInterval 133, changing to 11 [ 239.274246][ T1238] usb 1-1: config 0 interface 0 has no altsetting 0 [ 239.292558][ T1238] usb 1-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 239.321393][ T1238] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.345871][ T1238] usb 1-1: config 0 descriptor?? [ 239.383724][ T8550] netlink: 'syz.1.968': attribute type 12 has an invalid length. [ 239.855323][ T8562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.900499][ T8562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.971957][ T6825] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 240.016707][ T8562] netlink: 3 bytes leftover after parsing attributes in process `syz.0.966'. [ 240.030038][ T8566] capability: warning: `syz.1.973' uses 32-bit capabilities (legacy support in use) [ 240.147110][ T6825] usb 3-1: Using ep0 maxpacket: 32 [ 240.163656][ T6825] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 240.184096][ T6825] usb 3-1: config 0 has no interface number 0 [ 240.205088][ T6825] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 240.218851][ T6825] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.242586][ T6825] usb 3-1: Product: syz [ 240.259608][ T6825] usb 3-1: Manufacturer: syz [ 240.280016][ T6825] usb 3-1: SerialNumber: syz [ 240.311493][ T6825] usb 3-1: config 0 descriptor?? [ 240.335382][ T6825] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 240.362513][ T6825] usb 3-1: selecting invalid altsetting 1 [ 240.371931][ T8572] netlink: 20 bytes leftover after parsing attributes in process `syz.1.974'. [ 240.396197][ T6825] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 240.436128][ T6825] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 240.463654][ T6825] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 240.495668][ T6825] usb 3-1: media controller created [ 240.599726][ T6825] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 240.663037][ T8578] tipc: Enabled bearer , priority 0 [ 240.683304][ T8578] syzkaller0: MTU too low for tipc bearer [ 240.697027][ T8578] tipc: Disabling bearer [ 240.722432][ T8578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.976'. [ 240.742484][ T8578] netlink: 'syz.3.976': attribute type 10 has an invalid length. [ 240.766896][ T8578] netlink: 12 bytes leftover after parsing attributes in process `syz.3.976'. [ 240.818218][ T8559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 240.852452][ T8559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 240.867464][ T8578] geneve2: entered promiscuous mode [ 240.886791][ T8578] geneve2: entered allmulticast mode [ 241.066560][ T6825] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 241.085997][ T6825] zl10353_read_register: readreg error (reg=127, ret==-71) [ 241.119748][ T6825] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 241.131626][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 241.271968][ T1238] usbhid 1-1:0.0: can't add hid device: -71 [ 241.300631][ T1238] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 241.331423][ T1238] usb 1-1: USB disconnect, device number 28 [ 241.390511][ T6825] usb 3-1: USB disconnect, device number 20 [ 241.846804][ T8593] bridge0: port 2(bridge_slave_1) entered disabled state [ 241.855183][ T8593] bridge0: port 1(bridge_slave_0) entered disabled state [ 241.939925][ T8597] netlink: 16 bytes leftover after parsing attributes in process `syz.2.983'. [ 242.067494][ T8593] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 242.103558][ T8593] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 242.418885][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.438009][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.463821][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.494425][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.621641][ T8604] FAULT_INJECTION: forcing a failure. [ 242.621641][ T8604] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 242.636904][ T8604] CPU: 1 UID: 0 PID: 8604 Comm: syz.2.985 Tainted: G L syzkaller #0 PREEMPT(full) [ 242.636938][ T8604] Tainted: [L]=SOFTLOCKUP [ 242.636945][ T8604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 242.636958][ T8604] Call Trace: [ 242.636966][ T8604] [ 242.636975][ T8604] dump_stack_lvl+0xe8/0x150 [ 242.637011][ T8604] should_fail_ex+0x40c/0x560 [ 242.637042][ T8604] _copy_from_user+0x2d/0xb0 [ 242.637076][ T8604] copy_uabi_to_xstate+0x4d3/0xa10 [ 242.637116][ T8604] ? __pfx_copy_uabi_to_xstate+0x10/0x10 [ 242.637143][ T8604] ? __might_fault+0xaf/0x130 [ 242.637174][ T8604] ? fpu__restore_sig+0xc25/0x1200 [ 242.637201][ T8604] ? fpu__restore_sig+0xc25/0x1200 [ 242.637227][ T8604] ? __local_bh_enable_ip+0xd0/0x130 [ 242.637249][ T8604] ? x86_task_fpu+0x4c/0x90 [ 242.637275][ T8604] fpu__restore_sig+0x1092/0x1200 [ 242.637308][ T8604] ? fpu__restore_sig+0xc25/0x1200 [ 242.637338][ T8604] ? __lock_acquire+0x683/0x2cf0 [ 242.637368][ T8604] ? __pfx_fpu__restore_sig+0x10/0x10 [ 242.637422][ T8604] ia32_restore_sigcontext+0x40c/0x560 [ 242.637455][ T8604] ? __pfx_ia32_restore_sigcontext+0x10/0x10 [ 242.637501][ T8604] ? _raw_spin_unlock_irq+0x23/0x50 [ 242.637545][ T8604] __ia32_compat_sys_rt_sigreturn+0x1ad/0x270 [ 242.637578][ T8604] ? __task_pid_nr_ns+0x28/0x470 [ 242.637611][ T8604] ? __pfx___ia32_compat_sys_rt_sigreturn+0x10/0x10 [ 242.637649][ T8604] ? asm_int80_emulation+0x1a/0x20 [ 242.637676][ T8604] do_int80_emulation+0x19a/0x550 [ 242.637699][ T8604] ? trace_irq_disable+0x3b/0x140 [ 242.637725][ T8604] ? asm_int80_emulation+0x1a/0x20 [ 242.637746][ T8604] ? clear_bhb_loop+0x40/0x90 [ 242.637767][ T8604] ? clear_bhb_loop+0x40/0x90 [ 242.637793][ T8604] asm_int80_emulation+0x1a/0x20 [ 242.637814][ T8604] RIP: 0023:0xf700f0ec [ 242.637834][ T8604] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 242.637852][ T8604] RSP: 002b:00000000f53fd50c EFLAGS: 00000206 [ 242.637871][ T8604] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001 [ 242.637884][ T8604] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 242.637897][ T8604] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 242.637910][ T8604] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 242.637923][ T8604] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 242.637954][ T8604] [ 243.208841][ T8610] netlink: 4 bytes leftover after parsing attributes in process `syz.2.987'. [ 243.462501][ T6821] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 243.516281][ T8619] syzkaller1: entered promiscuous mode [ 243.522256][ T8619] syzkaller1: entered allmulticast mode [ 243.593602][ T8621] vivid-007: ================= START STATUS ================= [ 243.603301][ T8621] vivid-007: Enable Output Cropping: true [ 243.610530][ T8621] vivid-007: Enable Output Composing: true [ 243.618058][ T8621] vivid-007: Enable Output Scaler: true [ 243.623824][ T6825] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 243.624428][ T8621] vivid-007: Tx RGB Quantization Range: Automatic [ 243.639568][ T8621] vivid-007: Transmit Mode: HDMI [ 243.644878][ T8621] vivid-007: Hotplug Present: 0x00000000 [ 243.645133][ T6821] usb 3-1: Using ep0 maxpacket: 8 [ 243.650612][ T8621] vivid-007: RxSense Present: 0x00000000 [ 243.665527][ T6821] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 243.676047][ T8621] vivid-007: EDID Present: 0x00000000 [ 243.681540][ T8621] vivid-007: ================== END STATUS ================== [ 243.691635][ T6821] usb 3-1: config 179 has no interface number 0 [ 243.699275][ T9] IPVS: starting estimator thread 0... [ 243.699804][ T6821] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 243.721286][ T8621] netlink: 16 bytes leftover after parsing attributes in process `syz.1.992'. [ 243.733379][ T6821] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 243.750283][ T8621] syzkaller0: entered promiscuous mode [ 243.756129][ T8621] syzkaller0: entered allmulticast mode [ 243.757160][ T6821] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 243.779591][ T6821] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 243.794585][ T6821] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 243.803970][ T8623] IPVS: using max 25 ests per chain, 60000 per kthread [ 243.817388][ T6821] usb 3-1: config 179 interface 65 has no altsetting 0 [ 243.825201][ T6821] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 243.834623][ T6825] usb 1-1: Using ep0 maxpacket: 32 [ 243.840052][ T6821] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.861744][ T6825] usb 1-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 243.873370][ T6825] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.884717][ T6825] usb 1-1: Product: syz [ 243.888976][ T6825] usb 1-1: Manufacturer: syz [ 243.893899][ T6825] usb 1-1: SerialNumber: syz [ 243.925557][ T6825] usb 1-1: config 0 descriptor?? [ 243.940582][ T6821] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input12 [ 243.955678][ T6825] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 243.980973][ T6825] dvb-usb: bulk message failed: -22 (4/0) [ 244.001836][ T6825] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 244.017442][ T6825] dvb-usb: bulk message failed: -22 (5/0) [ 244.024657][ T6825] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 244.035253][ T4978] input input12: unable to receive magic message: -110 [ 244.065991][ T4978] input input12: unable to receive magic message: -32 [ 244.106497][ T6825] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 244.134523][ T6825] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 244.161767][ T6825] usb 1-1: media controller created [ 244.229008][ T6825] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 244.248816][ T8612] bond0: option arp_all_targets: invalid value (1073741824) [ 244.279902][ T8612] team_slave_1: Caught tx_queue_len zero misconfig [ 244.298963][ T6825] usb 1-1: selecting invalid altsetting 3 [ 244.318535][ T6825] ttusb2: set interface to alts=3 failed [ 244.357317][ T5711] usb 3-1: USB disconnect, device number 21 [ 244.357485][ C1] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 244.410226][ T6825] DVB: Unable to find symbol tda10086_attach() [ 244.426878][ T6825] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 244.438714][ T6825] dvb-usb: bulk message failed: -22 (4/0) [ 244.444740][ T6825] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 244.472624][ T6825] dvb-usb: bulk message failed: -22 (5/0) [ 244.500521][ T6825] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 244.515737][ T6825] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 244.587205][ T6825] usb 1-1: USB disconnect, device number 29 [ 244.701801][ T9] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 244.733031][ T6825] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 244.864326][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 244.880564][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 244.894699][ T9] usb 4-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 244.905903][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.927454][ T9] usb 4-1: config 0 descriptor?? [ 245.366644][ T9] hid_parser_main: 4007 callbacks suppressed [ 245.366671][ T9] hkems 0003:2006:0118.000A: unknown main item tag 0x1 [ 245.430396][ T9] hkems 0003:2006:0118.000A: hidraw0: USB HID v0.00 Device [HID 2006:0118] on usb-dummy_hcd.3-1/input0 [ 245.470138][ T9] hkems 0003:2006:0118.000A: no inputs found [ 245.482870][ T9] hkems 0003:2006:0118.000A: force feedback init failed [ 245.628315][ T9] usb 4-1: USB disconnect, device number 35 [ 245.875253][ T8648] ptrace attach of ""[8656] was attempted by "ci-upstream-kasan-gce-386/syz-executor exec"[8648] [ 246.111787][ T9] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 246.242170][ T9] usb 2-1: device descriptor read/64, error -71 [ 246.433388][ T8661] Set syz1 is full, maxelem 65536 reached [ 246.504078][ T9] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 246.531758][ T1238] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 246.651796][ T9] usb 2-1: device descriptor read/64, error -71 [ 246.693303][ T1238] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 246.716789][ T1238] usb 4-1: New USB device found, idVendor=0b05, idProduct=1abe, bcdDevice= 0.00 [ 246.738728][ T1238] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.763464][ T1238] usb 4-1: config 0 descriptor?? [ 246.773934][ T9] usb usb2-port1: attempt power cycle [ 246.785995][ T8668] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 246.931689][ T5711] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 247.016989][ T8668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.042150][ T8668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.064053][ T8668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.087135][ T8668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.101851][ T5711] usb 1-1: Using ep0 maxpacket: 32 [ 247.118180][ T5711] usb 1-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 247.137060][ T5711] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.149198][ T9] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 247.156964][ T5711] usb 1-1: Product: syz [ 247.161396][ T5711] usb 1-1: Manufacturer: syz [ 247.168966][ T5711] usb 1-1: SerialNumber: syz [ 247.179972][ T5711] usb 1-1: config 0 descriptor?? [ 247.191314][ T9] usb 2-1: device descriptor read/8, error -71 [ 247.204143][ T5711] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 247.212118][ T5711] dvb-usb: bulk message failed: -22 (4/0) [ 247.218002][ T5711] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 247.228414][ T5711] dvb-usb: bulk message failed: -22 (5/0) [ 247.237559][ T5711] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 247.277388][ T5711] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 247.315165][ T5711] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 247.333490][ T5711] usb 1-1: media controller created [ 247.391483][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.410589][ T5711] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 247.425574][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.437992][ T9] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 247.454795][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.483709][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.502924][ T5711] usb 1-1: selecting invalid altsetting 3 [ 247.510253][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.521721][ T9] usb 2-1: device descriptor read/8, error -71 [ 247.530571][ T5711] ttusb2: set interface to alts=3 failed [ 247.538453][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.561710][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.586198][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.602767][ T1238] asus 0003:0B05:1ABE.000B: unknown main item tag 0x0 [ 247.652577][ T9] usb usb2-port1: unable to enumerate USB device [ 247.670639][ T1238] asus 0003:0B05:1ABE.000B: hidraw0: USB HID v7f.fd Device [HID 0b05:1abe] on usb-dummy_hcd.3-1/input0 [ 247.724684][ T1238] usb 4-1: USB disconnect, device number 36 [ 247.759201][ T5711] DVB: Unable to find symbol tda10086_attach() [ 247.773110][ T5711] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 247.807290][ T5711] dvb-usb: bulk message failed: -22 (4/0) [ 247.813537][ T5711] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 247.825660][ T5711] dvb-usb: bulk message failed: -22 (5/0) [ 247.831465][ T5711] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 247.846146][ T5711] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 247.879847][ T8681] fido_id[8681]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 247.886795][ T5711] usb 1-1: USB disconnect, device number 30 [ 248.030908][ T5711] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 248.312357][ T8694] netlink: 42 bytes leftover after parsing attributes in process `syz.3.1013'. [ 248.438425][ T8700] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1014'. [ 248.616362][ T8702] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1015'. [ 248.701239][ T8702] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.710978][ T8702] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 249.014062][ T8711] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1018'. [ 249.587779][ T8725] FAULT_INJECTION: forcing a failure. [ 249.587779][ T8725] name failslab, interval 1, probability 0, space 0, times 0 [ 249.626844][ T8725] CPU: 1 UID: 0 PID: 8725 Comm: syz.2.1022 Tainted: G L syzkaller #0 PREEMPT(full) [ 249.626879][ T8725] Tainted: [L]=SOFTLOCKUP [ 249.626887][ T8725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 249.626900][ T8725] Call Trace: [ 249.626939][ T8725] [ 249.626949][ T8725] dump_stack_lvl+0xe8/0x150 [ 249.626987][ T8725] should_fail_ex+0x40c/0x560 [ 249.627018][ T8725] should_failslab+0xa8/0x100 [ 249.627051][ T8725] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 249.627076][ T8725] ? local_lock_release+0x9c/0x160 [ 249.627107][ T8725] ? __alloc_skb+0x1d7/0x7a0 [ 249.627136][ T8725] ? __alloc_skb+0x1d7/0x7a0 [ 249.627172][ T8725] __alloc_skb+0x1d7/0x7a0 [ 249.627208][ T8725] netlink_ack+0x136/0xb30 [ 249.627232][ T8725] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 249.627262][ T8725] ? ref_tracker_free+0x689/0x830 [ 249.627305][ T8725] ? __pfx_ref_tracker_free+0x10/0x10 [ 249.627331][ T8725] ? __asan_memcpy+0x40/0x70 [ 249.627364][ T8725] netlink_rcv_skb+0x2a4/0x4a0 [ 249.627387][ T8725] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 249.627420][ T8725] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 249.627455][ T8725] ? netlink_deliver_tap+0x2e/0x1b0 [ 249.627478][ T8725] ? netlink_deliver_tap+0x2e/0x1b0 [ 249.627506][ T8725] netlink_unicast+0x7bb/0x940 [ 249.627551][ T8725] netlink_sendmsg+0x813/0xb40 [ 249.627584][ T8725] ? __pfx_netlink_sendmsg+0x10/0x10 [ 249.627613][ T8725] ? aa_sock_msg_perm+0xf1/0x1b0 [ 249.627641][ T8725] ? __pfx_netlink_sendmsg+0x10/0x10 [ 249.627664][ T8725] sock_sendmsg_nosec+0x13a/0x180 [ 249.627696][ T8725] ____sys_sendmsg+0x54e/0x850 [ 249.627724][ T8725] ? __pfx_____sys_sendmsg+0x10/0x10 [ 249.627763][ T8725] ___sys_sendmsg+0x2a5/0x360 [ 249.627784][ T8725] ? __lock_acquire+0x683/0x2cf0 [ 249.627818][ T8725] ? __pfx____sys_sendmsg+0x10/0x10 [ 249.627840][ T8725] ? get_pid_task+0x20/0x1f0 [ 249.627869][ T8725] ? get_pid_task+0x20/0x1f0 [ 249.627897][ T8725] ? get_pid_task+0x20/0x1f0 [ 249.627957][ T8725] ? __fget_files+0x2a/0x420 [ 249.627984][ T8725] ? __fget_files+0x3a2/0x420 [ 249.628023][ T8725] __sys_sendmsg+0x177/0x240 [ 249.628048][ T8725] ? __pfx___sys_sendmsg+0x10/0x10 [ 249.628090][ T8725] __do_fast_syscall_32+0x23e/0x6f0 [ 249.628116][ T8725] ? do_fast_syscall_32+0x33/0x70 [ 249.628137][ T8725] ? lockdep_hardirqs_on+0x7a/0x110 [ 249.628158][ T8725] ? asm_int80_emulation+0x1a/0x20 [ 249.628179][ T8725] ? do_int80_emulation+0x29f/0x550 [ 249.628201][ T8725] ? trace_irq_disable+0x3b/0x140 [ 249.628231][ T8725] do_fast_syscall_32+0x33/0x70 [ 249.628255][ T8725] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 249.628282][ T8725] RIP: 0023:0xf700f0ec [ 249.628310][ T8725] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 249.628329][ T8725] RSP: 002b:00000000f53fd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 249.628352][ T8725] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080006040 [ 249.628367][ T8725] RDX: 0000000020040054 RSI: 0000000000000000 RDI: 0000000000000000 [ 249.628379][ T8725] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 249.628392][ T8725] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 249.628405][ T8725] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 249.628437][ T8725] [ 250.292832][ T8732] Invalid logical block size (65533) [ 250.477383][ T8721] Set syz1 is full, maxelem 65536 reached [ 250.618153][ T8741] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1028'. [ 251.315843][ T5770] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 251.481212][ T5770] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 251.510397][ T5770] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.535799][ T5770] usb 1-1: Product: syz [ 251.547417][ T5770] usb 1-1: Manufacturer: syz [ 251.556457][ T8764] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1036'. [ 251.561266][ T5770] usb 1-1: SerialNumber: syz [ 251.575756][ T8764] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1036'. [ 252.137105][ T5770] rtl8150 1-1:1.0: couldn't reset the device [ 252.167985][ T5770] rtl8150 1-1:1.0: probe with driver rtl8150 failed with error -5 [ 252.240384][ T5770] usb 1-1: USB disconnect, device number 31 [ 252.556888][ T8784] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1042'. [ 252.609197][ T8785] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1042'. [ 252.656109][ T8784] erspan0: entered promiscuous mode [ 252.714932][ T8784] macvtap1: entered promiscuous mode [ 252.741342][ T8784] macvtap1: entered allmulticast mode [ 252.765960][ T8784] erspan0: entered allmulticast mode [ 252.807225][ T8785] erspan0: left allmulticast mode [ 252.826709][ T8785] erspan0: left promiscuous mode [ 253.104966][ T8800] FAULT_INJECTION: forcing a failure. [ 253.104966][ T8800] name failslab, interval 1, probability 0, space 0, times 0 [ 253.167784][ T8800] CPU: 1 UID: 0 PID: 8800 Comm: syz.3.1045 Tainted: G L syzkaller #0 PREEMPT(full) [ 253.167819][ T8800] Tainted: [L]=SOFTLOCKUP [ 253.167827][ T8800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 253.167840][ T8800] Call Trace: [ 253.167852][ T8800] [ 253.167861][ T8800] dump_stack_lvl+0xe8/0x150 [ 253.167901][ T8800] should_fail_ex+0x40c/0x560 [ 253.167933][ T8800] should_failslab+0xa8/0x100 [ 253.167967][ T8800] __kmalloc_cache_noprof+0xa8/0x660 [ 253.167995][ T8800] ? sctp_v6_cmp_addr+0x2e/0xd0 [ 253.168028][ T8800] ? sctp_add_bind_addr+0x8c/0x370 [ 253.168057][ T8800] ? sctp_add_bind_addr+0x8c/0x370 [ 253.168095][ T8800] sctp_add_bind_addr+0x8c/0x370 [ 253.168131][ T8800] sctp_copy_local_addr_list+0x31a/0x4e0 [ 253.168166][ T8800] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 253.168198][ T8800] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 253.168232][ T8800] ? sctp_v6_is_any+0x64/0x80 [ 253.168266][ T8800] ? sctp_copy_one_addr+0x93/0x360 [ 253.168299][ T8800] sctp_bind_addr_copy+0xb3/0x3c0 [ 253.168330][ T8800] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 253.168366][ T8800] sctp_connect_new_asoc+0x2ff/0x6b0 [ 253.168394][ T8800] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 253.168426][ T8800] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 253.168450][ T8800] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 253.168472][ T8800] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 253.168498][ T8800] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 253.168522][ T8800] ? security_sctp_bind_connect+0x7e/0x2c0 [ 253.168557][ T8800] sctp_sendmsg+0x159b/0x2d00 [ 253.168596][ T8800] ? __pfx_sctp_sendmsg+0x10/0x10 [ 253.168627][ T8800] ? aa_sk_perm+0x6d5/0x900 [ 253.168667][ T8800] ? __might_fault+0xaf/0x130 [ 253.168696][ T8800] ? sock_rps_record_flow+0x19/0x350 [ 253.168732][ T8800] ? inet_sendmsg+0x298/0x320 [ 253.168767][ T8800] ? __pfx_inet_sendmsg+0x10/0x10 [ 253.168797][ T8800] sock_sendmsg_nosec+0x10e/0x180 [ 253.168830][ T8800] __sys_sendto+0x408/0x5a0 [ 253.168869][ T8800] ? __pfx___sys_sendto+0x10/0x10 [ 253.168915][ T8800] ? __fget_files+0x3a2/0x420 [ 253.168956][ T8800] ? ksys_write+0x242/0x270 [ 253.168996][ T8800] __ia32_sys_sendto+0xdd/0x100 [ 253.169034][ T8800] __do_fast_syscall_32+0x23e/0x6f0 [ 253.169059][ T8800] ? do_fast_syscall_32+0x33/0x70 [ 253.169082][ T8800] ? lockdep_hardirqs_on+0x7a/0x110 [ 253.169101][ T8800] ? asm_int80_emulation+0x1a/0x20 [ 253.169122][ T8800] ? do_int80_emulation+0x29f/0x550 [ 253.169144][ T8800] ? trace_irq_disable+0x3b/0x140 [ 253.169173][ T8800] do_fast_syscall_32+0x33/0x70 [ 253.169196][ T8800] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 253.169222][ T8800] RIP: 0023:0xf709f0ec [ 253.169242][ T8800] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 253.169261][ T8800] RSP: 002b:00000000f544b50c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 253.169284][ T8800] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080847fff [ 253.169299][ T8800] RDX: 0000000000034000 RSI: 0000000000000000 RDI: 000000008005ffe4 [ 253.169313][ T8800] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 253.169326][ T8800] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 253.169339][ T8800] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 253.169371][ T8800] [ 254.041249][ T8811] netlink: 'syz.3.1051': attribute type 8 has an invalid length. [ 254.053858][ T8811] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1051'. [ 254.215344][ T8815] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1052'. [ 254.228435][ T8817] netlink: 'syz.1.1054': attribute type 1 has an invalid length. [ 254.241679][ T8817] netlink: 'syz.1.1054': attribute type 2 has an invalid length. [ 254.271792][ T6825] usb 1-1: new low-speed USB device number 32 using dummy_hcd [ 254.423994][ T6825] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 254.438056][ T6825] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 254.471754][ T6825] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 254.495038][ T6825] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 254.518934][ T6825] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 254.535773][ T8822] FAULT_INJECTION: forcing a failure. [ 254.535773][ T8822] name failslab, interval 1, probability 0, space 0, times 0 [ 254.562540][ T6825] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 254.576763][ T8822] CPU: 0 UID: 0 PID: 8822 Comm: syz.1.1057 Tainted: G L syzkaller #0 PREEMPT(full) [ 254.576796][ T8822] Tainted: [L]=SOFTLOCKUP [ 254.576804][ T8822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 254.576817][ T8822] Call Trace: [ 254.576825][ T8822] [ 254.576842][ T8822] dump_stack_lvl+0xe8/0x150 [ 254.576880][ T8822] should_fail_ex+0x40c/0x560 [ 254.576911][ T8822] should_failslab+0xa8/0x100 [ 254.576943][ T8822] __kmalloc_cache_noprof+0xa8/0x660 [ 254.576973][ T8822] ? sctp_add_bind_addr+0x8c/0x370 [ 254.577001][ T8822] ? sctp_add_bind_addr+0x8c/0x370 [ 254.577037][ T8822] sctp_add_bind_addr+0x8c/0x370 [ 254.577072][ T8822] sctp_copy_local_addr_list+0x31a/0x4e0 [ 254.577105][ T8822] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 254.577137][ T8822] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 254.577169][ T8822] ? sctp_v6_is_any+0x64/0x80 [ 254.577203][ T8822] ? sctp_copy_one_addr+0x93/0x360 [ 254.577237][ T8822] sctp_bind_addr_copy+0xb3/0x3c0 [ 254.577268][ T8822] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 254.577307][ T8822] sctp_connect_new_asoc+0x2ff/0x6b0 [ 254.577334][ T8822] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 254.577382][ T8822] ? __local_bh_enable_ip+0xd0/0x130 [ 254.577406][ T8822] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 254.577431][ T8822] ? security_sctp_bind_connect+0x7e/0x2c0 [ 254.577466][ T8822] sctp_sendmsg+0x159b/0x2d00 [ 254.577504][ T8822] ? __pfx_sctp_sendmsg+0x10/0x10 [ 254.577535][ T8822] ? aa_sk_perm+0x6d5/0x900 [ 254.577575][ T8822] ? __might_fault+0xaf/0x130 [ 254.577605][ T8822] ? sock_rps_record_flow+0x19/0x350 [ 254.577643][ T8822] ? inet_sendmsg+0x298/0x320 [ 254.577677][ T8822] ? __pfx_inet_sendmsg+0x10/0x10 [ 254.577707][ T8822] sock_sendmsg_nosec+0x10e/0x180 [ 254.577747][ T8822] __sys_sendto+0x408/0x5a0 [ 254.577788][ T8822] ? __pfx___sys_sendto+0x10/0x10 [ 254.577840][ T8822] ? __fget_files+0x3a2/0x420 [ 254.577881][ T8822] ? ksys_write+0x242/0x270 [ 254.577922][ T8822] __ia32_sys_sendto+0xdd/0x100 [ 254.577959][ T8822] __do_fast_syscall_32+0x23e/0x6f0 [ 254.577984][ T8822] ? do_fast_syscall_32+0x33/0x70 [ 254.578006][ T8822] ? lockdep_hardirqs_on+0x7a/0x110 [ 254.578026][ T8822] ? asm_int80_emulation+0x1a/0x20 [ 254.578047][ T8822] ? do_int80_emulation+0x29f/0x550 [ 254.578068][ T8822] ? trace_irq_disable+0x3b/0x140 [ 254.578099][ T8822] do_fast_syscall_32+0x33/0x70 [ 254.578122][ T8822] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 254.578149][ T8822] RIP: 0023:0xf6fff0ec [ 254.578168][ T8822] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 254.578187][ T8822] RSP: 002b:00000000f53ed50c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 254.578209][ T8822] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 254.578223][ T8822] RDX: 0000000000000001 RSI: 0000000004000057 RDI: 0000000080000080 [ 254.578237][ T8822] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 254.578250][ T8822] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 254.578262][ T8822] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 254.578295][ T8822] [ 254.586371][ T6825] usb 1-1: config 168 interface 0 has no altsetting 0 [ 254.987819][ T6825] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 254.996021][ T6825] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 255.007490][ T6825] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 255.030988][ T6825] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 255.052596][ T6825] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 255.070914][ T6825] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 255.098660][ T6825] usb 1-1: config 168 interface 0 has no altsetting 0 [ 255.112783][ T8828] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1059'. [ 255.130894][ T6825] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 255.141148][ T6825] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 255.153423][ T6825] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 255.169493][ T8828] tipc: Enabling of bearer rejected, failed to enable media [ 255.181622][ T6825] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 255.200041][ T6825] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 255.237844][ T6825] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 255.264754][ T6825] usb 1-1: config 168 interface 0 has no altsetting 0 [ 255.285875][ T6825] usb 1-1: string descriptor 0 read error: -22 [ 255.292322][ T6825] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 255.302037][ T6825] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.331235][ T6825] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 255.462140][ T5697] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 255.554754][ T5711] usb 1-1: USB disconnect, device number 32 [ 255.631711][ T5697] usb 4-1: Using ep0 maxpacket: 16 [ 255.658969][ T5697] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.682546][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.688964][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.706143][ T5697] usb 4-1: config 0 interface 0 has no altsetting 0 [ 255.713529][ T5697] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 255.723894][ T5697] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.750002][ T5697] usb 4-1: config 0 descriptor?? [ 255.758244][ T8809] adutux: No device or device unplugged -19 [ 255.948735][ T8839] syzkaller1: entered allmulticast mode [ 256.226411][ T5697] mcp2221 0003:04D8:00DD.000C: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 256.326163][ T8844] netlink: 27 bytes leftover after parsing attributes in process `syz.4.1062'. [ 256.360700][ T8844] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 256.660761][ T5639] Bluetooth: hci1: unexpected event for opcode 0x0000 [ 256.679281][ T8849] netlink: 'syz.1.1063': attribute type 8 has an invalid length. [ 256.724720][ T8849] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1063'. [ 256.835752][ T8828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.845593][ T8828] 8021q: adding VLAN 0 to HW filter on device team0 [ 256.874287][ T8828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 256.993179][ T8828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 257.009211][ T8828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 257.028076][ T8828] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 257.038952][ T8828] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 257.042671][ T6821] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 257.070307][ T8828] veth0_virt_wifi: left promiscuous mode [ 257.082864][ T8828] veth1_vlan: left promiscuous mode [ 257.090197][ T8828] veth0_vlan: left promiscuous mode [ 257.099973][ T8828] veth0_vlan: entered promiscuous mode [ 257.114131][ T8828] veth1_vlan: entered promiscuous mode [ 257.137599][ T8828] veth1_macvtap: left promiscuous mode [ 257.145877][ T8828] veth0_macvtap: left promiscuous mode [ 257.153512][ T8828] veth0_macvtap: entered promiscuous mode [ 257.163897][ T8828] veth1_macvtap: entered promiscuous mode [ 257.183592][ T8828] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 257.194406][ T8828] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 257.203784][ T8828] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 257.213809][ T8828] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 257.229582][ T6821] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 257.242480][ T6821] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.257706][ T8828] 8021q: adding VLAN 0 to HW filter on device bond1 [ 257.264662][ T6821] usb 3-1: Product: syz [ 257.270037][ T6821] usb 3-1: Manufacturer: syz [ 257.283814][ T6821] usb 3-1: SerialNumber: syz [ 257.288691][ T8828] hsr1: left promiscuous mode [ 257.299616][ T6821] usb 3-1: config 0 descriptor?? [ 257.308933][ T8828] 8021q: adding VLAN 0 to HW filter on device bond2 [ 257.327555][ T8828] vlan2: left promiscuous mode [ 257.335060][ T8828] bridge0: left promiscuous mode [ 257.353378][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 257.360611][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 257.386205][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 257.393487][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 257.547891][ T9] usb 4-1: USB disconnect, device number 37 [ 257.554323][ T6821] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 257.617685][ T1174] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.650658][ T1174] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.703868][ T1174] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.730181][ T1174] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.867627][ T12] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 258.152550][ T5770] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 258.165186][ T8877] FAULT_INJECTION: forcing a failure. [ 258.165186][ T8877] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 258.221337][ T8877] CPU: 1 UID: 0 PID: 8877 Comm: syz.1.1074 Tainted: G L syzkaller #0 PREEMPT(full) [ 258.221370][ T8877] Tainted: [L]=SOFTLOCKUP [ 258.221378][ T8877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 258.221391][ T8877] Call Trace: [ 258.221402][ T8877] [ 258.221411][ T8877] dump_stack_lvl+0xe8/0x150 [ 258.221448][ T8877] should_fail_ex+0x40c/0x560 [ 258.221480][ T8877] _copy_from_user+0x2d/0xb0 [ 258.221514][ T8877] get_compat_msghdr+0xb3/0x4c0 [ 258.221542][ T8877] ? __pfx_get_compat_msghdr+0x10/0x10 [ 258.221578][ T8877] ___sys_sendmsg+0x201/0x360 [ 258.221601][ T8877] ? __lock_acquire+0x683/0x2cf0 [ 258.221634][ T8877] ? __pfx____sys_sendmsg+0x10/0x10 [ 258.221655][ T8877] ? get_pid_task+0x20/0x1f0 [ 258.221683][ T8877] ? get_pid_task+0x20/0x1f0 [ 258.221710][ T8877] ? get_pid_task+0x20/0x1f0 [ 258.221768][ T8877] ? __fget_files+0x2a/0x420 [ 258.221795][ T8877] ? __fget_files+0x3a2/0x420 [ 258.221834][ T8877] __sys_sendmsg+0x177/0x240 [ 258.221859][ T8877] ? __pfx___sys_sendmsg+0x10/0x10 [ 258.221900][ T8877] __do_fast_syscall_32+0x23e/0x6f0 [ 258.221926][ T8877] ? do_fast_syscall_32+0x33/0x70 [ 258.221947][ T8877] ? lockdep_hardirqs_on+0x7a/0x110 [ 258.221976][ T8877] ? asm_int80_emulation+0x1a/0x20 [ 258.221997][ T8877] ? do_int80_emulation+0x29f/0x550 [ 258.222019][ T8877] ? trace_irq_disable+0x3b/0x140 [ 258.222049][ T8877] do_fast_syscall_32+0x33/0x70 [ 258.222074][ T8877] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 258.222100][ T8877] RIP: 0023:0xf6fff0ec [ 258.222119][ T8877] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 258.222138][ T8877] RSP: 002b:00000000f53ed50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 258.222161][ T8877] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 258.222176][ T8877] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 258.222188][ T8877] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 258.222200][ T8877] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 258.222213][ T8877] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 258.222245][ T8877] [ 258.504407][ T30] audit: type=1326 audit(1784742858.873:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.532643][ T5770] usb 1-1: device descriptor read/64, error -71 [ 258.567953][ T30] audit: type=1326 audit(1784742858.873:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.592491][ T30] audit: type=1326 audit(1784742858.913:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=286 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.618043][ T30] audit: type=1326 audit(1784742858.913:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.645473][ T30] audit: type=1326 audit(1784742858.913:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.670417][ T30] audit: type=1326 audit(1784742858.913:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=288 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.694928][ T30] audit: type=1326 audit(1784742858.913:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.722733][ T30] audit: type=1326 audit(1784742858.913:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=286 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.747796][ T30] audit: type=1326 audit(1784742858.913:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.772403][ T5770] usb 1-1: new full-speed USB device number 34 using dummy_hcd [ 258.830057][ T8885] netlink: 'syz.1.1078': attribute type 8 has an invalid length. [ 258.835416][ T30] audit: type=1326 audit(1784742858.913:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8880 comm="syz.4.1075" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=287 compat=1 ip=0xf706f0ec code=0x7ffc0000 [ 258.856683][ T8885] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1078'. [ 258.902846][ T5770] usb 1-1: device descriptor read/64, error -71 [ 258.978570][ T8856] netlink: 'syz.2.1066': attribute type 2 has an invalid length. [ 259.006834][ T6821] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 259.013767][ T5770] usb usb1-port1: attempt power cycle [ 259.047629][ T8892] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 259.054046][ T6821] usb 3-1: USB disconnect, device number 22 [ 259.121515][ T8892] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.371727][ T5770] usb 1-1: new full-speed USB device number 35 using dummy_hcd [ 259.392382][ T5770] usb 1-1: device descriptor read/8, error -71 [ 259.421855][ T9] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 259.574137][ T9] usb 2-1: config 1 has an invalid interface number: 7 but max is 0 [ 259.593968][ T9] usb 2-1: config 1 has no interface number 0 [ 259.605580][ T9] usb 2-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0x97, changing to 0x87 [ 259.619232][ T9] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 259.629875][ T9] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 259.640967][ T5770] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 259.652589][ T9] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 259.666318][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.677481][ T9] usb 2-1: Product: syz [ 259.681945][ T5770] usb 1-1: device descriptor read/8, error -71 [ 259.688691][ T9] usb 2-1: Manufacturer: syz [ 259.693564][ T9] usb 2-1: SerialNumber: syz [ 259.702166][ T8896] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 259.791939][ T5770] usb usb1-port1: unable to enumerate USB device [ 259.916156][ T9] usb 2-1: Error in usbnet_get_endpoints (-71) [ 259.945965][ T9] usb 2-1: USB disconnect, device number 22 [ 260.572966][ T8917] sctp: [Deprecated]: syz.1.1088 (pid 8917) Use of int in max_burst socket option. [ 260.572966][ T8917] Use struct sctp_assoc_value instead [ 260.604879][ T8919] capability: warning: `syz.4.1089' uses deprecated v2 capabilities in a way that may be insecure [ 261.132811][ T8930] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1092'. [ 261.350027][ T8939] fuse: Bad value for 'rootmode' [ 261.529791][ T8941] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1095'. [ 261.753885][ T8945] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 262.453389][ T8960] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1101'. [ 262.670273][ T8969] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1106'. [ 262.741151][ T8971] FAULT_INJECTION: forcing a failure. [ 262.741151][ T8971] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.761934][ T8971] CPU: 1 UID: 0 PID: 8971 Comm: syz.4.1107 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.761969][ T8971] Tainted: [L]=SOFTLOCKUP [ 262.761976][ T8971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 262.761989][ T8971] Call Trace: [ 262.761997][ T8971] [ 262.762006][ T8971] dump_stack_lvl+0xe8/0x150 [ 262.762043][ T8971] should_fail_ex+0x40c/0x560 [ 262.762073][ T8971] _copy_from_user+0x2d/0xb0 [ 262.762106][ T8971] get_compat_msghdr+0xb3/0x4c0 [ 262.762133][ T8971] ? __pfx_get_compat_msghdr+0x10/0x10 [ 262.762170][ T8971] ___sys_sendmsg+0x201/0x360 [ 262.762192][ T8971] ? __lock_acquire+0x683/0x2cf0 [ 262.762225][ T8971] ? __pfx____sys_sendmsg+0x10/0x10 [ 262.762251][ T8971] ? kstrtoull+0x12f/0x1d0 [ 262.762322][ T8971] ? __fget_files+0x2a/0x420 [ 262.762350][ T8971] ? __fget_files+0x3a2/0x420 [ 262.762390][ T8971] __sys_sendmmsg+0x2de/0x4d0 [ 262.762419][ T8971] ? __pfx___sys_sendmmsg+0x10/0x10 [ 262.762471][ T8971] ? fput+0xa0/0xd0 [ 262.762498][ T8971] ? ksys_write+0x242/0x270 [ 262.762546][ T8971] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 262.762574][ T8971] __do_fast_syscall_32+0x23e/0x6f0 [ 262.762600][ T8971] ? do_fast_syscall_32+0x33/0x70 [ 262.762622][ T8971] ? lockdep_hardirqs_on+0x7a/0x110 [ 262.762642][ T8971] ? asm_int80_emulation+0x1a/0x20 [ 262.762662][ T8971] ? do_int80_emulation+0x29f/0x550 [ 262.762689][ T8971] ? trace_irq_disable+0x3b/0x140 [ 262.762731][ T8971] do_fast_syscall_32+0x33/0x70 [ 262.762754][ T8971] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 262.762780][ T8971] RIP: 0023:0xf706f0ec [ 262.762800][ T8971] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 262.762818][ T8971] RSP: 002b:00000000f545d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 262.762840][ T8971] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001100 [ 262.762855][ T8971] RDX: 0000000000000001 RSI: 0000000000004010 RDI: 0000000000000000 [ 262.762867][ T8971] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 262.762879][ T8971] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 262.762892][ T8971] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 262.762922][ T8971] [ 263.518391][ T8989] netlink: 'syz.2.1113': attribute type 8 has an invalid length. [ 263.526361][ T5697] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 263.539866][ T8989] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1113'. [ 263.681788][ T5697] usb 2-1: Using ep0 maxpacket: 16 [ 263.689251][ T5697] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 263.701613][ T5697] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 263.731889][ T5697] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 263.753917][ T5697] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 263.778467][ T5697] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.808064][ T5697] usb 2-1: config 0 descriptor?? [ 264.068334][ T5697] microsoft 0003:045E:07DA.000D: unbalanced delimiter at end of report description [ 264.103037][ T5697] microsoft 0003:045E:07DA.000D: parse failed [ 264.118344][ T5697] microsoft 0003:045E:07DA.000D: probe with driver microsoft failed with error -22 [ 264.169028][ T5697] usb 2-1: USB disconnect, device number 23 [ 264.217738][ T9010] input: syz0 as /devices/virtual/input/input13 [ 264.475590][ T9000] Set syz1 is full, maxelem 65536 reached [ 264.588125][ T9003] Set syz1 is full, maxelem 65536 reached [ 265.158144][ T9023] sg_write: data in/out 19942/1 bytes for SCSI command 0x32-- guessing data in; [ 265.158144][ T9023] program syz.3.1124 not setting count and/or reply_len properly [ 265.207597][ T9026] netlink: 'syz.2.1125': attribute type 8 has an invalid length. [ 265.217829][ T9026] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1125'. [ 265.664466][ T9035] FAULT_INJECTION: forcing a failure. [ 265.664466][ T9035] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 265.714851][ T9035] CPU: 0 UID: 0 PID: 9035 Comm: syz.3.1128 Tainted: G L syzkaller #0 PREEMPT(full) [ 265.714887][ T9035] Tainted: [L]=SOFTLOCKUP [ 265.714895][ T9035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 265.714907][ T9035] Call Trace: [ 265.714914][ T9035] [ 265.714923][ T9035] dump_stack_lvl+0xe8/0x150 [ 265.714959][ T9035] should_fail_ex+0x40c/0x560 [ 265.714988][ T9035] _copy_from_user+0x2d/0xb0 [ 265.715022][ T9035] get_compat_msghdr+0xb3/0x4c0 [ 265.715049][ T9035] ? __pfx_get_compat_msghdr+0x10/0x10 [ 265.715084][ T9035] ___sys_sendmsg+0x201/0x360 [ 265.715105][ T9035] ? __lock_acquire+0x683/0x2cf0 [ 265.715145][ T9035] ? __pfx____sys_sendmsg+0x10/0x10 [ 265.715166][ T9035] ? get_pid_task+0x20/0x1f0 [ 265.715195][ T9035] ? get_pid_task+0x20/0x1f0 [ 265.715221][ T9035] ? get_pid_task+0x20/0x1f0 [ 265.715275][ T9035] ? __fget_files+0x2a/0x420 [ 265.715302][ T9035] ? __fget_files+0x3a2/0x420 [ 265.715341][ T9035] __sys_sendmsg+0x177/0x240 [ 265.715365][ T9035] ? __pfx___sys_sendmsg+0x10/0x10 [ 265.715406][ T9035] __do_fast_syscall_32+0x23e/0x6f0 [ 265.715433][ T9035] ? do_fast_syscall_32+0x33/0x70 [ 265.715455][ T9035] ? lockdep_hardirqs_on+0x7a/0x110 [ 265.715475][ T9035] ? asm_int80_emulation+0x1a/0x20 [ 265.715509][ T9035] ? do_int80_emulation+0x29f/0x550 [ 265.715530][ T9035] ? trace_irq_disable+0x3b/0x140 [ 265.715560][ T9035] do_fast_syscall_32+0x33/0x70 [ 265.715583][ T9035] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 265.715609][ T9035] RIP: 0023:0xf709f0ec [ 265.715628][ T9035] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 265.715647][ T9035] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 265.715669][ T9035] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 265.715684][ T9035] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 265.715696][ T9035] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 265.715709][ T9035] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 265.715721][ T9035] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 265.715751][ T9035] [ 265.992178][ T9037] syzkaller0: entered promiscuous mode [ 265.997705][ T9037] syzkaller0: entered allmulticast mode [ 266.563831][ T9043] binder: BINDER_SET_CONTEXT_MGR already set [ 266.584876][ T9043] binder: 9042:9043 ioctl 4018620d 80000100 returned -16 [ 266.638663][ T9043] binder: BINDER_SET_CONTEXT_MGR already set [ 266.664300][ T9043] binder: 9042:9043 ioctl 4018620d 80004a80 returned -16 [ 266.719468][ T9039] Set syz1 is full, maxelem 65536 reached [ 267.202445][ T5770] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 267.240955][ T9061] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 267.314627][ T9061] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1136'. [ 267.368108][ T9061] geneve2: entered promiscuous mode [ 267.373785][ T5770] usb 2-1: Using ep0 maxpacket: 16 [ 267.393589][ T9061] geneve2: entered allmulticast mode [ 267.394278][ T5770] usb 2-1: unable to get BOS descriptor or descriptor too short [ 267.430548][ T9061] batman_adv: batadv0: Adding interface: geneve2 [ 267.451639][ T9061] batman_adv: batadv0: Interface activated: geneve2 [ 267.456372][ T5770] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 267.458595][ T5770] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 267.458617][ T5770] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.458632][ T5770] usb 2-1: Product: syz [ 267.458644][ T5770] usb 2-1: Manufacturer: syz [ 267.458656][ T5770] usb 2-1: SerialNumber: syz [ 267.682963][ T9050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.683920][ T9050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.819401][ T5770] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 267.850834][ T5770] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 267.919170][ T5770] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 268.111514][ T9070] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1138'. [ 268.850468][ T9077] syzkaller0: entered promiscuous mode [ 268.872148][ T9077] syzkaller0: entered allmulticast mode [ 268.912906][ T9081] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1143'. [ 269.192542][ T5770] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 269.363515][ T5770] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 269.396157][ T5770] usb 1-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 269.439601][ T5770] usb 1-1: config 0 has no interface number 0 [ 269.474075][ T5770] usb 1-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 269.493212][ T5770] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.530698][ T5770] usb 1-1: Product: syz [ 269.547330][ T5770] usb 1-1: Manufacturer: syz [ 269.564244][ T5770] usb 1-1: SerialNumber: syz [ 269.601227][ T5770] usb 1-1: config 0 descriptor?? [ 269.690036][ T6821] usb 2-1: USB disconnect, device number 24 [ 269.832908][ T9077] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.868013][ T9077] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.882575][ T9092] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1145'. [ 269.940262][ T5770] uvcvideo 1-1:0.64: Found UVC 0.00 device syz (046d:0823) [ 269.970057][ T5770] uvcvideo 1-1:0.64: No valid video chain found. [ 270.029743][ T5770] usb 1-1: USB disconnect, device number 37 [ 270.105598][ T9088] Set syz1 is full, maxelem 65536 reached [ 270.424596][ T9103] netlink: 'syz.1.1148': attribute type 8 has an invalid length. [ 270.451641][ T9103] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1148'. [ 272.529567][ T9135] Set syz1 is full, maxelem 65536 reached [ 272.581705][ T5697] usb 1-1: new full-speed USB device number 38 using dummy_hcd [ 272.741673][ T9] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 272.763357][ T5697] usb 1-1: config 6 has an invalid interface number: 2 but max is 0 [ 272.773361][ T5697] usb 1-1: config 6 has no interface number 0 [ 272.783879][ T5697] usb 1-1: config 6 interface 2 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 272.801686][ T5697] usb 1-1: config 6 interface 2 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 272.818729][ T5697] usb 1-1: config 6 interface 2 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 272.841014][ T5697] usb 1-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 272.858289][ T5697] usb 1-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 272.872599][ T5697] usb 1-1: Product: syz [ 272.882715][ T5697] usb 1-1: Manufacturer: syz [ 272.889810][ T5697] usb 1-1: SerialNumber: syz [ 272.902082][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 272.911442][ T5697] hso 1-1:6.2: Failed to find INT IN ep [ 272.919529][ T5770] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 272.930709][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 272.957729][ T9] usb 4-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=8a.0a [ 272.975916][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.996331][ T9] usb 4-1: Product: syz [ 273.006498][ T9] usb 4-1: Manufacturer: syz [ 273.013456][ T9] usb 4-1: SerialNumber: syz [ 273.027744][ T9] usb 4-1: config 0 descriptor?? [ 273.041477][ T9] xr_serial 4-1:0.0: failed to claim sibling interface: -16 [ 273.048956][ T9] xr_serial 4-1:0.0: probe with driver xr_serial failed with error -16 [ 273.093761][ T5770] usb 3-1: config 246 has an invalid interface number: 166 but max is 0 [ 273.102510][ T5770] usb 3-1: config 246 has an invalid descriptor of length 255, skipping remainder of the config [ 273.113742][ T5770] usb 3-1: config 246 has no interface number 0 [ 273.120389][ T5770] usb 3-1: config 246 interface 166 altsetting 118 endpoint 0xB has invalid wMaxPacketSize 0 [ 273.132433][ T5770] usb 3-1: config 246 interface 166 altsetting 118 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 273.146075][ T5770] usb 3-1: config 246 interface 166 has no altsetting 0 [ 273.158673][ T5770] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 9.63 [ 273.170157][ T5770] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.180310][ T5770] usb 3-1: Product: syz [ 273.186118][ T5770] usb 3-1: Manufacturer: syz [ 273.190789][ T5770] usb 3-1: SerialNumber: syz [ 274.191981][ T5770] usb 3-1: Cannot retrieve CPort count: -110 [ 274.201847][ T5770] usb 3-1: Cannot retrieve CPort count: -110 [ 274.208108][ T5770] es2_ap_driver 3-1:246.166: probe with driver es2_ap_driver failed with error -110 [ 274.232003][ T9155] syzkaller0: entered promiscuous mode [ 274.247581][ T9155] syzkaller0: entered allmulticast mode [ 274.271042][ T5697] usb 4-1: USB disconnect, device number 38 [ 274.292012][ T5770] usb 3-1: USB disconnect, device number 23 [ 274.305095][ T6821] usb 1-1: USB disconnect, device number 38 [ 274.402619][ T9162] netlink: 252 bytes leftover after parsing attributes in process `syz.1.1164'. [ 275.283742][ T9181] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 275.625806][ T9198] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1176'. [ 