last executing test programs: 7m16.495921892s ago: executing program 0 (id=358): ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000080)={[{0x9, 0x7, 0x3, 0x1c, 0x5, 0x2, 0x4e, 0x3, 0xf9, 0x1, 0x80, 0x9, 0x8002200000000000}, {0xfffffffb, 0x6, 0x8, 0xc4, 0x2, 0x17, 0xa, 0xf1, 0x7, 0xff, 0x41, 0x7d, 0x7}, {0xe2a5, 0x4, 0x1, 0x9, 0x2, 0x9, 0x6, 0x7, 0xff, 0x3, 0x3, 0x1, 0x131}], 0x4}) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000000a01080000000000000000070000000900010073797a30000000000c00044000000000000000044c00060098d560227defe8a9e949f23891071949edba7a5b59dc884427bff96fac71f2db1e12bcef82bf040f716d96376fac5d28236b656fa5044c44e4dd9a2b37a2fe55337e1029dd978eb454000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000c080003400000000808000440ffffff"], 0x17c}}, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x48010) ioctl$BTRFS_IOC_QGROUP_ASSIGN(0xffffffffffffffff, 0x40189429, 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 7m15.89441361s ago: executing program 0 (id=365): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="5500000018007f5f00fe01b2a4a2809302060000ff41fd01040400000a00120002002800000019002d4400009b84136ef75afb83de066a5900e1baac341b61130000f2ff00000100"/85, 0x55}], 0x1, 0x0, 0x0, 0x7a000000}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x95, 0x0, 0x21, 0x3, 0xfffffffe, 0x236, 0x800000000009, 0x8, 0xd861, 0x3}, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) clock_adjtime(0x0, &(0x7f0000000500)={0x7de, 0x6b, 0x0, 0x1000, 0x1, 0x9, 0x7, 0x6, 0x9, 0xffc99a3b00000000, 0x0, 0x7fff, 0x81, 0xfffffffffffffff9, 0x3, 0x6, 0x8000000000000001, 0x1000000004, 0x58fd, 0x3, 0x9, 0x2, 0x9, 0x6, 0xab, 0x5}) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x2]}, 0x8, 0x0) read$FUSE(r2, &(0x7f0000001b40)={0x2020}, 0x205c) ioctl$TFD_IOC_SET_TICKS(r2, 0x40085400, &(0x7f0000002080)=0x3) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6cb, 0x73f6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x20}}}}}]}}]}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io$hid(r3, 0x0, 0x0) gettid() r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x1}]}}, 0x0}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x517102, 0x20) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000071401000000000000000000050060"], 0x18}}, 0x0) recvmmsg(r1, &(0x7f0000004c00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)=""/26, 0x1a}, {&(0x7f0000000100)=""/246, 0x48}, {&(0x7f0000000200)=""/253, 0xfd}], 0x3, &(0x7f0000000340)=""/37, 0x25}, 0xff}, {{&(0x7f0000000380)=@nfc_llcp, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000400)=""/165, 0xa5}, {&(0x7f0000000600)=""/170, 0xaa}, {&(0x7f00000006c0)=""/252, 0xfc}, {&(0x7f00000007c0)=""/246, 0xf6}, {&(0x7f00000004c0)=""/16, 0x10}, {&(0x7f00000008c0)=""/89, 0x59}, {&(0x7f0000000940)=""/74, 0x4a}, {&(0x7f00000009c0)=""/107, 0x6b}], 0x8, &(0x7f0000000ac0)=""/141, 0x8d}, 0x74}, {{&(0x7f0000000b80)=@ieee802154, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000c00)=""/13, 0xd}, {&(0x7f0000000c40)=""/189, 0xbd}, {&(0x7f0000000d00)=""/28, 0x1c}, {&(0x7f0000000d40)=""/88, 0x58}], 0x4, &(0x7f0000000e00)=""/4096, 0x1000}, 0x80}, {{&(0x7f0000001e00)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000003200)=[{&(0x7f0000001e80)=""/133, 0x85}, {&(0x7f0000001f40)=""/20, 0x14}, {&(0x7f0000001f80)=""/177, 0xb1}, {&(0x7f0000002040)=""/7, 0x7}, {&(0x7f0000002080)}, {&(0x7f00000020c0)=""/4096, 0x1000}, {&(0x7f00000030c0)=""/170, 0xaa}, {&(0x7f0000003180)=""/120, 0x78}], 0x8}, 0x400}, {{&(0x7f0000003280)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f00000044c0)=[{&(0x7f0000003300)=""/29, 0x1d}, {&(0x7f0000003340)=""/219, 0xdb}, {&(0x7f0000003440)=""/95, 0x5f}, {&(0x7f00000034c0)=""/4096, 0x1000}], 0x4, &(0x7f0000004500)=""/186, 0xba}, 0x1}, {{0x0, 0x0, &(0x7f00000046c0)=[{&(0x7f00000045c0)=""/49, 0x31}, {&(0x7f0000004600)=""/136, 0x88}], 0x2, &(0x7f0000004700)=""/246, 0xf6}, 0x8001}, {{&(0x7f0000004800)=@alg, 0x80, &(0x7f0000004b40)=[{&(0x7f0000004880)=""/112, 0x70}, {&(0x7f0000004900)=""/96, 0x60}, {&(0x7f0000004980)=""/239, 0xef}, {&(0x7f0000004a80)=""/78, 0x4e}, {&(0x7f0000004b00)}], 0x5, &(0x7f0000004bc0)=""/20, 0x14}, 0xffffff7a}], 0x7, 0x20, &(0x7f0000004dc0)={0x0, 0x3938700}) 7m12.865787087s ago: executing program 0 (id=383): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000000), 0x4) (async) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000000), 0x4) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e010203010902"], 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[], 0xfe33) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB='quota,grpquota_inode_hardlimit=3,noswap']) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002c00ef5f"], 0x14}, 0x1, 0x0, 0x0, 0x20008081}, 0x800) (async) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002c00ef5f"], 0x14}, 0x1, 0x0, 0x0, 0x20008081}, 0x800) recvmmsg(r2, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x2, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000500), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000100)={{0x2, 0x0, 0x401000, 0x3, 0x4000}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f0000000780)={0x5, 0x20000006, 0x11080, 0x0, 0x4}) lchown(&(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0xee01) (async) lchown(&(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0xee01) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) (async) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) listen(r4, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) gettid() (async) gettid() socket$inet6_tcp(0xa, 0x1, 0x0) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r6, 0x6, 0x1c, 0x0, &(0x7f0000000000)) timer_create(0x4, &(0x7f0000533fa0)={0x0, 0x32, 0x4, @thr={&(0x7f0000000180)="de19418c4216bbbcb06268c403c51d1ef501d93b9627e3546e811fa74cff81b0779aae0c362d29dbe3214a97abd604bba7ef4c1a5c6dd8b03718b7a26e7239d6258c7cce494f6387be5299bf2bbbccf4babccd6a2e3af9784b4c77b2fd993220c6d043f96e5f45c6bbf03d7ab7b300bc2d717702106014cb25a6661c31886da912acbf7e391a3b770f69a4cd41cee1b82edefa85302daea5d361dbbb432da8d1", &(0x7f00000002c0)="326d371884002c52ef6380e3cc1bb706f51ce466"}}, &(0x7f00000000c0)=0x0) timer_settime(r7, 0x0, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) r8 = dup(r3) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x23) (async) r9 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x23) eventfd(0x8c66) (async) r10 = eventfd(0x8c66) ioctl$KVM_IOEVENTFD(r9, 0x4040ae79, &(0x7f0000000140)={0x3, 0x0, 0x1, r10, 0x11}) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000240)={0x6ddbfead, 0x0, 0x1, r10, 0x1}) (async) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000240)={0x6ddbfead, 0x0, 0x1, r10, 0x1}) 7m12.208023926s ago: executing program 0 (id=385): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x14, r1, 0x701, 0x74bd2b, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20004835}, 0x40084) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_filter={0x0, 0x1, 0x1, &(0x7f0000000080)={0xffff, 0x4, 0x1}}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01864c1, &(0x7f0000000100)={0x0, 0x0, 0xffffffffffffffff}) r5 = getpid() syz_pidfd_open(r5, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000400)={0x30c, 0x21, 0x0, 0x70bd26, 0x25dfdbfc, {0x18}, [@typed={0x8, 0xd0, 0x0, 0x0, @fd=r4}, @nested={0x1e7, 0x11f, 0x0, 0x1, [@nested={0x4, 0x13e}, @nested={0x4, 0xc9}, @nested={0x4, 0x5b}, @nested={0x4, 0x79}, @generic="576e0a68c919e7f7110f89ef3464fb1ffd00f3c6fe043389a2301c43c7d0041e2d392c08caac090d4227b0f121774c441efb7f2034c3691e24c4491e211e8031f41d7f066bfe5e6d1f535ada991acd76fdf2b0f05c4269cd6f1c7518c8355f4c5f49269bd8eea84598fe97b21910c54f7639ba4322637975bfd0fbe7618ddd6a1b407fd19a8d01f532a7aab8d481c74a4760183fe030f1cab46b1583e372e87177a426fb3de1c57cc67a53ca4a51ae8a4e5d989d1704e80739ca03cad77fcc7219e221e723c81512fee6c536013271a8bcacd64d69def0df3c8e5630f2e7a5b493f0a3d0121349f4a7d1a3cab866a41ea3154bd3131444", @typed={0x8, 0x6d, 0x0, 0x0, @pid=r5}, @nested={0x4, 0xaf}, @generic="87d63321936d659e9a6daf0fc751e55c04da5a855c8cddb12b1243b8637a605ba4bcb0ed2e3cbb2c3a89dd508a9c477a12758918d2deaab6e3e976115d476d772526db10942745ba4c986cb92d9b55d112aea73d5455799c29327715bd2f26873e98f36006b1122b277427b56da3d94aefa2f29ebe46b26f7c619b94819c77186479a3ae28a368d080efc364ffc260fd867e3bcdc11b600d25328dd2b98a3a7e1da6c348046c954826f46de56cedf0650dbd78854674eeb8acf7f56541602c935389dd08c519eeaf75886dd68e4ad04e"]}, @nested={0x105, 0x39, 0x0, 0x1, [@generic="067c6c03492eec91c62ae516262d6d8ab88e8795d71c437220b25b4fa7c200b653ec47e574b0e5f55e6a111783ca40feea5e1a414bc1b5964cfb9fda712edcbf20d5651e2aa01b554db9e99ff4ad873a7f9abcda009a7252e34f4105c26181b15ed1c9fbccdd9e41ec1b4d01a33661b977e7d224399fc895b1211bf1a1afccc653eb6c394d2e0ead728eb54bb8e1f9a6b29f63d6d305aa36526bd5b4fecd0362aba04cc60857a08831776b843e6fe8e25599700447b6e64ca7c810c46cc3681ad9c6f1ac457446c722872b16b9d6def46974c794a3ae731b3caf7d72e296bb652e9142047c370c4c3351213542d44b3071f72ec288", @typed={0x5, 0x92, 0x0, 0x0, @str='\x00'}, @nested={0x4, 0x3f}]}]}, 0x30c}, 0x1, 0x0, 0x0, 0x800}, 0x440c0) 7m12.101152759s ago: executing program 0 (id=388): socket$kcm(0x10, 0x400000002, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="2e00000010008188040f80ec59acbc0413a1f848000000005ea6aa36b303073a600f1ea2e4acf6f49dfaf61298ed0003d06fd98dbd3b3e6c174d979aeba1ebd90fa43f8237eab16139404300d1bd06d0ed13fc8f026846409b18fac5776547a44ce3cb929996c6dab6c40dc8f0103d2ad5e81ba26027f5a1afb2f97fe84802d5ff7bda1803431d4f92005a9a065fe7b6d710b6c5e4d739a92577127b15ff8d9a798dc312491a87848a16612b", 0xac}, {&(0x7f0000000180)="76f94049b5285fa7abd9c42dbff4b2aa18002ec782fc8dd27f4726", 0x1b}], 0x2}, 0x24000000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) recvmmsg$unix(r2, &(0x7f00000009c0)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000003900)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_WOWLAN(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000008ac0)=ANY=[], 0xff8}, 0x1, 0x0, 0x0, 0x2404e0d0}, 0x404c845) r3 = syz_open_dev$dri(&(0x7f00000005c0), 0x4a7, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f00000002c0)={0x2, 0x0, &(0x7f0000000080)=[0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r3, 0xc04064aa, &(0x7f000001f880)={0x0, &(0x7f0000000280)=[{}], r4, 0x0, '\x00', 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_ADDFB(r0, 0xc01c64ae, &(0x7f0000000000)={r4, 0x0, 0x5, 0x6, 0x1ff, 0xa, 0x3}) sendmsg$alg(r2, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401}, 0x844) mmap$fb(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000004, 0x11, r0, 0x6f000) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r5, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYRES16=r5], 0xfe33) 7m11.923237895s ago: executing program 0 (id=390): r0 = socket(0x40000000015, 0x805, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r2, 0x0) syz_open_procfs(r2, &(0x7f0000000140)='mounts\x00') getsockopt$inet6_int(r1, 0x29, 0x2, 0x0, &(0x7f0000000100)=0xa4) getsockopt(r0, 0x114, 0x2716, 0x0, &(0x7f0000000000)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x37) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x5, 0x7, 0xffffffff, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) sendmsg$NFNL_MSG_COMPAT_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000ff07000b01080000000000000000050000080c000100722a2d2a2a7b3af5"], 0x20}, 0x1, 0x0, 0x0, 0x22040007}, 0x6) 6m56.061136493s ago: executing program 32 (id=390): r0 = socket(0x40000000015, 0x805, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r2, 0x0) syz_open_procfs(r2, &(0x7f0000000140)='mounts\x00') getsockopt$inet6_int(r1, 0x29, 0x2, 0x0, &(0x7f0000000100)=0xa4) getsockopt(r0, 0x114, 0x2716, 0x0, &(0x7f0000000000)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x37) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x5, 0x7, 0xffffffff, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) sendmsg$NFNL_MSG_COMPAT_GET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000ff07000b01080000000000000000050000080c000100722a2d2a2a7b3af5"], 0x20}, 0x1, 0x0, 0x0, 0x22040007}, 0x6) 3m46.697983182s ago: executing program 2 (id=1468): r0 = socket(0x10, 0x3, 0x0) (async) r1 = socket(0x8000000010, 0x2, 0x0) write(r1, &(0x7f00000004c0)="fc0000001c000704ab5b2509b868030003ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400604033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177332e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd5339ec2a0f0d1bcae5fa0f5fcbbc7bc190bd06a76a715498fe9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd64338034a084f2013cd1890058a10000c880ac801fe4af", 0xfc) write(r0, &(0x7f00000000c0)="1c0000001d005f0214fffffffffffff8070000000d00000000005200", 0x1c) 3m46.645042123s ago: executing program 2 (id=1469): r0 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000004c0), 0x4) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000000040)=0x0) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000000040)=0x0) timer_settime(r4, 0x1, &(0x7f0000000140)={{0x77359400}, {0x0, 0x3938700}}, 0x0) timer_settime(r5, 0x0, &(0x7f00000003c0)={{}, {0x0, 0x989680}}, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r6, 0x89f2, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000400)={'syztnl2\x00', 0x0, 0x0, 0x7, 0x0, 0x402226, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @empty, @empty}}}}) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f00000005c0)='fd', 0x0, r2) r7 = socket$can_raw(0x1d, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r8 = socket(0x15, 0x5, 0x0) connect$l2tp6(r8, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x20) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000680)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) r9 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r9, &(0x7f0000000200)='./file1\x00', 0x800, 0x1) r10 = open(&(0x7f0000000480)='./bus\x00', 0x200000, 0x718bb647156ec307) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) linkat(r10, &(0x7f0000000100)='./file1\x00', r10, &(0x7f0000000180)='./file0\x00', 0x1000) getsockopt$CAN_RAW_FILTER(r7, 0x65, 0x7, 0x0, &(0x7f00000000c0)) r11 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)=ANY=[@ANYBLOB="1c0100002e000100000000000000000004001980080111800101cf80d478b585fcf4962925eb81095dd3d92e983e841d6ef7368187237f5e91a74d57e8aaee05ec63198f3bec68ef62803fe98daf2de4c76a713091d7d093f16995a391c42d5dfc312e9b67f3e831135df00a399b5234733f156436b0ed25721632972efdd7a775655ff99c2abdc650ece6458a5f9db07c36adc6ebcfe60b70e5a54a83041bc8e1c08dc0afd69868eddb1e9634f84ef01b3f9c31b8c76a0e2ac9dba5adc10a3c9a2360cbb39dd49895a112f947e4923d9b5c428a37b673f33f3ed02d225807d47efe0a590665b49bf5eaa0890c512f2a01eb6713c6b3539790dca05a2632596c591745bbbf4953c0a783a881f8cf755e6c00000008dd1a48f02b8b3f73ebb409ff89ec9eb434f24d5014c2845ab4f77a872b755b0409a89edb15593f595565fba8adfca4e443a66b20a2d322ddac799f"], 0x11c}], 0x1, 0x0, 0x0, 0x84}, 0x300) sendmsg$netlink(r0, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="34000000100001002bbd279311758cde1270bc99e871b07000fbdbdf2504005880040071801c00bc800400c380080013803a48ad040c002e085897d10fb35552a5ebe71b89cf6eb982779ad216d56b2227e3b3650c81fc81d7c979e9631da7a77b0e0d9f802a3068c8cf8c48ba"], 0x34}], 0x1, 0x0, 0x0, 0x8000}, 0x8880) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000440)={0x0, 0x14, "9913dbc98d009843af64476f995fcb849ad90f12"}) 3m46.371975163s ago: executing program 2 (id=1470): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x1, 0x608141) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000000904"], 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="cc01000002010102000000000000000002000002340010800800024000001c0008000340000000080800024000000008080002400007ff8008000340000000060800024000000003240002800c000280050001000100000014000180080001006401010208000200000000003800048034000380080002400000000705000100090000000800024000000b1c0800024000000b6d08000240000000020800024000000fff0600124000010000a0000280060003400004000006000340000300000c000280050001008d0000001400018008000100e0000001080002000a0101022c00018014000300fc020000000000000000000000000001140004000000000000000000000000000000000006000340000100000600034000030000140001800800010064010101080002006401010014000180080001006401010008000200"], 0x1cc}, 0x1, 0x0, 0x0, 0x4000044}, 0x34000080) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000140)={0x24, &(0x7f0000000000)={0x0, 0x23, 0x20, {0x20, 0xc, "32fcc58d09a7229288803f1a905c091ae7ccf940014664dd833cbbe32977"}}, &(0x7f0000000080)={0x0, 0x3, 0x16, @string={0x16, 0x3, "bf0a69a99cb7b16208a2968b3b60370d3a4357cd"}}, &(0x7f00000000c0)={0x0, 0x22, 0x26, {[@main=@item_012={0x0, 0x0, 0xb}, @global=@item_012={0x2, 0x1, 0xd, "3ded"}, @global=@item_4={0x3, 0x1, 0x1, "675423ac"}, @global=@item_4={0x3, 0x1, 0x2}, @global=@item_012={0x2, 0x1, 0x3, "3eee"}, @main=@item_4={0x3, 0x0, 0xc, "e6e25551"}, @main=@item_4={0x3, 0x0, 0xb, "ae28b041"}, @local=@item_4={0x3, 0x2, 0x9, "bee3772e"}, @main=@item_012={0x0, 0x0, 0xc}, @main=@item_4={0x3, 0x0, 0xa, "21947c95"}]}}, &(0x7f0000000100)={0x0, 0x21, 0x9, {0x9, 0x21, 0x8ff, 0x4, 0x1, {0x22, 0x50e}}}}, &(0x7f0000000400)={0x2c, &(0x7f0000000180)={0x40, 0x13, 0x94, "b40d2ca346752d8940d3516942951589224960a4c1471fe35cd66fef37c60a54c56db2271a1541e7d30d26e6f6ed945917493ae0c7e1e71ae5d83b3b6d2d7cabba9acc120c43634a5bd919f39723f5928d6f7c686d065dd02e59a02421bf93ef53cc06417879444a9a9f12e33771839ea126c2ee00683baaba17948dd0f05f060e843226999298567bb19d202e6813964159788d"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x9b}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0xf3}, &(0x7f0000000480)=ANY=[@ANYBLOB="2001c3000000fccce1cd34411d6d236ee3f14db19669791ace4295c7065b36d169d334b2868a8bc1087613154337b543212ff0303a62353fc2849d8e41f005c21ce2b4c330b5c41447fef2ba217dcef0c54b6aa03e5e2e0f834a238ea5009dfa3fccede81abd91ac2fbaf8f0216f8270da5531fcacdb0d6aa5495c44812cec0621b52b0a031bb9089dfccb9778c3d90b8ce2737bb23e6b4f511767b36216926d4e4c4470d5102b027e2ba7a3e6f73ac5b22fe84c6dbacb1602ec082c9e38227e94936f4c7e4068da4473d2e878b15fe0e3a004e08d7f8204ff988d9d57e8856b7de08bcfc298885ea4ac973ef195665d1c496169b734fba4e4eb16be4b3ce01f4e1725ae0cd277f024408360e0ab"], &(0x7f00000003c0)={0x20, 0x3, 0x1, 0x9}}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) 3m44.248085389s ago: executing program 2 (id=1481): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000380)=@riscv64_core={0x8030000000200006, &(0x7f00000001c0)=0x10000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300), 0x40, &(0x7f0000000340)={[{@redirect_dir_on}, {@workdir={'workdir', 0x3d, './file0/../file0'}}, {@index_on}]}) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000400)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8924, &(0x7f0000001300)={'nr0\x00'}) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9901) ioctl$KVM_CAP_X86_DISABLE_EXITS(r1, 0x4068aea3, &(0x7f0000000280)={0x8f, 0x0, 0xc}) mount$bind(&(0x7f0000000140)='./file0/file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x10a78c0, 0x0) 3m44.088019652s ago: executing program 2 (id=1482): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000021c0)='/proc/sysvipc/sem\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000080)=0x4) r1 = semget$private(0x0, 0x6, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = gettid() tkill(r3, 0x16) sendmsg$netlink(r2, &(0x7f0000001280)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000024000100000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="0b000080cbcdab1c51d930000800e000", @ANYRES32=r3, @ANYBLOB="34c0a217d3b0"], 0x2c}, {&(0x7f0000003300)=ANY=[@ANYBLOB="f01000003400000227bd7000fbdbdf25830089809e4f90a0255590ef4de7e905aafda38448e71425739313af8be3fb8a2e6d0a4d24a5456f8070f789dad83fb4871f3e999dd1435ccbb80df7d6d246a999a62ddad6e1f2929587d65d9ef7631b7bfa2b2dd5cb9bda9a31fe23117e63e62af5d6812f45ab728d7d9df58fed5ecbbe6ed33864d8fe18d9967108fa57726ef2334800d743223ef5a13dfb3531c40c0f96c7a62b62b9a585e450601394238f5494396fba2681e36526525fc28153b1541cdcf727116611b49286599cfa0403c0371d7c3b5b9502969bd5fe6db0d2651b57de5b7dfdf26b15f1d0755a1be7b5e249225e160aae729c5b3e71c1cf177d39b87314ea975ffa671fed7d1ed89c39a43597d4d219cd25605cd72fc43d69760a2b9886d68cc91685933a0631f8d549f268994536d8938eb286b257c49da17faf045d262e8140225b3bc22bc4c3a4caac334ac09a2308e7521983ecb86c82fada8de497c4c65c075c453f42e3d160c19c3b905ce9db8d113975550b25055eb9ff3ed6fb693a20df380ee54b26ff55d78066ee45dcd16b1efe4b908dc3fdb97bfb34e042883e2c734fe55cd70246965a706b4895329542ac61b0fe06a244343573c2a218ed91b8cc8577c6ba9721279c07a0593a53d12c8f278bf65af7849f17c26e53660a2d5c22f522a446e10d07bbacd9a0fe9c3453ffc767e493c1b4ee116af7700761049eb13d0294dbb563cfc4e528b58f93dd5501c08422badd7dd0460d45ddf6b0bef0d5db30168be6b9d4064764316f8cd35dd21fcefc023bc891e13ba26cbd9a89e36145b5609de2f59a2cf1e796cde87147564a12cfff306a9d4159a8f682be3ef61c86a2aa24110dfc7147c277ea42c269e05043593a4350f6d355afea1b40e466bc7e43c37ab06b74de29f7c7b0d3a8efa7fe76a8831d6a5c20908d5ec417237a05c42b26676fb5904e03d2927f3aeb5aa76e7a1231a29d20318c6e8f5a13957c6da237322e4c4eb7c2b210b732054c5d773a58af2b929539013378a85492c53f1ec27026c14e1c83f8ef0590915bab6b585727e6b05577d4ade60e9346848185b4125b8b74e756ed5ecb9178546c8757fd74be554630d13fc6ecf78fc7442664ae9eba89267b149a4c8268dbdf8c4c94ee438c027ca63d972f8444579c847da4d22c9a959c1d227d732a5e0082c748fb7fbc8427216df972d3e564fb8064476cae763790eed8cca34277f07cc89c8c6456785dd16f617b84079ddf484e760cd9ee748b4a8b32189ae93ceef521f4d3721943319a871751ea23e3871ef63114cb4ae3c1a26c46c1340954db4df8e8200acd1e4818ded4f1af6bdce86a564597f3b7ecadbdf603025fbc6d1ccb7836a1a6b5e2f8425833aa07b600880c206c262b958520a4d52be86dba6821be8525fde33e6a53fde9bf07977f2dcf4719d0871fba3db3fee9f6ecd245192fa3c5dbc72de66411622db81b8b60206ea966e52553dc743b78ec67586e46664631e29870b58c3a951581aa1a2c5cbbd5cee50de96e8910e7d2e48aaef943092543f4d1d87c6c3a112d56500c34e86b9b65618766f938815160dc843cbe58fc9af48f5eba492c3398f26d6ba912b18754e62c878c613f868fe8b8293682cb6bce4ed522d4def8bd708d8653c4f9d68ba8ab8faad734b8cea3cf7d7cb27edb0b79550667796a155db3c1d2d7e4028db14a5e0c36de3d906fc96c2aecd063f72d54d2ad18ae7743fb45e80046fad6b46c58380b5c9c5d25f9a572f3c3a78830aec839dfc95bcd2a0b2da3c1408809fd47c6e6d5a89f02a86990bb6d9f4f569b51bf4e82042b2e8e3550e5a086171e5fb4a889b75a5834d01e973fae7c6fde3e71d8a0afb2429d8e3524670b82a15aa1bf0f9ac3a7d88f77fc6156649d2d131b614c662a917941c6b0f797285c5f5ce0529d6bc775578d8fc7c58515ac3e6a0079e3efd2e8de646ef7d79791aec403ab4f8b6138b5c268e7e7bdbf6d8106f69419623473791b7ba4cb890b8ff6c0660610c26bd352c6a70b92520caba9d13824348c2b73d7a557f13cf5c43c76ef86634006faba4ed428e14deda19a9e7a267a7e2d13fa989a34b5ee4139cea570d800d676a249b9f19debce46d11b19e1e312a262792cdecfb5a056942d8a45adcb6bb8ccbe6bf394a6b0ebae9ae98274915dd895becef6b36d21f0826f8f5e4fba3283bc169319f7e21b3cf346e8a3e5d48b7b7f20bf59010e16c861ef72588326dec77df90dd5ded723aed9fa92f3ef5bc2c37d94c0c18b16f9cbfa4a166c35ac41eba96537b1b1337e7aaee18d142ea4750ff662478ea33ef2a029f33e30379e8b6e234ad4f83cbbd8aa70c4ffe91d0b6af1816dfaa86a4ea27cfd3e6987ad63b16ae848415de8a58c8b9e6d953eef046f2c54b63caccf32e11cc0a85db8ddb9a3bf9aedb2d9d1ded8439dd24979354782fe3596587497005b793f5a0d43b12badcf655a9b87f9dabb44d7fa6204273c43cf254bc41d98ea5a5c5ccc24df13b76fbb4ef22303138784442611aa3cc489d6e40dd326e55ea90463ad8071ce850242a836a1f5ac3343dcea5cac5b60c246e88655692e42903bdd6024f48de3799a41e4b38a7d5cb72707bc3a55b219e0b4d5a7015dc269a308e351529a3a1bfdeda388aa533d60c333808a8667ea65c2d0fe00392b6a62e03f69cf5f4f67a4338d581d99adbda0c3735c89dfd86fae0f760f630fd3fd1796cbf1fd117b47a143bfca798b4415d237e24b04d361dc979bc9c5fdd112d9ba9eae558322c6c9f49acf560d971b2b93395efaa7a2d5559b22dd3387af6dd6913e40d5b0da2e810d7ce0970d5f6d4b1adc7ee81939acdc133945450f03d9d4b7029da6444f67f0226a2e4c053af99e8bc5a37cac680875f51737ecfbe6c2cac95a05c47a08628899c227c9dddec721fa0d3ff6f105471eecf4ff8070bc31398fe1e9321e242a52cc38c31d5f299e2220df7c0a23313f0d6fc68c3da35de0694c12587e9be9c49a5fe54c6ca2656c50561053f491ec3c1caeac5ac538477849f0cde42402f915c63920f553bb16cd446244fb7b5c1648f24d79bf09d83e5906bfaed93bbe785130f3d5ee3d8d5d1da9dbefb97acaf7a46f36fd0683470e4b05a1e831ad454ee9cd1144dcb46e6308c48bee1d290464b0dbf8980fdf4c6fdfaaced12cfe249ae1068d39ad4c57d18466134d16eb4574da179e18e6d1187b5a16b5697ffbe557a2338a76ebb02e574536bc5c8f2944b1e5a5e027da5aa1bc77a56dbea6c03d55c5c052afbbf787e8999c9ca73348614d52dbbde14425fe73373bb9fa69b9354c128acf18a1cee5ca58b8326a9c2d0a18862f7a087b9243aaeebcba0a39d967f0561f202635478c9681e47dd4969ca4ac94015ee9bb307a758b51af0014b7a1115d0aa2b0ef03fcd93c257d34a9cf80af55768880097ba9244510d59d225ca050a42b6ce8baa3bd62bcb6bee6b59676132b6b11a8aa953eea20864ce4d20bcc6531bf6c23a18e2d9a4babc9d468bb33ac394f8fe243ddee9ace6aa4cb57ec8853cc550e86f12d79fa2d7f6d422eb5ddfc0a90150349115b2ace9bfcde3e13fcc1bb7c5b5ee3605d5c902c4d98b483ce47343acf533ce981403100d46bb1134b0b7bd93faf7de7f2bde70adfcbb94e6313aa60e230e342a7f5be2bdadd7de4238fce5f589e7851856cbe521838e382f2e22826c4155db1d2bf9f0fbbd010e17d7108a99aa95581cd3c4979815e87e5416f654c365813302e4e604a3e829810a506342dc386b3990f4197855feef705bce9304afea1315fc02d13cc076666c8f3ab0121ae4c9e68a5474766ef52a8458edf5d13f2f8255e009dcc09c8166451803bae8b505d154dfaab3b7696a0d864f70982df6cc7e9d9d5a6e43b79aef86bb54973736f8435fef3bbdf30af9f47b403d1451acece8fc96cd301ec2d477dec2e2f2dfe650441d66f78d3a98ab659090ba131f27a61e12a6ea86231157e45fad2b814467eab07aa4c8a05bdeff294b578fce773724e8fca57d167b6dc0bc9dde8441a389a907c3a132b5cd278f1c8c358fea76d783f7090ccdf8274bb9833c9da9515b29dafc58b0918f55b6b4afa55926216e8d07404f63d44e1b638281ec53a072fb8fcf24f9b19c7ebfdf272cbfa5df7e2f20e07acb20c477d5080c8a72d52cf74ff62a070172a18e64636a49370e079db7c292adee11393040271292b0f36e4ff7d3a2740b1f4818249dd5eb208fe143c0c740c8e8fc286fdea77aa577a76551324905bcbe6b311cb6170227d791a0abffcf37800de2339cbb4ced1fce704a7fdb10389714d2c2889bfd3e3ddf4ff599b3ea710997fc18fff208e5dc2266e3c619e161bf00fc5ba542c067d3a79a70c07a428c188f5451af5aa8847de1d084551f6f9647c09c48551d5f80bc1a7daf3d5303be4a2d865e2c659b1b605c584147a03cb5c9fcded5d0cd00d701c02100fcfe506d99847cc3b19c9c61d5d46610d3c55984d5cf6b3254fc081f17782d9e56812e9df34f691d8f2c5da6f56ee8a2c573a908659321ecb999589634b9a0f7bf53815c05143d6c927a117478511e2e92375257eabac1d5c0d8660f80e6d7e9b3136d64e586e0055ccc1cc766f570f3241009327a59ed15a0b5cd86eb01463a6a012c6c2bb8b13c7ddd3c7d7ea71251b2c6e4891e1a6266aa0bb0776178ac762baefa928e772ebf83251d537345d30ade4eb9bbc5d932afc0696c066c2ba2ff11ccd6600f5c5b5a9f6cddaffe8efc31a7f77295ec07cb1244ba44acffbe1ef4e5f1fc4892ee8dcc5727e1d76f7efd707f23a347cbb1151388c51100ac01067b607f465ad870e764f8f214f536aefba25554d900e84e5d1d2f808bb5bd3d5424881afa42817b4c81bdc2bcb4bcf60c7f31d02a3651a4821edaa6bb7a332afec3299d07900172612a040552ebc2c262f252e92e8db4c5a5ccb2593eb119d1773f8d2f3ea2974e9f0fe1245af7fbe4974ae542d2825e97136eb52be339771cd4ff125500840d9b2e54eab8c25809b02e3d8a603b237d9e6a3fa0d14775b48cbeb009856982772f4392b6c11e433854e6ec6e0f517e9dadcf46d420fb0874032726cba58f8294c201928e67d4017e138104215ad2831e6a8d7810a66f0577903f9831673f02a3de3b67dd9197646b70089ec0063a835d75a1165844562fa6bf7497246994bcdfc7ca051581aafd2302e4cc8551e1055bc4cc9cb7c959f89cc11fbc2ca7d0f1803c900c67c81509a78db1a933e7b132031dc391af0d5378cf3aa539c2359e7453e7f2ae8465b22bc68b7c46735652c19ce04841e714dc64abf3d35fe0a346b802219967595ecb04957fe25b04d6a414720280e40bf94362602972fddc13d0c5c1c7a4929b02d2e8a86fbfaa62cb6d76172f77e7ee434ef701bab7dd910bcc3037aafb0cb9b255bfc6c2ab40e75bdd444d3905046b1cd0af3a003e9a0fcb6436f58da31c02e0f861fdf5065b36d4e809dc71d7b2584bfecf12c45dfb054dc6fe4bdfa70b554d23ddbc89e1f26f15e04d1d0644d5638e18f8ed07e6243dcaa8b90a7c25343b6597d97589ba52d5ee255a9612778a6e71981718d601f6995bb1e051b72f6bf9856948878902c7a3af4dbcf95b5ed4b6bc6504b7c672a7ab3030541090da1ac980d4b2e7ccab145d758d6a2578fb8b63a5666e2cdcf6ecb5c9a13b32844541340c0a030397a628a4c9a42ef66f4eb8e7e5147831f9a47a65ff29359fbe943eb6b8ae00686c98b4ce064a326a43e67f49468d06139732d9377a5b7ee888498bed412f01c964ad0ab6bf997105ed67bd55e8736f814e022860160e7492ec48e628b604dc83d15b23ecd24dc2ce18ec5847e62a7f8ed2f418a04758e5950ad6c26b1aa3f88f40f1d86b3071348cb60f47dc9cb2d86a6b39eb77c8a8677c60a8fba671d1414dc3f454238f394656c9b30965366e1bdc9ca086086560ba2ca7b4f5f24283062aa9da23516beed05aef3f3012689ae0d8b721342ed2b1e19b24b32c764e20c084c05542add5c38dc9c1a7325f1fb08b725c53df8df2225d21ef8e011d1e92997101997c3e96cf0d000f10fd0a8df4a6d42343d2c075bb3000000a6ce27ae4fb6243919fedb63f9a3bf85f30ca3090c9a5db05acb49dae0d77aba29f44c10c10ed08ef6399070f143a708723d044df7c2864f606cf2737cda81f8a72bb776b2adec2df3e7d66d41dcd60051ce2c515aa11a5a3372e82e42770a8df87b2b90a325c899b05ac2147551cf5907165040887210b418c6df42f87c63ec3f9e5c5ea5d986c10e2f7e75ae06f4d3c045a1d41e10195ca78a4ef71185a2aaff1ea847d3646477acaa9905a1f2fdef7d00a16ba8f370dd86ae4930d469ece09fef5d297f6e926153cbf39bda35cc87fa979fc82a525ab6f730822d"], 