275.897401][ T9188] Set syz1 is full, maxelem 65536 reached [ 276.111902][ T9202] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1177'. [ 276.323380][ C0] Unknown status report in ack skb [ 276.433498][ T9210] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 276.699999][ T9216] bridge0: port 3(hsr0) entered blocking state [ 276.717815][ T9216] bridge0: port 3(hsr0) entered disabled state [ 276.725061][ T9216] hsr0: entered allmulticast mode [ 276.737726][ T9216] hsr_slave_0: entered allmulticast mode [ 276.754256][ T9222] netlink: 'syz.2.1184': attribute type 10 has an invalid length. [ 276.762498][ T9216] hsr_slave_1: entered allmulticast mode [ 276.775373][ T9216] hsr0: entered promiscuous mode [ 276.787786][ T9216] bridge0: port 3(hsr0) entered blocking state [ 276.796210][ T9216] bridge0: port 3(hsr0) entered forwarding state [ 276.809702][ T9218] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1185'. [ 276.830243][ T9222] bridge0: port 3(hsr0) entered disabled state [ 276.836770][ T9222] bridge0: port 2(bridge_slave_1) entered disabled state [ 276.844556][ T9222] bridge0: port 1(bridge_slave_0) entered disabled state [ 276.884573][ T9222] bridge0: port 3(hsr0) entered blocking state [ 276.892623][ T9222] bridge0: port 3(hsr0) entered forwarding state [ 276.899395][ T9222] bridge0: port 2(bridge_slave_1) entered blocking state [ 276.906770][ T9222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 276.914394][ T9222] bridge0: port 1(bridge_slave_0) entered blocking state [ 276.923183][ T9222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 276.949360][ T9222] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 276.981716][ T5711] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 277.158151][ T5711] usb 2-1: unable to get BOS descriptor or descriptor too short [ 277.169984][ T5711] usb 2-1: not running at top speed; connect to a high speed hub [ 277.193272][ T5711] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 277.218278][ T5711] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 277.244178][ T5711] usb 2-1: New USB device found, idVendor=041e, idProduct=3030, bcdDevice= 0.40 [ 277.261695][ T5711] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.283652][ T5711] usb 2-1: Product: syz [ 277.292535][ T5711] usb 2-1: Manufacturer: syz [ 277.302816][ T5711] usb 2-1: SerialNumber: syz [ 277.527384][ T9221] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1186'. [ 277.545720][ T9228] Set syz1 is full, maxelem 65536 reached [ 277.609056][ T9221] input: syz0 as /devices/virtual/input/input15 [ 277.641630][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 277.641649][ T30] audit: type=1326 audit(1784742878.003:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9220 comm="syz.1.1186" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fff0ec code=0x0 [ 277.883302][ T9238] syzkaller0: entered promiscuous mode [ 277.888871][ T9238] syzkaller0: entered allmulticast mode [ 277.934937][ T9242] netlink: 738 bytes leftover after parsing attributes in process `syz.3.1192'. [ 278.121698][ T6821] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 278.285812][ T6821] usb 4-1: Using ep0 maxpacket: 8 [ 278.295371][ T6821] usb 4-1: unable to get BOS descriptor or descriptor too short [ 278.314399][ T6821] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 278.322795][ T6821] usb 4-1: can't read configurations, error -71 [ 278.345998][ T9247] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1189'. [ 279.818375][ T5711] usb 2-1: unit 9 not found! [ 280.052572][ T5711] usb 2-1: USB disconnect, device number 25 [ 280.083274][ T9164] udevd[9164]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 281.287600][ T9247] team0: Port device team_slave_0 removed [ 281.883901][ T5770] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 282.074119][ T5770] usb 1-1: Using ep0 maxpacket: 32 [ 282.092303][ T5770] usb 1-1: unable to get BOS descriptor or descriptor too short [ 282.112127][ T5770] usb 1-1: config 7 has an invalid interface number: 187 but max is 0 [ 282.123376][ T5770] usb 1-1: config 7 has no interface number 0 [ 282.146726][ T5770] usb 1-1: config 7 interface 187 altsetting 6 endpoint 0x3 has invalid wMaxPacketSize 0 [ 282.168785][ T5770] usb 1-1: config 7 interface 187 altsetting 6 bulk endpoint 0x3 has invalid maxpacket 0 [ 282.196249][ T5770] usb 1-1: config 7 interface 187 has no altsetting 0 [ 282.213861][ T5770] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 282.229996][ T5770] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.247645][ T5770] usb 1-1: Product: syz [ 282.256220][ T5770] usb 1-1: Manufacturer: syz [ 282.267139][ T5770] usb 1-1: SerialNumber: syz [ 282.513551][ T5770] usb 1-1: Unknown endpoint type found, address 0x07 [ 282.525327][ T5770] usb 1-1: Not enough endpoints found in device, aborting! [ 282.778376][ T9281] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1197'. [ 282.852226][ T9308] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1205'. [ 282.941877][ C0] [ 282.944280][ C0] ============================================ [ 282.950447][ C0] WARNING: possible recursive locking detected [ 282.956629][ C0] syzkaller #0 Tainted: G L [ 282.962603][ C0] -------------------------------------------- [ 282.968743][ C0] syz.0.1197/9278 is trying to acquire lock: [ 282.974711][ C0] ffff888033161070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 282.983770][ C0] [ 282.983770][ C0] but task is already holding lock: [ 282.991125][ C0] ffff88805345d070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x3cd/0xcf0 [ 283.001398][ C0] [ 283.001398][ C0] other info that might help us debug this: [ 283.009459][ C0] Possible unsafe locking scenario: [ 283.009459][ C0] [ 283.016902][ C0] CPU0 [ 283.020184][ C0] ---- [ 283.023461][ C0] lock(&hsr->seqnr_lock); [ 283.027984][ C0] lock(&hsr->seqnr_lock); [ 283.032487][ C0] [ 283.032487][ C0] *** DEADLOCK *** [ 283.032487][ C0] [ 283.040620][ C0] May be due to missing lock nesting notation [ 283.040620][ C0] [ 283.048934][ C0] 11 locks held by syz.0.1197/9278: [ 283.054136][ C0] #0: ffff88803431aa68 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x27f/0xfd0 [ 283.063500][ C0] #1: ffffc90000007cc0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 [ 283.073528][ C0] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 [ 283.082702][ C0] #3: ffff88805345d070 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x3cd/0xcf0 [ 283.093423][ C0] #4: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb3/0x28c0 [ 283.102143][ T5697] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 283.102918][ C0] #5: ffffffff8eb59cc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3820 [ 283.120502][ C0] #6: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: bond_start_xmit+0xb4/0x19e0 [ 283.130003][ C0] #7: ffffffff8eb59cc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3820 [ 283.139917][ C0] #8: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x19d/0x1a30 [ 283.149140][ C0] #9: ffffffff8eb59cc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3820 [ 283.159064][ C0] #10: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 283.168296][ C0] [ 283.168296][ C0] stack backtrace: [ 283.174184][ C0] CPU: 0 UID: 0 PID: 9278 Comm: syz.0.1197 Tainted: G L syzkaller #0 PREEMPT(full) [ 283.174205][ C0] Tainted: [L]=SOFTLOCKUP [ 283.174211][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 283.174220][ C0] Call Trace: [ 283.174228][ C0] [ 283.174234][ C0] dump_stack_lvl+0xe8/0x150 [ 283.174258][ C0] print_deadlock_bug+0x279/0x290 [ 283.174283][ C0] __lock_acquire+0x24df/0x2cf0 [ 283.174307][ C0] ? __lock_acquire+0x683/0x2cf0 [ 283.174329][ C0] ? skb_network_protocol+0x234/0x400 [ 283.174346][ C0] ? hsr_dev_xmit+0x237/0x360 [ 283.174364][ C0] lock_acquire+0x106/0x350 [ 283.174387][ C0] ? hsr_dev_xmit+0x237/0x360 [ 283.174410][ C0] ? hsr_dev_xmit+0x237/0x360 [ 283.174428][ C0] _raw_spin_lock_bh+0x36/0x50 [ 283.174450][ C0] ? hsr_dev_xmit+0x237/0x360 [ 283.174468][ C0] hsr_dev_xmit+0x237/0x360 [ 283.174487][ C0] ? hsr_dev_xmit+0x2d/0x360 [ 283.174506][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 283.174527][ C0] __dev_queue_xmit+0x14c0/0x3820 [ 283.174544][ C0] ? lock_acquire+0x106/0x350 [ 283.174565][ C0] ? __lock_acquire+0x683/0x2cf0 [ 283.174585][ C0] ? __dev_queue_xmit+0x29b/0x3820 [ 283.174602][ C0] ? is_bpf_text_address+0x292/0x2b0 [ 283.174624][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 283.174645][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 283.174664][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 283.174685][ C0] ? br_nf_post_routing+0x150/0xee0 [ 283.174703][ C0] br_dev_queue_push_xmit+0x370/0x4b0 [ 283.174725][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 283.174747][ C0] NF_HOOK+0x360/0x3f0 [ 283.174767][ C0] ? __dev_queue_xmit+0x14c0/0x3820 [ 283.174784][ C0] ? NF_HOOK+0xa2/0x3f0 [ 