0x10f0}], 0x2}, 0x0) semtimedop(r1, &(0x7f0000000040)=[{0x3, 0x1bf6, 0x1800}, {0x3}], 0x2, 0x0) read$FUSE(r0, &(0x7f000000a2c0)={0x2020}, 0x2020) 3m43.93454039s ago: executing program 2 (id=1484): r0 = shmget$private(0x0, 0xb000, 0x2, &(0x7f0000ff4000/0xb000)=nil) shmctl$IPC_INFO(r0, 0x3, &(0x7f0000000140)=""/202) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff}, 0x800) read$nci(r2, &(0x7f0000000300)=""/6, 0x6) fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000002c0)={{}, {0x1, 0x1}, [{0x2, 0x3, 0xee00}], {0x4, 0x5}, [], {0x10, 0x6}}, 0x2c, 0x3) (async) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000040)=""/135) (async) r3 = socket$phonet(0x23, 0x2, 0x1) setsockopt$sock_linger(r3, 0x1, 0x4a, &(0x7f0000000000)={0x0, 0x4}, 0x8) (async) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x7a, 0x101b01) ioctl$USBDEVFS_CLEAR_HALT(r4, 0x80045515, &(0x7f0000000240)={0x1, 0x1}) 3m43.745270527s ago: executing program 33 (id=1484): r0 = shmget$private(0x0, 0xb000, 0x2, &(0x7f0000ff4000/0xb000)=nil) shmctl$IPC_INFO(r0, 0x3, &(0x7f0000000140)=""/202) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff}, 0x800) read$nci(r2, &(0x7f0000000300)=""/6, 0x6) fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000002c0)={{}, {0x1, 0x1}, [{0x2, 0x3, 0xee00}], {0x4, 0x5}, [], {0x10, 0x6}}, 0x2c, 0x3) (async) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000040)=""/135) (async) r3 = socket$phonet(0x23, 0x2, 0x1) setsockopt$sock_linger(r3, 0x1, 0x4a, &(0x7f0000000000)={0x0, 0x4}, 0x8) (async) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x7a, 0x101b01) ioctl$USBDEVFS_CLEAR_HALT(r4, 0x80045515, &(0x7f0000000240)={0x1, 0x1}) 3m2.424647073s ago: executing program 4 (id=1708): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0xd) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_X2APIC_API(r1, 0x4068aea3, &(0x7f0000000080)={0x81, 0x0, 0x3}) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000100)={0xdddd1000, 0x100000, 0x2, 0x0, 0x4}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f0000000000)={0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000040)={r3, 0x0, 0x0, 0x9, 0x6}) 3m2.358606326s ago: executing program 4 (id=1709): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01082cba7000fedbdf250c0000001800058008000100756470"], 0x78}, 0x1, 0x0, 0x0, 0x24008000}, 0x8000) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000640)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0501ffffffff0a0000002e00000008000300", @ANYRESHEX=r2, @ANYBLOB="06003400c5f3000008004a000bec0f00180049"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x4004050) arch_prctl$ARCH_SHSTK_STATUS(0x5005, &(0x7f0000000000)) 3m2.16958668s ago: executing program 4 (id=1710): capset(&(0x7f0000000040)={0x20071026}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6, 0xfffffff9}) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x103001) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0xfffffffffffffffc, 0x6, 0xb0, @scatter={0x0, 0x40000000, 0x0}, &(0x7f0000000280)="a7c5264913cd", 0x0, 0x3, 0x10000, 0x22, 0x0}) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, 0x0, 0x5c) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000001a40)=[@in={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0x12}}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}}], 0x20) sendto$inet(r2, &(0x7f0000000800)='-', 0x1, 0x0, &(0x7f0000000040)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x44}}, 0x10) mkdir(&(0x7f0000000300)='./bus\x00', 0x5224ab994f6b661c) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(r3, r3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f00000089c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, r4}}}], 0x20}}], 0x1, 0x0) mount$overlay(0x0, &(0x7f0000000440)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000900)={[{@index_on}]}) 3m2.035830636s ago: executing program 4 (id=1711): socket$nl_crypto(0x10, 0x3, 0x15) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0xa5) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x100) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200) syz_open_dev$sg(&(0x7f00000002c0), 0xffffffffffffffff, 0x2080) r1 = socket$alg(0x26, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0) r3 = fanotify_init(0x200, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x2000008, &(0x7f0000000480)={[{@redirect_dir_off, 0x3a}], [], 0x2f}) socket$xdp(0x2c, 0x3, 0x0) fanotify_mark(r3, 0x1, 0x40000020, r2, &(0x7f00000000c0)='./file0\x00') bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="06000000a9474b3c816fae8e7de1887b148e5188ce5e89", @ANYRES16=r5, @ANYBLOB="719428bd7000fbdbdf254b00000008000300", @ANYRES32=r6, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x8000) r7 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x11a0}, 0x1, 0x0, 0x0, 0x8040}, 0x8080) recvmsg(r7, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000400)=""/128, 0x80}], 0x1}, 0x40) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000000)) r8 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r8, 0x40946400, 0x0) 3m1.881834406s ago: executing program 4 (id=1712): ioctl$IOCTL_VMCI_DATAGRAM_SEND(0xffffffffffffffff, 0x7ab, &(0x7f0000000280)={&(0x7f0000000780)={{@host, 0x4}, {@my=0x1, 0x800000}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c5fe68bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a437761ea75776763139fadd55c46daf5338870951822f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f5a5bb878281d0129afcfb8410cd1fa5acd080993d01084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6ea2e3856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316b20e0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8ba58502975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af05a0e8ae831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f329fd45ffa640f1b04efb38a36e0ed0fbabcb07e4ad88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1d97b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411d5f0e8ab2102a97e539c34e9c769a7dafb87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d86e3fccc39a5b694c18a4cc0d6af1e61d9c69e6466bc0cbef15365109e4f67a6268625f8c3f358fb7d567cbea52e1bc289bd8effda4e362a729e8cd3064970b97e3f72535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfdec3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f4fe1b3212a70f185ad71ec86b8c9"}, 0x418, 0x9}) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, 0x0) creat(0x0, 0x1c) r2 = open(0x0, 0x48141, 0x0) fcntl$setlease(r2, 0x400, 0x1) socket$can_j1939(0x1d, 0x2, 0x7) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000580)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0xc, "f50a5159"}]}}, 0x0}, 0x0) syz_usb_connect(0x5, 0xa2, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ba71d120410e4d53d658010203010902900001000000000904"], 0x0) syz_usb_ep_write(r0, 0x81, 0xffffff75, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2ea95f65bba452eae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c90679b4dd859ddc9e4800448aab0000000000000d75f34bb50d8d7084") 3m1.041274517s ago: executing program 4 (id=1715): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x2, 0xff, 0x71, 0x20, 0x9c4, 0x11, 0xb01c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x4, 0x10, 0x0, [{{0x9, 0x4, 0x7e, 0x10, 0x2, 0x26, 0xd5, 0x18, 0x8, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000004c0)={0x14, 0x0, &(0x7f0000000e00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) syz_usb_control_io$printer(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB='@!\f\x00\x00\x00\f!'], 0x0}, 0x0) 3m0.764984977s ago: executing program 34 (id=1715): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x2, 0xff, 0x71, 0x20, 0x9c4, 0x11, 0xb01c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x4, 0x10, 0x0, [{{0x9, 0x4, 0x7e, 0x10, 0x2, 0x26, 0xd5, 0x18, 0x8, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000004c0)={0x14, 0x0, &(0x7f0000000e00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) syz_usb_control_io$printer(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB='@!\f\x00\x00\x00\f!'], 0x0}, 0x0) 7.170868842s ago: executing program 6 (id=3257): r0 = fanotify_init(0x8, 0x400) write$binfmt_elf64(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="7f454c462200001c"], 0x40) r1 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r3, &(0x7f00000000c0)=""/55, 0x37) lseek(r3, 0x1000000, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000540), 0x6400, 0x0) ioctl$sock_ax25_SIOCDELRT(r4, 0x890c, &(0x7f0000000000)={@null, @bcast, 0x7, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @null]}) 7.099596566s ago: executing program 6 (id=3259): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000204c05d5030000000000010902240001000000000904000001030001000921000006012207000905810300"], 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f0000000080)={0x0, 0x0, 0x7, {0x7, 0xa, "392cdaab4a"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = fsopen(&(0x7f0000000140)='tracefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x8) fchdir(r6) r7 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) lseek(r7, 0x100, 0x0) syz_usb_connect$cdc_ncm(0x3, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0xcf, 0x10, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0xa}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x1, 0xbc6, 0x7}, {0x6, 0x24, 0x1a, 0x1800, 0x20}}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0xbd, 0x3, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x630, 0x3, 0x5, 0x7e}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0xd, 0x7, 0x4}}}}}}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x200, 0x0, 0xfa, 0xe, 0xff}, 0x162, &(0x7f0000000180)={0x5, 0xf, 0x162, 0x5, [@ssp_cap={0x24, 0x10, 0xa, 0x6, 0x6, 0x1, 0xf000, 0x6, [0xcf, 0xf, 0xff0000, 0xff00c0, 0xff0000, 0x0]}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x6, 0x4, 0xe06}, @ssp_cap={0x24, 0x10, 0xa, 0x6, 0x6, 0x7, 0xf00f, 0x6, [0xffff00, 0x0, 0xc000, 0xff000f, 0xf, 0xff00ff]}, @generic={0x103, 0x10, 0xa, "aec7e823b25388e4df9d1a75e5b1311059c2550dee71dc41f13d33a9101e9349b9ed7210f4aed117b6216339d3158e090167d489be3ae60b4fa2d1e483b9672815077942a4fb0c6b68ec0d35fdceed5ca6cfd0953bf45159a9950309c4adff0166e5cbfa1976cdbd4f8d25bbdb4fa9f7e389f88c5712ad58ea95b2cdd6ce2f095d84b1ee9438bdb148a5f79f19a9e5f9a440fa9677db2450e0c8e2a80cd5fc97b3b89fbcbfdca3d99ee2764578b3d9aa2598d44d2625920f2c56d8d21b139a2a30768b51446c2b48288d8f02e47bcb62727f9b115f0180779ef5db6e13faac1867fea72dead018c8302873d03bbb9628c194caa6353677a77f46a7f2a1a1f352"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x0, 0xf7, 0x40, 0xfffb, 0x3e}]}, 0x8, [{0x30, &(0x7f0000000300)=@string={0x30, 0x3, "2e42f81c5f4207b0bc71a79bfa79edc49502ad7078605be591af1f6e751c453694c0fe59137ec2df3f171757fd2a"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x2809}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x42d}}, {0x78, &(0x7f00000003c0)=@string={0x78, 0x3, "18e515d4f6d06c5213dd122643cf1dab1810b4dd198875d9b601142d972a3cd7ed7269171cb4d589f76fe2c5e41139a874640df998b92180f66b638898d4edeaa1675110050932cf9932295727b68c5d577515825c62be94dec3c64f9b62a6046e9f696d7d4029d5a9f879acdd511409a766c261629e"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x402}}, {0xc1, &(0x7f0000000480)=@string={0xc1, 0x3, "25c8b88eee4f9b1f08e74ad16cc3c123369aa7006f6c3de2b82ad6e0b17ca474dbfd29385d148c6343d40b79e9e231176582b4878cbeb969f1677b7e23a735b4a82c2223495a2836b155ba39b4f4e03f641a876abb88cebbf6e522517ec4505e77de8ab7bbe180931e5c4d50b6221acefc153551fac12c89c863ca6adfe109f0b84927267d319e072dbb193e0696a4384c8f25f28a1a263f86ed07d415e7d3cc7c4a87f2a79277418a8bd2687e368b7abe57edd084dceb9071b286c1f07da1"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x455}}, {0xa3, &(0x7f00000005c0)=@string={0xa3, 0x3, "9e7dea2e9780a57116bd040a99b5652c43cef473dbeb7d31f0d10559a11ed7501e6248bb919a216d3f3cac49865a5ae60ee59b035cae9f06db0b48984ac73cb294dc66ffb869a2cdd58d8b860354bfc5a727744562a3997c125bda1a91d6b60650fc73c0a8fa4dae193cd3874503ee951877a5310bbfa668663053ef31380502c67dfe9a462b90173f1dd061c127dedf408a527d2409b235564300e34a62869c1a"}}]}) 5.017802773s ago: executing program 3 (id=3273): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x10, 0x9, 0x0, 0xdf, 0x8, 0x22b8, 0x2d9a, 0xbfdc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xb, 0x7, 0x30, 0x7, [{{0x9, 0x4, 0x3e, 0x0, 0x0, 0x31, 0xc5, 0xe8, 0x4}}]}}]}}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r2, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000a00)={0x28, 0x7, r2, 0x0, &(0x7f00000a0000)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1000}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r0, 0x3ba0, &(0x7f0000000d40)={0x48, 0x7, r3, 0x0, 0x0, 0x0, 0x5, 0x1001}) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYRES8=r1], 0x0) timer_create(0x3, 0x0, &(0x7f00000001c0)=0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4}]}) socket$packet(0x11, 0xa, 0x300) timer_gettime(r5, &(0x7f0000000100)) restart_syscall() r6 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, &(0x7f00000000c0)={0x2, 0x0, 0x6, {0xeb, 0xfffffffd, 0x5, 0x7fffffff}}) syz_usb_control_io(r4, 0x0, 0x0) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000040)='S', 0x1}], 0x1) close(r7) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000180)={@multicast1, @broadcast, @remote}, 0xc) mbind(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, &(0x7f0000000200)=0x30000000000000, 0xf5, 0x1) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x38, r10, 0x1, 0x70bd29, 0x0, {{0x2}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x41, 0x60}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x39a}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x2e}]]}, 0x38}}, 0x0) ioctl$SIOCGSTAMP(r8, 0x8906, &(0x7f0000000000)) 4.522603318s ago: executing program 5 (id=3274): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) read(r0, &(0x7f0000000000)=""/168, 0xa8) r1 = syz_usb_connect$cdc_ecm(0x1, 0x5b, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x49, 0x1, 0x1, 0x7, 0x90, 0x4, [{{0x9, 0x4, 0x0, 0x1, 0x3, 0x2, 0x6, 0x0, 0x3, {{0x5}, {0x5, 0x24, 0x0, 0xd}, {0xd, 0x24, 0xf, 0x1, 0x5, 0xfff7, 0x1, 0xf}, [@obex={0x5, 0x24, 0x15, 0x60ca}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x400, 0x39, 0x7f, 0x5}}], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x8, 0x9, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x77, 0xd, 0x23}}}}}]}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x110, 0x8, 0x0, 0x10, 0x18, 0x3}, 0x48, &(0x7f0000000180)={0x5, 0xf, 0x48, 0x6, [@ptm_cap={0x3}, @ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x4, 0xf, 0x8, [0x3fcf, 0x3f00, 0xff0000]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x9, 0x5, 0xe3, 0x6}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xd, 0xe7, 0xc, 0x9}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0x1d, 0x27, 0x5}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0x4, 0x2, 0x5}]}, 0x2, [{0x9e, &(0x7f0000000200)=@string={0x9e, 0x3, "ccb5c4f63efe64dd8cdbbe6e36d49624639415952d768773532aba866a71f9cd22232c24ad3ef0aa575f90714f5828132b127c77ba75ff2d50ccd7e78408e3ebeae0a16470674015198e8540f865ca07ce8d6a3425527ce4e18814ceef37f26b6698c588931d969f8e3e9110f863c320613da68535a9e3dd8d8b79159a4987207849cbfb7c131ca1aac7a6fe8aa1c30efcfe65117482d3ee1faf81bb"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x1c3d}}]}) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000003c0)={0x14, &(0x7f0000000340)={0x40, 0x7, 0x2c, {0x2c, 0x30, "0ef44d4840a5d6f9460fd2d5b434df789d61e915e72b156deb6f3960d58ef36d8a7c957c8454a38ede20"}}, &(0x7f0000000380)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000580)={0x1c, &(0x7f0000000400)={0x20, 0x16, 0xc0, "d669cea61e1c373955146615391f112dc354d3912428f51e4e583d7f603b4edbcbf22242e7fa472a668aaaad28b59c9cd22bbaf139b395812a09fc91b89e2fa792b1f0d143023df4f13a36f9eb0636284c391f5126280aa6d404992ab294aa35aa3f515454772f83dca925dd3f2708431fdafbaf04cb348c7c1f982f5c53fb0e101d19aa203d2d68330577c675d85ab8e65d365c9864e9cc9e7b330a9f1923b1206e706b514a7972396690d433962ead26c64d0da9666ddaa9e5281271bcf6cf"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0xf4}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x7}}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0), 0x214000, 0x0) write$ppp(r2, &(0x7f0000000600)="d047acc42e4edeb121e6e357962239b26170f93b41ee94fb447feaaebae0e366ca3b723786cfdbe2a133ec04d911b3876d5c968532e30d98195435db8817ec2b11e181bc246075181d82298deabaf29152b8391184d29035795aa7462f6ee1b7e35022ba97f9226909f1abb13908d938bdeffaef2a049b06d814ddc05cfca0cb3799afbfdf0a32a9fe690cdbbee92851fecc5101ed65f8ee773a8c2054235ca0a73114a716c9fa3c60e9f091a44510531de5182be53f9acdffecbb9c91cab4d36d099e3fc46ca09602f6843941816bde9ffe555dc7b3c54db504de1da1ca31fa0a23cf97a765daac5c3b73b2fe76c14542ca", 0xf2) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000700)=0x1) getsockopt$sock_buf(r0, 0x1, 0x3d, &(0x7f0000000740)=""/142, &(0x7f0000000800)=0x8e) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000840), 0x40200, 0x0) ioctl$SNDCTL_TMR_START(r3, 0x5402) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000880), 0x80000, 0x0) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f00000008c0)) ioctl$SIOCGETMIFCNT_IN6(r4, 0x89e0, &(0x7f0000000900)={0xffffffffffffffff}) write$P9_RFLUSH(r4, &(0x7f0000000940)={0x7, 0x6d, 0x1}, 0x7) sendmsg$NFT_MSG_GETTABLE(r4, &(0x7f0000000a40)={&(0x7f0000000980), 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x40, 0x1, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r4, 0xc008ae67, &(0x7f0000000a80)={0x8, 0x9}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b00), r4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000b40)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEAUTHENTICATE(r4, &(0x7f0000000c80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000b80)={0xa4, r5, 0x100, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SSID={0x20, 0x34, @random="4dedaf4f035547e335f647f123bdcb457d36b50855fd5c5ba36a6c15"}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1}, @NL80211_ATTR_IE={0x5f, 0x2a, [@chsw_timing={0x68, 0x4, {0x9, 0x6}}, @channel_switch={0x25, 0x3, {0x1, 0x80, 0x4}}, @measure_req={0x26, 0x11, {0x0, 0xd, 0x2, "f530962fd0d757b3233c1cfba738"}}, @tim={0x5, 0x38, {0x7, 0x72, 0xf4, "c11da3a65cd98a741e4b83d3f3a8f5cd3bc1157aa26b35bd79d82ebeb17f4fb0a2af978d31b6bff481acf927659ed8e366fba8d1f4"}}, @erp={0x2a, 0x1, {0x0, 0x1, 0x1}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x24000044}, 0x1) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), r4) sendmsg$TIPC_NL_MEDIA_GET(r4, &(0x7f0000001180)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001140)={&(0x7f0000000d40)={0x3ec, r7, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xe0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6dd4}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x48}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb754}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_MEDIA={0x80, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}]}, @TIPC_NLA_NODE={0x17c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x7d, 0x3, "68d324e0a520c19c1543cd32fd14e3ec6b90891997016a52e82806ea6524d7bb6a6cd7af49c54f344b74cd02f264f0c5d3c14dcb2c1ced06b17daed8f8ed76a50f6b2276c8e4791793480c9cc0294e115f30639d1843fb11746480a2eabe0309512cd6d701635c5a6fba818f6ef4b239549647f457e3072536"}, @TIPC_NLA_NODE_ID={0xf8, 0x3, "77248a5348d612f9792b52bb04a79137fcca5f049b2f8eae1a7957a7679be54def03f1b4e67164e2c04694870febf34906cc60867a310880aa1ee9051bd60ecebf5d4b037b97052c33b7f8cd419fb973df98f14865346f58532227b84f4fb375c6ec952497365fb0c2ad3d60bddf1268ee47de13183df50cd36866b17980726bfe3d1584c98ee0a92cae9ec524dc88772373aca2a4c715d64ac5409e9d807714a6bf5d4c0dbcce481ce9514d78e912726ac1ee0e49570c37dcbd2ade00973988dfcd6cf942a255b11f8336ddc48698b94ffea6dbe9db66ebcb038136dabd90f1393d9f3ef0e920a95024b6d3d63de413f63f953f"}]}, @TIPC_NLA_MEDIA={0xfc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7d9f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3b26}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}]}]}, 0x3ec}, 0x1, 0x0, 0x0, 0x4}, 0x20000005) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r4, &(0x7f0000001280)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001240)={&(0x7f0000001200)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x4, 0xc}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x40080}, 0x1) r8 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000bfd000/0x400000)=nil) syz_kvm_add_vcpu$x86(r8, &(0x7f00000016c0)={0x0, &(0x7f00000012c0)=[@nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_create_vm={0x12d, 0x18, 0x3}, @set_irq_handler={0xc8, 0x20, {0x22}}, @nested_vmresume={0x130, 0x18, 0x8}, @wr_drn={0x68, 0x20, {0x0, 0x8}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @save_area=0x62c, 0x4, 0x4, 0x85}}, @code={0xa, 0x68, {"b9ea0a00000f3266baf80cb8b4c4e58eef66bafc0ced8f6aa812410ebede0000f046836b9efc670f22c566baf80cb886e6d889ef66bafc0c66edb9800000c00f3235010000000f3066b813008ee0660f388072640f791f"}}, @uexit={0x0, 0x18, 0x5}, @nested_create_vm={0x12d, 0x18, 0x1}, @nested_amd_set_intercept={0x181, 0x30, {0x1, 0xe083, 0x9, 0x1}}, @uexit={0x0, 0x18, 0x9}, @nested_amd_invlpga={0x17d, 0x20, {0x70000, 0x98fc}}, @out_dx={0x6a, 0x28, {0x6eee, 0xf61bcad1c67507f9}}, @rdmsr={0x66, 0x18, {0x40a}}, @nested_vmresume={0x130, 0x18, 0x1}, @out_dx={0x6a, 0x28, {0x26a0, 0x3, 0xbed}}, @wrmsr={0x65, 0x20, {0xab2, 0xe132}}, @uexit={0x0, 0x18, 0xa3d2}, @nested_amd_set_intercept={0x181, 0x30, {0x1, 0xfffffffffffffff9, 0x2}}, @nested_amd_stgi={0x17e, 0x10}, @nested_amd_vmsave={0x183, 0x18, 0x1}, @nested_amd_invlpga={0x17d, 0x20, {0xeeee8000, 0x1aeb}}, @nested_amd_invlpga={0x17d, 0x20, {0x2000, 0x3e6a}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x3, 0x7}}, @wr_crn={0x67, 0x20, {0x4, 0x5}}, @nested_load_code={0x12e, 0x91, {0x2, "b9400a0000b828000000ba000000000f30d8bb000000006666460f3880a40e0a000000b9a20a0000b800000000ba000000000f3048b800000080000000000f23d80f21f835400000e00f23f82e650f01d50f21ae66baf80cb8a810fb8bef66bafc0c66b8009066ef450f00588d3e653e66430f11aa03000000"}}], 0x3f1}) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001740), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000001780)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r9, &(0x7f0000001840)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001800)={&(0x7f00000017c0)={0x28, r10, 0x400, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x28}, 0x1, 0x0, 0x0, 0x200400c0}, 0x400c8c0) read$usbmon(r4, &(0x7f0000001880)=""/165, 0xa5) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000001a80)={&(0x7f0000001940), 0xc, &(0x7f0000001a40)={&(0x7f00000019c0)={0x4c, 0x0, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x280000000}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x20004410) 3.752187631s ago: executing program 6 (id=3277): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x4, 0x7, 0x1, 0x2, 0xd0d5a7df9660cefb, @local, @loopback, 0x1, 0x10, 0x1ff, 0x3}}) 3.746248465s ago: executing program 6 (id=3278): r0 = userfaultfd(0x801) timer_create(0x8da985c6a3581772, &(0x7f0000000000)={0x0, 0x3b}, &(0x7f0000000040)) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x6}) userfaultfd(0x801) (async) timer_create(0x8da985c6a3581772, &(0x7f0000000000)={0x0, 0x3b}, &(0x7f0000000040)) (async) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) (async) socket$igmp6(0xa, 0x3, 0x2) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x6}) (async) 3.706072881s ago: executing program 6 (id=3279): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x1, 0x608141) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000000904"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000180)={0x40, 0x13, 0x4a, "b40d2ca346752d8940d3516942951589224960a4c1471fe35cd66fef37c60a54c56db2271a1541e7d30d26e6f6ed945917493ae0c7e1e71ae5d83b3b6d2d7cabba9acc120c43634a5bd9"}, &(0x7f0000000240)={0x0, 0xa, 0x1, 0x9b}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0xf3}, &(0x7f0000000480)=ANY=[@ANYBLOB="2001c3000000fccce1cd34411d6d236ee3f14db19669791ace4295c7065b36d169d334b2868a8bc1087613154337b543212ff0303a62353fc2849d8e41f005c21ce2b4c330b5c41447fef2ba217dcef0c54b6aa03e5e2e0f834a238ea5009dfa3fccede81abd91ac2fbaf8f0216f8270da5531fcacdb0d6aa5495c44812cec0621b52b0a031bb9089dfccb9778c3d90b8ce2737bb23e6b4f511767b36216926d4e4c4470d5102b027e2ba7a3e6f73ac5b22fe84c6dbacb1602ec082c9e38227e94936f4c7e4068da4473d2e878b15fe0e3a004e08d7f8204ff988d9d57e8856b7de08bcfc298885ea4ac973ef195665d1c496169b734fba4e4eb16be4b3ce01f4e1725ae0cd277f024408360e0ab"], 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) 2.925035546s ago: executing program 6 (id=3281): r0 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./file1\x00', 0x42, 0x1ff) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file1\x00'}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f00000003c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f00000000c0)={r4, 0x1, r0, 0x5, 0x80000}) r5 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000480)=ANY=[@ANYRES8=r1, @ANYRESOCT=r4], 0x0) syz_usb_control_io(r5, 0x0, 0x0) r6 = socket(0x1d, 0x2, 0x6) close_range(r2, r2, 0x2) getsockopt$inet_mreqn(r6, 0x6a, 0x4, 0x0, &(0x7f00000000c0)=0x5c) syz_usb_control_io(r5, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000e40)={0x84, &(0x7f0000000180)=ANY=[@ANYBLOB="001e1400000009"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000440)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x20, 0x1, 0x40, "20854e8c4b94a5715f8227fd4236ff070000000000001c9d3f45f2e89c1cffa964866b4b54712851c8825a2f8de125e3470c50febcb7566c61ba4ffbb8c84e5b"}, 0x0}) 1.274667146s ago: executing program 5 (id=3285): r0 = fanotify_init(0x8, 0x1000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) open_tree(r0, &(0x7f0000000000)='./file0\x00', 0x1802) syz_usb_connect(0x4, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) 