283.174803][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 283.174824][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 283.174844][ C0] ? lock_acquire+0x106/0x350 [ 283.174867][ C0] br_forward_finish+0xd3/0x130 [ 283.174887][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 283.174908][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 283.174929][ C0] NF_HOOK+0x360/0x3f0 [ 283.174950][ C0] ? NF_HOOK+0xa2/0x3f0 [ 283.174969][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 283.174989][ C0] ? __asan_memcpy+0x40/0x70 [ 283.175005][ C0] ? __skb_clone+0x5c/0x6c0 [ 283.175021][ C0] ? br_handle_vlan+0x5e/0x530 [ 283.175041][ C0] __br_forward+0x397/0x540 [ 283.175060][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 283.175083][ C0] br_flood+0x3e6/0x8d0 [ 283.175107][ C0] ? br_dev_xmit+0x19d/0x1a30 [ 283.175122][ C0] br_dev_xmit+0x1235/0x1a30 [ 283.175138][ C0] ? br_dev_xmit+0x19d/0x1a30 [ 283.175155][ C0] ? __pfx_br_dev_xmit+0x10/0x10 [ 283.175169][ C0] ? netif_skb_features+0xc83/0x1410 [ 283.175185][ C0] ? __pfx___skb_get_hash_net+0x10/0x10 [ 283.175200][ C0] ? refcount_dec_and_test+0x43/0x80 [ 283.175221][ C0] ? __pfx_netif_skb_features+0x10/0x10 [ 283.175239][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 283.175260][ C0] __dev_queue_xmit+0x14c0/0x3820 [ 283.175281][ C0] ? __dev_queue_xmit+0x29b/0x3820 [ 283.175298][ C0] ? __lock_acquire+0x683/0x2cf0 [ 283.175318][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 283.175334][ C0] ? stack_trace_save+0xa9/0x100 [ 283.175353][ C0] ? unwind_next_frame+0x8f/0x2550 [ 283.175367][ C0] ? lock_acquire+0x106/0x350 [ 283.175394][ C0] ? netdev_lower_get_next_private_rcu+0x9f/0x100 [ 283.175418][ C0] ? bond_get_slave_by_id+0x589/0x590 [ 283.175435][ C0] ? __pfx_bond_get_slave_by_id+0x10/0x10 [ 283.175452][ C0] ? bond_start_xmit+0xb4/0x19e0 [ 283.175476][ C0] bond_start_xmit+0xd4f/0x19e0 [ 283.175502][ C0] ? bond_start_xmit+0xb4/0x19e0 [ 283.175524][ C0] ? __pfx_bond_start_xmit+0x10/0x10 [ 283.175549][ C0] ? __pfx_netif_skb_features+0x10/0x10 [ 283.175565][ C0] ? stack_trace_save+0xa9/0x100 [ 283.175584][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 283.175605][ C0] __dev_queue_xmit+0x14c0/0x3820 [ 283.175620][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 283.175637][ C0] ? vcpu_run+0x499b/0x77d0 [ 283.175656][ C0] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 283.175677][ C0] ? __dev_queue_xmit+0x29b/0x3820 [ 283.175695][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 283.175715][ C0] ? __copy_skb_header+0xa3/0x4a0 [ 283.175730][ C0] ? __asan_memcpy+0x40/0x70 [ 283.175746][ C0] ? __skb_clone+0x5c/0x6c0 [ 283.175761][ C0] ? __skb_clone+0x449/0x6c0 [ 283.175774][ C0] ? hsr_addr_subst_dest+0x30a/0xaa0 [ 283.175794][ C0] ? skb_clone+0x246/0x3a0 [ 283.175810][ C0] hsr_forward_skb+0x152a/0x28c0 [ 283.175834][ C0] ? kmem_cache_alloc_node_noprof+0x1f5/0x610 [ 283.175855][ C0] ? hsr_forward_skb+0xb3/0x28c0 [ 283.175878][ C0] ? __pfx_hsr_forward_skb+0x10/0x10 [ 283.175899][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 283.175918][ C0] ? __skb_pad+0x3f8/0x600 [ 283.175935][ C0] send_hsr_supervision_frame+0x733/0xcf0 [ 283.175959][ C0] ? __pfx_send_hsr_supervision_frame+0x10/0x10 [ 283.175981][ C0] hsr_announce+0x1db/0x370 [ 283.176000][ C0] ? hsr_announce+0x89/0x370 [ 283.176019][ C0] ? __pfx_hsr_announce+0x10/0x10 [ 283.176038][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 283.176056][ C0] call_timer_fn+0x192/0x5e0 [ 283.176077][ C0] ? __pfx_hsr_announce+0x10/0x10 [ 283.176096][ C0] ? call_timer_fn+0xd4/0x5e0 [ 283.176117][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 283.176142][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 283.176163][ C0] ? __pfx_hsr_announce+0x10/0x10 [ 283.176182][ C0] __run_timer_base+0x652/0x8b0 [ 283.176202][ C0] ? ktime_get+0x45/0x220 [ 283.176223][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 283.176244][ C0] ? ktime_get+0x1f5/0x220 [ 283.176262][ C0] ? lapic_next_event+0x11/0x20 [ 283.176287][ C0] run_timer_softirq+0xb7/0x170 [ 283.176307][ C0] handle_softirqs+0x225/0x840 [ 283.176325][ C0] ? __irq_exit_rcu+0xca/0x220 [ 283.176344][ C0] __irq_exit_rcu+0xca/0x220 [ 283.176361][ C0] irq_exit_rcu+0x9/0x30 [ 283.176376][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 283.176404][ C0] [ 283.176409][ C0] [ 283.176414][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 283.176431][ C0] RIP: 0010:vcpu_run+0x499b/0x77d0 [ 283.176450][ C0] Code: 4c 8b ac 24 20 01 00 00 4c 89 eb 48 c1 eb 03 42 0f b6 04 3b 84 c0 0f 85 30 16 00 00 41 c6 45 00 01 e8 59 de 86 00 fb 4c 89 f0 <48> c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 c2 36 ec 00 49 ff 06 [ 283.176463][ C0] RSP: 0018:ffffc90004c6f360 EFLAGS: 00000202 [ 283.176476][ C0] RAX: ffff88803431c720 RBX: 1ffff110068636be RCX: 0000000080000001 [ 283.176488][ C0] RDX: 0000000000000006 RSI: ffffffff8e22be89 RDI: ffffffff8c4bdb80 [ 283.176499][ C0] RBP: ffffc90004c6f730 R08: ffffffff905788f7 R09: 1ffffffff20af11e [ 283.176510][ C0] R10: dffffc0000000000 R11: fffffbfff20af11f R12: ffff88803431a9c0 [ 283.176521][ C0] R13: ffff88803431b5f2 R14: ffff88803431c720 R15: dffffc0000000000 [ 283.176547][ C0] ? vcpu_run+0x363a/0x77d0 [ 283.176580][ C0] ? __pfx_vcpu_run+0x10/0x10 [ 283.176597][ C0] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070 [ 283.176617][ C0] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070 [ 283.176636][ C0] ? fpu_swap_kvm_fpstate+0xcb/0x510 [ 283.176652][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 283.176671][ C0] kvm_arch_vcpu_ioctl_run+0x1193/0x2070 [ 283.176690][ C0] ? __lock_acquire+0x683/0x2cf0 [ 283.176713][ C0] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070 [ 283.176731][ C0] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 283.176751][ C0] ? rcu_is_watching+0x15/0xb0 [ 283.176773][ C0] ? trace_contention_end+0x3d/0x140 [ 283.176788][ C0] ? __mutex_lock+0x30d/0x1550 [ 283.176806][ C0] ? kvm_vcpu_ioctl+0x27f/0xfd0 [ 283.176822][ C0] ? __pfx___mutex_lock+0x10/0x10 [ 283.176839][ C0] ? kasan_quarantine_put+0xbb/0x1f0 [ 283.176860][ C0] kvm_vcpu_ioctl+0xa61/0xfd0 [ 283.176878][ C0] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 283.176892][ C0] ? do_vfs_ioctl+0x116f/0x1530 [ 283.176907][ C0] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 283.176926][ C0] ? hook_file_ioctl_compat+0x1f0/0x5f0 [ 283.176956][ C0] kvm_vcpu_compat_ioctl+0x204/0x390 [ 283.176974][ C0] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 283.176990][ C0] ? __fget_files+0x3a2/0x420 [ 283.177009][ C0] ? __fget_files+0x2a/0x420 [ 283.177029][ C0] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 283.177049][ C0] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 283.177065][ C0] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 283.177082][ C0] ? __se_sys_futex_time32+0x3ab/0x440 [ 283.177100][ C0] ? rcu_is_watching+0x15/0xb0 [ 283.177126][ C0] __do_fast_syscall_32+0x23e/0x6f0 [ 283.177142][ C0] ? do_fast_syscall_32+0x33/0x70 [ 283.177156][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 283.177170][ C0] ? irqentry_exit+0x10f/0x8f0 [ 283.177182][ C0] ? trace_irq_disable+0x3b/0x140 [ 283.177202][ C0] do_fast_syscall_32+0x33/0x70 [ 283.177218][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 283.177236][ C0] RIP: 0023:0xf70bf0ec [ 283.177249][ C0] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 283.177262][ C0] RSP: 002b:00000000f548c50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 283.177276][ C0] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000000ae80 [ 283.177286][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 283.177295][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 283.177303][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 283.177312][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 283.177330][ C0] [ 284.253303][ T9313] veth1_to_bond: Caught tx_queue_len zero misconfig [ 284.344919][ T5697] usb 4-1: config 1 has an invalid descriptor of length 239, skipping remainder of the config [ 284.389983][ T5697] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 284.448642][ T5697] usb 4-1: too many endpoints for config 1 interface 1 altsetting 1: 241, using maximum allowed: 30 [ 284.491087][ T5697] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 241 [ 284.632601][ T5697] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 284.661657][ T5697] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.825041][ T5697] usb 4-1: Product: syz [ 284.834274][ T5697] usb 4-1: Manufacturer: syz [ 284.843265][ T5697] usb 4-1: SerialNumber: syz [ 285.237093][ T5697] usb 4-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 285.273758][ T5697] usb 4-1: MIDIStreaming interface descriptor not found [ 285.318985][ T9] usb 1-1: USB disconnect, device number 39 [ 285.319868][ T5697] usb 4-1: 0:2 : does not exist [ 285.341983][ T5697] usb 4-1: unit 4 not found! [ 285.446959][ T5697] usb 4-1: USB disconnect, device number 41