1.274295873s ago: executing program 3 (id=3286): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000000080)=0xffffffff) (async) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d16}, 0x4) r1 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000240)={r1}) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xe1956000) (async) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) (async) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004102, 0x0) r2 = timerfd_create(0x8, 0x80800) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) fstat(r3, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r4) (async) timerfd_settime(r2, 0x0, &(0x7f00000013c0)={{}, {0x0, 0x989680}}, 0x0) r5 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) (async) ioctl$VIDIOC_QUERYSTD(r5, 0x8008563f, &(0x7f0000000100)) (async) syz_usb_connect(0x0, 0x3b, &(0x7f0000000140)=ANY=[@ANYBLOB="120100001b3ebd40d80483009c830102030109022900010000000009040000000202010004"], 0x0) 1.204886035s ago: executing program 1 (id=3287): bind$pptp(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=ANY=[@ANYBLOB="71feffff", @ANYRES16=0x0, @ANYBLOB="00082dbd7000fbdbdf250100000035a2e91187bf50aa5d943517544ba9a51e9d5241faf0ba28f904159b11c94bae6a99f505fb31d72a45a62e65d755ba25ed2ad1efeea774791b6670eebd714e7fb0d86609387e3b467a3452d74c040e3c3dfbc08746eb841cad470758456d9b7ebcfda5ff3ec97c4c1f25063f801c8fab5d13285f9be3567bf3c12ccf6b3e8e79a6d1dd913c933d1c3618d7cdfb9a038b2059c91e978e1387ae75717df425d404bdd62aaeb40b6453f7cb46a18a38880ef713126d05fcf2d1934a834e3448e2520eb577e4284eeb4af77f3cf29df4"], 0x14}}, 0xa4) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x5, 0xff, 0x0, 0x0, @time, {}, {0x0, 0x1}, @result={0x400}}], 0x1c) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r2, 0x0, 0x80000000, &(0x7f0000000300)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r6, 0x89f2, &(0x7f0000001880)={'ip6tnl0\x00', &(0x7f0000001800)={'ip6gre0\x00', 0x0, 0x4, 0x1, 0x9c, 0x1, 0x20, @dev={0xfe, 0x80, '\x00', 0xe}, @ipv4={'\x00', '\xff\xff', @empty}, 0x7, 0x20, 0xc9, 0x4}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r7) sendmsg$ETHTOOL_MSG_RINGS_SET(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a00)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01000000000000000000100000001800018014000200776c616e3000000000000000000000000800090000000080"], 0x34}}, 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x4c, &(0x7f000002eff0)={0x1, &(0x7f0000000000)=[{0xffff}]}, 0x10) connect$unix(r5, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r5, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e21}, 0x6e) r9 = syz_open_dev$vim2m(&(0x7f0000000040), 0x1000001, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r9, 0xc008561c, &(0x7f0000000000)={0x980915, 0x8}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000180)="66baa000ecc744240011000000c7442402b16e0000ff2c2443f466baf80cb8f2c96789ef66bafc0c66ed0f072e0f01c248b820450000000000000f23d00f21f835000000010f23f8c46289900cabb9f9080000b8c93c0000ba000000000f30c4816857a601000000", 0x68}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 928.54675ms ago: executing program 1 (id=3288): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) memfd_create(0x0, 0x5) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}}, 0x10) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x4, 0x2a282) r5 = memfd_create(&(0x7f0000000180)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6*t\xc8\xf4>q%\xa4\x81\xe2\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\x1cf\xf0\xf2xW?\x8e\xd9\x06\xc7\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n<+l\xfdG\x8e\t\x96rT|\xe3\x13\x19\xe3%g\xa7n\xa93\xf5>\x81R\xe7`\x83N\xf4\xa7\xc8:\x8eY\x0e@\x1b\x17Y>b\x85\xd3\x12I\xbf\xac\x9eM\x884Z\xaf\xf3\'\x8aj\"\xd1~k\x7f%\x96\xf95&\x84A%\x97\xb8\x18\xa7\x88\xe3w', 0x1) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, r5) ioctl$LOOP_SET_STATUS(r4, 0x4c02, &(0x7f0000000000)={0x0, {}, 0x0, {}, 0x0, 0x0, 0x25, 0xd, "eeddb7c25540993ad642248c7b0157ce0dc9b4e500476312cd6cb416f686ce0058265f66cdddf2e9ce8bb87ae03e87a61fb648d5c6a3e9977956be87176a30a9", "a863a5170a11d26a730cb3d1e9fb18cb0e58986d58e881bbe5e4230de84eea7a", [0x3, 0x800]}) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f0000000080)='cifs.spnego\x00', &(0x7f00000000c0)) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r3]) renameat2(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x1) llistxattr(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f0000000480)='syzkaller\x00', &(0x7f00000004c0)=@secondary) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000140)={0x0, 0x1, 0x6, @local}, 0x10) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) write$UHID_INPUT(r1, &(0x7f0000001040)={0xc, {"a2e3ad9bed0d52f91b18090987f70e06d038e7ff7fc6e5539b5b43078b089b3b33326d090890e0878f0e1ac6e7049b3371959b719a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074c0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x3b3cc1e9e7df1ab7}}, 0x9b) 928.009464ms ago: executing program 1 (id=3289): r0 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\x83\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0xa4, &(0x7f0000000300)={0x2f, 0x3, 0x3}) mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0) mq_timedreceive(r0, &(0x7f0000000540)=""/207, 0xcf, 0xffefffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRES16=0x0], 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x4000010) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000000), &(0x7f0000000040)=0x4) 904.652639ms ago: executing program 1 (id=3290): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x1, 0x608141) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000000904"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="40134a000000b40d2ca346752d8940d3516942951589224960a4c1471fe35cd66fef37c60a54c56db2271a1541e7d30d26e6f6ed945917493ae0c7e1e71ae5d83b3b6d2d7cabba0600000000000000d9"], &(0x7f0000000240)={0x0, 0xa, 0x1, 0x9b}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0xf3}, &(0x7f0000000480)=ANY=[@ANYBLOB="2001c3000000fccce1cd34411d6d236ee3f14db19669791ace4295c7065b36d169d334b2868a8bc1087613154337b543212ff0303a62353fc2849d8e41f005c21ce2b4c330b5c41447fef2ba217dcef0c54b6aa03e5e2e0f834a238ea5009dfa3fccede81abd91ac2fbaf8f0216f8270da5531fcacdb0d6aa5495c44812cec0621b52b0a031bb9089dfccb9778c3d90b8ce2737bb23e6b4f511767b36216926d4e4c4470d5102b027e2ba7a3e6f73ac5b22fe84c6dbacb1602ec082c9e38227e94936f4c7e4068da4473d2e878b15fe0e3a004e08d7f8204ff988d9d57e8856b7de08bcfc298885ea4ac973ef195665d1c496169b734fba4e4eb16be4b3ce01f4e1725ae0cd277f024408360e0ab"], &(0x7f00000003c0)={0x20, 0x3, 0x1, 0x9}}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e20, @empty}, 0x1, 0x0, 0x3, 0x3}}, 0x26) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt(r2, 0x111, 0x1, 0x0, &(0x7f0000000080)) syz_usb_control_io$uac1(r1, 0x0, 0x0) 663.899187ms ago: executing program 5 (id=3291): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000fddbdf25070000000400018008000400ea000000"], 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20040000) 592.583398ms ago: executing program 5 (id=3292): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000), 0xf43, 0x420000) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x20008800}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000140)={0xf, 0x8}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x7, 0x4, 0x3e0, 0x110, 0x0, 0x110, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@arp={@multicast2, @private=0xa010100, 0xff, 0xffffff00, 0xc, 0x4, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xbe9240b8a223bba0]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x2, 0x6, 0x23b0, 0x9dd7, 0x80, 0x9, 'veth1_vlan\x00', 'ip_vti0\x00', {0xff}, {0xff}, 0x0, 0x12}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "716ebd2e1aa0cc683e62f312359594df00da56317f76121697127951fdba"}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000190000404e040c1200000000000109022400010000500009efdf214003000000092104000801220810090581030000070203"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000940)={0x24, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYRES64=r0], 0x0}, 0x0) 500.318666ms ago: executing program 3 (id=3294): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000400)=[{0x28, 0x0, 0x0, 0xffffefff}, {0x6, 0x0, 0x0, 0x6}]}, 0x10) sendmsg$IPCTNL_MSG_CT_GET_DYING(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) socket(0x28, 0xa, 0x40000200) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/packet\x00') preadv(r1, &(0x7f00000001c0)=[{&(0x7f00000013c0)=""/186, 0xba}], 0x1, 0x92bb, 0x21a) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x44a800, 0x0) 472.993443ms ago: executing program 3 (id=3295): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x24, &(0x7f00000000c0)=0x100000001, 0x4) recvfrom$inet(r1, 0x0, 0x0, 0xc9100120, 0x0, 0x0) (async) listen(r0, 0x20) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) inotify_init1(0x80000) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) (async) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r3, 0x4068aea3, &(0x7f0000000100)={0xed, 0x0, 0x7}) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000140)) (async) r5 = syz_open_procfs(0x0, &(0x7f0000000280)='net/arp\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x804000, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) (async) accept(r0, 0x0, 0x0) (async) shutdown(r0, 0x0) 392.507423ms ago: executing program 3 (id=3296): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) (async) mbind(&(0x7f00007e0000/0x2000)=nil, 0x2000, 0x2, 0x0, 0x1, 0x3) 391.390608ms ago: executing program 3 (id=3297): r0 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000340)) tkill(0x0, 0xb) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2101, 0x0) setsockopt$packet_int(r1, 0x107, 0x12, &(0x7f0000000080)=0x1, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'vlan0\x00', 0x0}) sendto$packet(r3, 0x0, 0x0, 0x4004, &(0x7f0000000200)={0x11, 0x8100, r4, 0x1, 0xe0}, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) r7 = socket$inet6(0xa, 0x800000000000002, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002580)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="64bb6a97aaf0b87f190a4cba6feb816dfef1c47030d7e707ac33636c25", 0x1d}], 0x1}}], 0x1, 0x4802d) write(r7, &(0x7f00000006c0)="843425ab38b4b7d5d98e64e62a511c1b6ffcf6786c06d22b38cf37c2a0b75817763fde1069731a55e4dcfb1e165467fbf9cfbef4cf10035ed6e4304b14428cce0f3b4df566b620f99193d22c223577e0cee16ab7598977b8e7da7b579e4d8133854c334624bac2b424ed47ee6b0209786b33b1143982b88c46fce78040af685181f283dee9ce9639bf744fe7701fb2c11c88f1f8af9bfe9094145ae10cc21771728a9bb32d2e59adeea3920d61b9194c0c68792f014550a58165ce253287184a7db17b914a46f45e1eae0b53b0f882", 0xcf) sendto$inet6(r7, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x12, @mcast2}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000014c0)="03fe62190d30c5266fecee89914547e2f7b4a027049e2e1a5f83155978a78bbdad6455463d1cf596b04e732b6208f7c2052499aeef053781fbcdade1e4509b96442dfeafff2d34ca74ba872f741bbfffb78009ba745cfae12435500f1548f44c78a2836904c1ea9465ff82cb288006c8b5c825f6e663221b67557c1a53955db404b3085745aa93be94c608c017ab4764a52e05dbd67f25f8e41ff55982990488669a5f80e6e42ebfbd55ceb2c27f0fa69f747f4d483ec4b65af86c376e247ae4ab495dd8f7c0d8e6104642b2e43821297f235302198b83cce600f79b7fafa02050af352e7fe2bf1f0fed3684b62c375dcb08b279e4ad209e087e9f90856fc28dcc1df7ff5275e5b006e6b8b805d1e8c7bfdb9c8c77037566567c0ec3629789917cbacbca99bcc7e0b4a8be600f139af8b95ba2b96c04e3f42399ee18b61475963296f6c91cad4b61365e0cc818b1e1652a7da261d5d9417aa190a14344b33f187f8471ae22630602748c55fc6cdfdc3b9e314e2b3ba81bb7419e32d19e5941307b57963f2111206605791ee926d1bec8311ef95d0dcbd58f4b89170627dc5b61f821ef31c5ab23c2d6fe6a329c7c9894be247401fd97bc780ab214110ed5964afa26473f6f5746eb2b4d2ac1bd24572187252841894553f50897a289af17a94b7c33cc71f242bb7e10fea955117bef8610512b1ff43dec43b8431de3dad13d796b7c9ed0cccc7cadf43bed753f7005f3d1744853b7c73b534673fcdb64ca2c7c729ccff8dc45cc970b38d5838b5bcdbab648e1ccc89f59c1702dce2848814ce9fc9ec3abc06ec9a130b0c9253d9f21853b36330d6b1018d096f50c4a979e4be4648d96b0929bffb0668f1933888b9536cd1fac764c507e65858ae5cda4f89c8aa0f3778c47", 0x285}], 0x1}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)="c0b4", 0x2}], 0x1}}], 0x3, 0x400c404) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000d8ca8d40d10521200031010203010902120001000000000904"], 0x0) 126.113765ms ago: executing program 1 (id=3298): r0 = socket$can_j1939(0x1d, 0x2, 0x7) connect$can_j1939(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r3 = socket(0x400000000010, 0x3, 0x0) write(r3, &(0x7f0000000040)="0f03000018002551075c0165ff0ffc02802000030004000500e1000cee0203001a000000", 0x33a) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16, @ANYBLOB="937322adaec9db7fa787635de17af4f5f464317073753c92a040e0b42c796c9ab3aa13eb19832c9086a299d93286bf77b435146394d3c2c14bef4cfa9b9aeb3326a31ae4c007a3ba28a11e410ac388a95679e33886fd6294ac638b9463b96484c32cf7699e2141f09040ff4ab7a6b3423fc67d6dc4c1793704851ae841b8e76422d8edf3a3360e96ae39a7fba8ec6592f642e8", @ANYRES16=r3], 0x2c}, 0x1, 0x0, 0x0, 0x202c090}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x44, 0x27, 0x100, 0x70bd29, 0x25dfdbfd, {0xd}, [@nested={0x2c, 0xcb, 0x0, 0x1, [@typed={0x4, 0xdf}, @typed={0x4, 0x9e}, @typed={0x8, 0x4, 0x0, 0x0, @fd=r3}, @nested={0x4, 0xd6}, @typed={0x8, 0x5c, 0x0, 0x0, @fd=r4}, @typed={0xa, 0xf5, 0x0, 0x0, @str='wlan0\x00'}]}, @nested={0x4, 0x149}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x4000004) 70.025356ms ago: executing program 1 (id=3299): r0 = syz_usb_connect(0x0, 0x62, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d24060101030200010006000609240305050306058109240306010304050507240405"], 0x0) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0xc81, 0x0) write$UHID_CREATE2(r1, 0x0, 0x194) syz_usb_control_io$rtl8150(r0, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/resume', 0x8080, 0x40) quotactl_fd$Q_QUOTAON(r2, 0xffffffff80000201, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x2c, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}, @in6={0xa, 0x4e22, 0x58, @dev={0xfe, 0x80, '\x00', 0x43}, 0x1ff}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000280)={r3, @in={{0x2, 0x4e20, @multicast2}}, 0xa, 0x1}, &(0x7f0000000140)=0x90) 272.076µs ago: executing program 5 (id=3300): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xb, &(0x7f0000000040)=0x8, 0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x51, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x1}}) getsockopt$sock_buf(r0, 0x1, 0x37, &(0x7f0000000080)=""/173, &(0x7f0000000000)=0x6f) 0s ago: executing program 5 (id=3301): r0 = fanotify_init(0x8, 0x1000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) open_tree(r0, &(0x7f0000000000)='./file0\x00', 0x1802) kernel console output (not intermixed with test programs): amed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 375.552279][ T43] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 375.572969][ T10] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.001D/input/input49 [ 375.589023][ T1583] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x00b0: ffffffb9 [ 375.606285][ T43] usb 2-1: can't read configurations, error -71 [ 375.615457][ T1583] asix 4-1:0.188: probe with driver asix failed with error -71 [ 375.637517][ T1583] usb 4-1: USB disconnect, device number 69 [ 375.720191][T11631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 375.743536][ T10] keytouch 0003:0926:3333.001D: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 375.743735][T11631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.003179][T11648] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1609'. [ 376.012351][T11648] .30ªX¹¦D: renamed from macvtap0 (while UP) [ 376.020325][T11648] A link change request failed with some changes committed already. Interface .30ªX¹¦D may have been left with an inconsistent configuration, please check. [ 376.064401][ T5831] usb usb42-port1: unable to enumerate USB device [ 376.088228][T11650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 376.102577][T11650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.171889][ T1583] usb 6-1: USB disconnect, device number 12 [ 376.263336][ T43] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 376.363287][ T5831] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 376.413778][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 376.420696][ T43] usb 2-1: unable to get BOS descriptor or descriptor too short [ 376.429972][ T43] usb 2-1: config 1 interface 0 altsetting 9 bulk endpoint 0x1 has invalid maxpacket 511 [ 376.440123][ T43] usb 2-1: config 1 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 376.453440][ T43] usb 2-1: config 1 interface 0 has no altsetting 0 [ 376.462070][ T43] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 376.471329][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.480315][ T43] usb 2-1: Product: 糺진뫠ᒳ低äˆà¬„툻à¢î«î§Îžï¹°ç‚ºï±µç›±í™–틟盖ㅡ膤暪ꈬ秗뀀﹔ì°ê¤ê°½ê´¶ã‡ƒç±ëºì±Œï¨¼í…†é¼Å¢è¹ç£Šå¯„à°œçŒä®ï¦ Ð‘ [ 376.496897][ T43] usb 2-1: SerialNumber: 裑黥濌梡翬侴ߦݥ [ 376.506645][T11641] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 376.533307][ T5831] usb 4-1: Using ep0 maxpacket: 8 [ 376.540740][ T5831] usb 4-1: unable to get BOS descriptor or descriptor too short [ 376.549644][ T5831] usb 4-1: config 1 has an invalid interface descriptor of length 7, skipping [ 376.558630][ T5831] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 376.568945][ T5831] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 376.581314][ T5831] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 376.590630][ T5831] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.598792][ T5831] usb 4-1: Product: syz [ 376.602984][ T5831] usb 4-1: Manufacturer: syz [ 376.607661][ T5831] usb 4-1: SerialNumber: syz [ 376.732692][ T6356] udevd[6356]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 376.741956][T11641] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1608'. [ 376.832781][ T6356] udevd[6356]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 376.849489][ T5831] usb 4-1: USB disconnect, device number 70 [ 376.913080][T11665] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1616'. [ 376.941347][ T43] usb 2-1: USB disconnect, device number 69 [ 377.101000][T11663] cgroup: fork rejected by pids controller in /syz4 [ 377.123916][ T10] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 377.293262][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 377.300962][ T10] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 377.314493][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 377.327658][ T10] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 377.337018][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.345253][ T10] usb 6-1: Product: syz [ 377.349429][ T10] usb 6-1: Manufacturer: syz [ 377.354199][ T10] usb 6-1: SerialNumber: syz [ 377.361755][ T10] usb 6-1: config 0 descriptor?? [ 377.371729][ T10] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 377.381027][ T10] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 377.673424][ T1583] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 377.753388][ T5915] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 377.843615][ T1583] usb 4-1: Using ep0 maxpacket: 8 [ 377.858234][ T1583] usb 4-1: config 5 has an invalid interface number: 151 but max is 0 [ 377.870581][ T1583] usb 4-1: config 5 has no interface number 0 [ 377.890777][ T1583] usb 4-1: New USB device found, idVendor=16ca, idProduct=1502, bcdDevice=1e.b5 [ 377.901348][ T1583] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.911489][ T1583] usb 4-1: Product: syz [ 377.916446][ T1583] usb 4-1: Manufacturer: syz [ 377.921103][ T1583] usb 4-1: SerialNumber: syz [ 377.929548][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 377.944150][ T5915] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 377.963083][ T5915] usb 2-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 377.974244][ T10] em28xx 6-1:0.0: chip ID is em2870 [ 377.985848][ T5915] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.005407][ T5915] usb 2-1: config 0 descriptor?? [ 378.034999][T11880] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 378.162840][ T10] usb 4-1: USB disconnect, device number 71 [ 378.186255][T11662] input: syz0 as /devices/virtual/input/input50 [ 378.211210][ T6123] usb 6-1: USB disconnect, device number 13 [ 378.226211][ T6123] em28xx 6-1:0.0: Disconnecting em28xx [ 378.245119][ T6123] em28xx 6-1:0.0: Freeing device [ 378.451113][ T5915] belkin 0003:1020:0006.001E: hidraw0: USB HID v0.00 Device [HID 1020:0006] on usb-dummy_hcd.1-1/input0 [ 378.489768][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.496491][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.601765][T12085] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 378.613126][T12085] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 378.629954][T12085] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 378.644838][T12085] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 378.649365][T11776] AppArmor: change_hat: Invalid input, NULL hat and NULL magic [ 378.660287][T11776] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1619'. [ 378.755260][ T5926] usb 2-1: USB disconnect, device number 70 [ 378.826193][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 378.839084][T12089] fuse: Unknown parameter 'Name: syz.3.1625 [ 378.839084][T12089] Umask: 0077 [ 378.839084][T12089] State: R (running) [ 378.839084][T12089] Tgid: 1340 [ 378.839084][T12089] Ngid: 0 [ 378.839084][T12089] Pid: 1341 [ 378.839084][T12089] PPid: 1 [ 378.839084][T12089] TracerPid: 0 [ 378.839084][T12089] Uid: 0 0 0 0 [ 378.839084][T12089] Gid: 0 0 0 0 [ 378.839084][T12089] FDSize: 256 [ 378.839084][T12089] Groups: 0 10 [ 378.839084][T12089] NStgid: 1340 [ 378.839084][T12089] NSpid: 1341 [ 378.839084][T12089] NSpgid: 1340 [ 378.839084][T12089] NSsid: 0 [ 378.839084][T12089] Kthread: 0 [ 378.839084][T12089] VmPeak: 102196 kB [ 378.839084][T12089] VmSize: 102196 kB [ 378.839084][T12089] VmLck: 0 kB [ 378.839084][T12089] VmPin: 0 kB [ 378.839084][T12089] VmHWM: 24208 kB [ 378.839084][T12089] VmRSS: 24208 kB [ 378.839084][T12089] RssAnon: 1412 kB [ 378.839084][T12089] RssFile: 22796 kB [ 378.839084][T12089] RssShmem: 0 kB [ 378.839084][T12089] VmData: 36584 kB [ 378.839084][T12089] VmStk: 132 kB [ 378.839084][T12089] VmExe: 1768 kB [ 378.839084][T12089] VmLib: 8 kB [ 378.839084][T12089] VmPTE: 136 kB [ 378.839084][T12089] VmSwap: 0 kB [ 378.839084][T12089] HugetlbPages: 0 kB [ 378.839084][T12089] CoreDumping: 0 [ 378.839084][T12089] THP_enabled: 1 [ 378.839084][T12089] untag_mask: 0xffffffffffffffff [ 378.839084][T12089] Threads: 2 [ 378.839084][T12089] SigQ: 0/12970 [ 378.839084][T12089] SigPnd: 0000000000000000 [ 378.839084][T12089] ShdPnd: 0000000000000000 [ 378.839084][T12089] SigBlk: 0000000000000000 [ 378.839084][T12089] SigIgn: fffffffefffaba35 [ 378.839084][T12089] SigCgt: 0000000100010440 [ 378.839084][T12089] CapInh: 0000000000000000 [ 378.839084][T12089] CapPrm: 000001ffff77ffff [ 378.839084][T12089] CapEff: 000001ffff77ffff [ 378.839084][T12089] CapBnd: 000001ffffffffff [ 378.839084][T12089] CapAmb: 0000000000000000 [ 378.839084][T12089] NoNewPrivs: 0 [ 378.839590][T12089] netlink: 'syz.3.1625': attribute type 39 has an invalid length. [ 379.052204][T12092] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1626'. [ 379.063082][T12091] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1626'. [ 379.118227][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 379.157421][T12096] sctp: [Deprecated]: syz.5.1628 (pid 12096) Use of int in max_burst socket option deprecated. [ 379.157421][T12096] Use struct sctp_assoc_value instead [ 379.254499][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 379.433247][ T5926] usb 4-1: new full-speed USB device number 72 using dummy_hcd [ 379.513284][ T5831] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 379.602591][ T5926] usb 4-1: config 0 has an invalid interface number: 46 but max is 0 [ 379.610846][ T5926] usb 4-1: config 0 has no interface number 0 [ 379.623435][ T5926] usb 4-1: too many endpoints for config 0 interface 46 altsetting 0: 223, using maximum allowed: 30 [ 379.645277][ T5926] usb 4-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 379.671175][ T5926] usb 4-1: config 0 interface 46 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 379.682265][ T5831] usb 6-1: not running at top speed; connect to a high speed hub [ 379.699901][ T5926] usb 4-1: config 0 interface 46 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 223 [ 379.732862][ T5831] usb 6-1: config 1 interface 0 has no altsetting 0 [ 379.746829][ T5831] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 379.758212][ T5831] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.769264][ T5831] usb 6-1: Product: syz [ 379.775346][ T5926] usb 4-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 379.784953][ T5831] usb 6-1: Manufacturer: syz [ 379.789566][ T5831] usb 6-1: SerialNumber: syz [ 379.794258][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.802254][ T5926] usb 4-1: Product: syz [ 379.808820][ T5926] usb 4-1: Manufacturer: syz [ 379.825648][ T5926] usb 4-1: SerialNumber: syz [ 379.835538][ T5926] usb 4-1: config 0 descriptor?? [ 379.841391][T12098] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 379.856492][ T5926] ums-karma 4-1:0.46: USB Mass Storage device detected [ 379.931857][ T5926] ums-karma 4-1:0.46: probe with driver ums-karma failed with error -5 [ 379.944231][ T5915] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 380.098094][ T10] usb 4-1: USB disconnect, device number 72 [ 380.113275][ T5915] usb 2-1: Using ep0 maxpacket: 32 [ 380.131896][ T5915] usb 2-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 380.148080][ T5915] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.159114][ T5915] usb 2-1: Product: syz [ 380.166499][ T5915] usb 2-1: Manufacturer: syz [ 380.171361][ T5915] usb 2-1: SerialNumber: syz [ 380.182883][ T5831] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 380.186192][ T5915] usb 2-1: config 0 descriptor?? [ 380.203729][ T5915] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 380.211961][ T5915] dvb-usb: bulk message failed: -22 (2/0) [ 380.218118][ T5831] usb 6-1: USB disconnect, device number 14 [ 380.236322][ T5915] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 380.249632][ T5915] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 380.261674][ T5915] usb 2-1: media controller created [ 380.284668][ T5915] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 380.307772][ T5915] usb 2-1: selecting invalid altsetting 7 [ 380.315726][ T5915] cxusb: set interface failed [ 380.320957][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 380.351656][ T5915] DVB: Unable to find symbol lgdt330x_attach() [ 380.358237][ T5915] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 380.413283][ T5915] rc_core: IR keymap rc-dvico-portable not found [ 380.419718][ T5915] Registered IR keymap rc-empty [ 380.426272][ T5915] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 380.437660][ T5915] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input51 [ 380.449025][ T5915] dvb-usb: schedule remote query interval to 100 msecs. [ 380.456309][ T5915] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 380.575926][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 380.683244][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 380.721834][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 380.780844][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 380.804687][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 380.903996][ T10] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 380.926329][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 381.034219][ T6123] dvb-usb: bulk message failed: -22 (1/0) [ 381.055796][ T5915] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 381.066814][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 381.070102][T12444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.079194][ T10] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 381.092659][T12444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.100613][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.116096][T12444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.118174][ T10] usb 4-1: config 0 descriptor?? [ 381.136548][T12444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.144657][ T1583] dvb-usb: bulk message failed: -22 (1/0) [ 381.224932][ T5915] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 381.236223][ T5915] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 381.248564][ T5915] usb 6-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 381.257824][ T1583] dvb-usb: bulk message failed: -22 (1/0) [ 381.263887][ T5915] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.271959][ T5915] usb 6-1: Product: syz [ 381.276201][ T5915] usb 6-1: Manufacturer: syz [ 381.281084][ T5915] usb 6-1: SerialNumber: syz [ 381.289734][ T5915] usb 6-1: config 0 descriptor?? [ 381.296771][ T5915] hub 6-1:0.0: bad descriptor, ignoring hub [ 381.302786][ T5915] hub 6-1:0.0: probe with driver hub failed with error -5 [ 381.313083][ T5915] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input52 [ 381.384410][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 381.493308][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 381.541038][ T10] keytouch 0003:0926:3333.001F: fixing up Keytouch IEC report descriptor [ 381.552719][ T10] input: HID 0926:3333 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0926:3333.001F/input/input53 [ 381.603461][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 381.613789][ T5831] usb 6-1: USB disconnect, device number 15 [ 381.646806][ T10] keytouch 0003:0926:3333.001F: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.3-1/input0 [ 381.713227][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 381.769105][T12332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.785883][T12332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.817976][ C0] kbd_keycode: 694 callbacks suppressed [ 381.817993][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.830443][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.837879][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.838848][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.838869][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.838909][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.838923][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.839483][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.839542][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.840173][ C0] keyboard: can't emulate rawmode for keycode 240 [ 381.864481][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 381.970908][T12450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.974325][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 381.986428][T12450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 382.042469][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 382.104306][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 382.109934][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 382.213313][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 382.262933][ T10] usb 4-1: USB disconnect, device number 73 [ 382.337134][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 382.443251][ T5915] dvb-usb: bulk message failed: -22 (1/0) [ 382.553264][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 382.675288][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 382.700322][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 382.730112][T12463] netlink: zone id is out of range [ 382.746612][ T43] usb 2-1: USB disconnect, device number 71 [ 382.806259][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 382.858654][ T43] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 383.133331][ T10] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 383.240688][T12585] 9pnet_fd: p9_fd_create_unix (12585): problem connecting socket: ./file0: -111 [ 383.283541][ T10] usb 6-1: device descriptor read/64, error -71 [ 383.393356][ T43] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 383.533303][ T5831] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 383.533354][ T10] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 383.558022][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 383.569085][ T43] usb 4-1: config 0 has an invalid interface number: 126 but max is 0 [ 383.577561][ T43] usb 4-1: config 0 has no interface number 0 [ 383.587739][ T43] usb 4-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 383.605157][ T43] usb 4-1: config 0 interface 126 has no altsetting 0 [ 383.619071][ T43] usb 4-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 383.633781][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.641806][ T43] usb 4-1: Product: syz [ 383.654307][ T43] usb 4-1: Manufacturer: syz [ 383.658951][ T43] usb 4-1: SerialNumber: syz [ 383.668433][ T43] usb 4-1: config 0 descriptor?? [ 383.674233][T12583] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 383.693458][ T10] usb 6-1: device descriptor read/64, error -71 [ 383.705335][T12694] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 383.715812][ T5831] usb 2-1: Using ep0 maxpacket: 32 [ 383.726736][ T5831] usb 2-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 383.738653][ T5831] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.748880][ T5831] usb 2-1: Product: syz [ 383.753237][ T5831] usb 2-1: Manufacturer: syz [ 383.757893][ T5831] usb 2-1: SerialNumber: syz [ 383.767117][ T5831] usb 2-1: config 0 descriptor?? [ 383.806552][ T10] usb usb6-port1: attempt power cycle [ 383.838272][T12696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 383.850136][T12696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 383.868946][T12696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 383.880357][T12696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.098191][ T43] ir_usb 4-1:0.126: required endpoints missing [ 384.163570][ T10] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 384.203855][ T10] usb 6-1: device descriptor read/8, error -71 [ 384.386589][ T5831] peak_usb 2-1:0.0 can0: unable to request usb[type=2 value=5] err=-71 [ 384.453696][ T10] usb 6-1: new full-speed USB device number 19 using dummy_hcd [ 384.454855][ T5831] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -71 [ 384.481101][ T10] usb 6-1: device descriptor read/8, error -71 [ 384.490627][ T5831] usb 2-1: USB disconnect, device number 72 [ 384.593610][ T10] usb usb6-port1: unable to enumerate USB device [ 384.742136][T12800] JFS: discard option not supported on device [ 384.749196][T12800] Mount JFS Failure: -22 [ 384.753753][T12800] jfs_mount failed w/return code = -22 [ 384.760569][T12800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 384.771884][T12800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 385.311673][T12806] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 385.320554][T12806] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 385.406220][T12909] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.1668'. [ 385.683983][T12918] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 385.693810][T12918] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 385.705645][T12918] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 385.716435][T12918] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 385.927455][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 386.024716][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 386.035771][ T10] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 386.166733][ T43] usb 4-1: USB disconnect, device number 74 [ 386.195974][ T10] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 386.205191][ T10] usb 2-1: can't read configurations, error -22 [ 386.252051][T12933] netlink: 'syz.3.1677': attribute type 27 has an invalid length. [ 386.277909][T12933] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 386.325796][T12937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 386.334297][ T10] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 386.334695][T12937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 386.357192][T12937] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1679'. [ 386.367729][T12937] netlink: 'syz.4.1679': attribute type 21 has an invalid length. [ 386.486039][ T10] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 386.494081][ T10] usb 2-1: can't read configurations, error -22 [ 386.500540][ T10] usb usb2-port1: attempt power cycle [ 386.593309][ T43] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 386.649495][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 386.744601][ T43] usb 4-1: config 3 has an invalid interface number: 168 but max is 0 [ 386.752809][ T43] usb 4-1: config 3 has no interface number 0 [ 386.759191][ T43] usb 4-1: config 3 interface 168 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 386.770993][ T43] usb 4-1: config 3 interface 168 altsetting 0 endpoint 0x81 has invalid maxpacket 30768, setting to 1024 [ 386.782349][ T43] usb 4-1: config 3 interface 168 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 386.793006][ T43] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice=a8.a4 [ 386.802101][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.813982][T12933] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 386.853438][ T10] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 386.876359][ T10] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 386.888595][ T10] usb 2-1: can't read configurations, error -22 [ 386.903244][ T6123] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 387.024793][ T10] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 387.028019][T12933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 387.049460][ T10] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 387.058434][T12933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 387.060426][ T10] usb 2-1: can't read configurations, error -22 [ 387.076085][ T6123] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 387.089707][ T10] usb usb2-port1: unable to enumerate USB device [ 387.098358][ T6123] usb 6-1: New USB device found, idVendor=044f, idProduct=b304, bcdDevice= 0.00 [ 387.110534][ T6123] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 387.133877][ T6123] usb 6-1: config 0 descriptor?? [ 387.166247][T12939] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 387.261394][ T43] usb 4-1: string descriptor 0 read error: -71 [ 387.274738][ T43] keyspan 4-1:3.168: Keyspan 2 port adapter converter detected [ 387.287053][ T43] keyspan 4-1:3.168: found no endpoint descriptor for endpoint 1 [ 387.300837][ T43] keyspan 4-1:3.168: found no endpoint descriptor for endpoint 84 [ 387.310856][ T43] keyspan 4-1:3.168: found no endpoint descriptor for endpoint 2 [ 387.332849][ T43] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 387.360473][ T43] keyspan 4-1:3.168: found no endpoint descriptor for endpoint 88 [ 387.397421][ T43] keyspan 4-1:3.168: found no endpoint descriptor for endpoint 6 [ 387.412795][ T43] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 387.417004][ T6123] thrustmaster 0003:044F:B304.0020: unknown main item tag 0x7 [ 387.437218][ T43] usb 4-1: USB disconnect, device number 75 [ 387.450715][ T43] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 387.467574][ T6123] thrustmaster 0003:044F:B304.0020: item fetching failed at offset 1/5 [ 387.480217][ T43] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 387.514954][ T6123] thrustmaster 0003:044F:B304.0020: parse failed [ 387.527618][ T43] keyspan 4-1:3.168: device disconnected [ 387.542601][ T6123] thrustmaster 0003:044F:B304.0020: probe with driver thrustmaster failed with error -22 [ 387.567141][ T6356] udevd[6356]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 387.604501][ T6123] usb 6-1: USB disconnect, device number 20 [ 387.757650][T13270] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 387.787252][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 387.823509][T13270] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 388.083878][ T6123] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 388.256706][ T6123] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 388.268877][ T6123] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 388.279260][ T6123] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.291668][ T6123] usb 6-1: config 0 descriptor?? [ 388.374295][ T5915] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 388.418379][T13302] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 388.430957][T13302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 388.442836][T13302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 388.513364][ T5915] usb 4-1: device descriptor read/64, error -71 [ 388.722145][ T6123] keytouch 0003:0926:3333.0021: fixing up Keytouch IEC report descriptor [ 388.737619][ T6123] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0021/input/input54 [ 388.763441][ T5915] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 388.867645][ T6123] keytouch 0003:0926:3333.0021: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 388.909507][ T5915] usb 4-1: device descriptor read/64, error -71 [ 388.943935][T13273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 388.952700][T13273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 389.014428][ C0] kbd_keycode: 342 callbacks suppressed [ 389.014448][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.027020][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.034074][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.040848][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.047292][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.053762][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.060198][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.067152][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.073596][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.080675][ C0] keyboard: can't emulate rawmode for keycode 240 [ 389.093812][ T5915] usb usb4-port1: attempt power cycle [ 389.432486][ T922] usb 6-1: USB disconnect, device number 21 [ 389.433339][ T5915] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 389.465683][ T5915] usb 4-1: device descriptor read/8, error -71 [ 389.550873][T13420] dvmrp12: entered allmulticast mode [ 389.694780][T13424] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 389.706330][T13424] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 389.706503][ T5915] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 389.733801][ T5915] usb 4-1: device descriptor read/8, error -71 [ 389.843640][ T5915] usb usb4-port1: unable to enumerate USB device [ 389.890151][T13428] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1701'. [ 389.899382][T13428] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1701'. [ 389.996518][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 390.032977][T13432] cgroup: Setting release_agent not allowed [ 390.128837][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 390.250079][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 390.324355][ T5915] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 390.349964][T13449] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 390.473251][ T5915] usb 2-1: Using ep0 maxpacket: 16 [ 390.487140][ T5915] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 390.504360][ T5915] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 390.523738][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 152, changing to 11 [ 390.543209][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 8285, setting to 1024 [ 390.557390][T13453] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1709'. [ 390.563220][ T5915] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 390.569198][T13453] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1709'. [ 390.592712][ T5915] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 390.606561][ T5915] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.614972][ T10] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 390.634084][ T5915] usb 2-1: Product: syz [ 390.638408][ T5915] usb 2-1: Manufacturer: syz [ 390.643024][ T5915] usb 2-1: SerialNumber: syz [ 390.658730][ T5915] usb 2-1: config 0 descriptor?? [ 390.777572][ T10] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 390.793195][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 390.812490][ T10] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 390.833358][ T10] usb 6-1: config 1 has no interface number 1 [ 390.839655][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 390.863370][ T10] usb 6-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 390.869098][T13558] overlay: Bad value for 'redirect_dir' [ 390.883977][ T5915] appledisplay: Apple Cinema Display connected [ 390.892589][ T10] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 390.922175][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.930407][ T10] usb 6-1: Product: syz [ 390.943197][ T10] usb 6-1: Manufacturer: syz [ 390.948235][ T10] usb 6-1: SerialNumber: syz [ 390.993117][ T7393] overlayfs: failed lookup in lower (newroot/364, name='bus', err=-40): overlapping layers [ 391.014367][ T7393] overlayfs: failed lookup in lower (newroot/364, name='bus', err=-40): overlapping layers [ 391.093535][ T922] usb 2-1: USB disconnect, device number 77 [ 391.093630][ C0] usb 2-1: appledisplay_complete - usb_submit_urb failed with result -19 [ 391.112147][ T922] appledisplay: Apple Cinema Display disconnected [ 391.160157][ T5915] usb 5-1: USB disconnect, device number 16 [ 391.904255][ T922] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 392.033388][ T922] usb 4-1: device descriptor read/64, error -71 [ 392.123359][ T5926] usb 2-1: new full-speed USB device number 78 using dummy_hcd [ 392.264324][ T5840] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 392.279074][ T5840] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 392.289556][ T5926] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 392.290946][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 392.299377][ T922] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 392.314182][ T5926] usb 2-1: can't read configurations, error -22 [ 392.314216][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 392.332380][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 392.443312][ T5926] usb 2-1: new full-speed USB device number 79 using dummy_hcd [ 392.452567][ T922] usb 4-1: device descriptor read/64, error -71 [ 392.574526][ T922] usb usb4-port1: attempt power cycle [ 392.585102][T13568] chnl_net:caif_netlink_parms(): no params data found [ 392.619432][ T5926] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 392.627593][ T5926] usb 2-1: can't read configurations, error -22 [ 392.634343][ T5926] usb usb2-port1: attempt power cycle [ 392.689463][T13568] bridge0: port 1(bridge_slave_0) entered blocking state [ 392.696882][T13568] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.704520][T13568] bridge_slave_0: entered allmulticast mode [ 392.711963][T13568] bridge_slave_0: entered promiscuous mode [ 392.722069][T13568] bridge0: port 2(bridge_slave_1) entered blocking state [ 392.731517][T13568] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.739024][T13568] bridge_slave_1: entered allmulticast mode [ 392.746610][T13568] bridge_slave_1: entered promiscuous mode [ 392.786204][T13568] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 392.798760][T13568] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 392.835217][T13568] team0: Port device team_slave_0 added [ 392.844064][T13568] team0: Port device team_slave_1 added [ 392.879520][T13568] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 392.886788][T13568] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 392.912960][T13568] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 392.924956][ T922] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 392.934947][T13568] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 392.941910][T13568] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 392.969225][T13568] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 392.983380][ T5926] usb 2-1: new full-speed USB device number 80 using dummy_hcd [ 392.991417][ T922] usb 4-1: device descriptor read/8, error -71 [ 393.018154][ T5926] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 393.026202][ T5926] usb 2-1: can't read configurations, error -22 [ 393.055248][T13568] hsr_slave_0: entered promiscuous mode [ 393.062180][T13568] hsr_slave_1: entered promiscuous mode [ 393.175270][ T5926] usb 2-1: new full-speed USB device number 81 using dummy_hcd [ 393.205895][ T5926] usb 2-1: config index 0 descriptor too short (expected 9, got 0) [ 393.225292][ T5926] usb 2-1: can't read configurations, error -22 [ 393.234587][ T922] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 393.249315][ T5926] usb usb2-port1: unable to enumerate USB device [ 393.257283][ T922] usb 4-1: device descriptor read/8, error -71 [ 393.312558][ T10] usb 6-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 393.332506][ T10] usb 6-1: MIDIStreaming interface descriptor not found [ 393.352522][ T6564] udevd[6564]: symlink '../../loop5' '/dev/disk/by-diskseq/84.tmp-b7:5' failed: Read-only file system [ 393.380180][ T922] usb usb4-port1: unable to enumerate USB device [ 393.380440][T13568] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 393.439163][T13568] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 393.452188][ T10] usb 6-1: USB disconnect, device number 22 [ 393.472479][T13568] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 393.518593][ T5943] udevd[5943]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 393.523097][T13568] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 393.634541][T13568] 8021q: adding VLAN 0 to HW filter on device bond0 [ 393.652911][T13568] 8021q: adding VLAN 0 to HW filter on device team0 [ 393.666639][ T8610] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.673906][ T8610] bridge0: port 1(bridge_slave_0) entered forwarding state [ 393.688834][ T1341] bridge0: port 2(bridge_slave_1) entered blocking state [ 393.696025][ T1341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 393.858932][T13568] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 394.039752][T13568] veth0_vlan: entered promiscuous mode [ 394.053628][T13568] veth1_vlan: entered promiscuous mode [ 394.080028][T13568] veth0_macvtap: entered promiscuous mode [ 394.091321][T13568] veth1_macvtap: entered promiscuous mode [ 394.110347][T13568] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 394.125911][T13568] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 394.139835][ T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.149707][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.161004][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.172032][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.281018][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.308042][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 394.350653][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.359115][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 394.403356][ T5839] Bluetooth: hci1: command tx timeout [ 394.715144][ T43] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 394.876378][ T43] usb 7-1: config 0 has an invalid interface number: 69 but max is 0 [ 394.886505][ T43] usb 7-1: config 0 has no interface number 0 [ 394.892631][ T43] usb 7-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 394.906290][ T43] usb 7-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 394.920916][ T43] usb 7-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 394.931827][ T43] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.933521][ T5915] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 394.940118][ T43] usb 7-1: Product: syz [ 394.952037][ T43] usb 7-1: Manufacturer: syz [ 394.957389][ T43] usb 7-1: SerialNumber: syz [ 394.967614][ T43] usb 7-1: config 0 descriptor?? [ 394.981928][T13606] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 394.991917][ T43] cyberjack 7-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 395.005674][ T43] usb 7-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 395.114012][ T5915] usb 4-1: Using ep0 maxpacket: 16 [ 395.128601][ T5915] usb 4-1: config 0 has an invalid interface number: 53 but max is 0 [ 395.144861][ T5915] usb 4-1: config 0 has no interface number 0 [ 395.153640][ T5915] usb 4-1: New USB device found, idVendor=03fd, idProduct=ebbe, bcdDevice=ed.e2 [ 395.162730][ T5915] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.172588][ T5915] usb 4-1: Product: syz [ 395.177994][ T5915] usb 4-1: Manufacturer: syz [ 395.182626][ T5915] usb 4-1: SerialNumber: syz [ 395.194477][ T5915] usb 4-1: config 0 descriptor?? [ 395.258735][T13630] 9p: Bad value for 'rfdno' [ 395.272616][ T5915] usb 7-1: USB disconnect, device number 2 [ 395.283468][ T10] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 395.319711][ T5915] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 395.350153][ T5915] cyberjack 7-1:0.69: device disconnected [ 395.441472][ T43] usb 4-1: USB disconnect, device number 84 [ 395.453481][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 395.471993][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 395.488679][ T10] usb 2-1: config 14 has an invalid interface number: 115 but max is 0 [ 395.501026][ T10] usb 2-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 395.521721][ T10] usb 2-1: config 14 has no interface number 0 [ 395.532885][ T10] usb 2-1: config 14 interface 115 has no altsetting 0 [ 395.546572][ T10] usb 2-1: New USB device found, idVendor=04e2, idProduct=1420, bcdDevice= 2.73 [ 395.557756][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.568646][ T10] usb 2-1: Product: syz [ 395.573494][ T10] usb 2-1: Manufacturer: syz [ 395.579349][ T10] usb 2-1: SerialNumber: syz [ 395.733589][ T5915] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 395.791461][T13639] 9p: Bad value for 'rfdno' [ 395.812808][ T10] usb 2-1: USB disconnect, device number 82 [ 395.903607][ T5915] usb 7-1: Using ep0 maxpacket: 32 [ 395.911040][ T5915] usb 7-1: config 0 has an invalid interface number: 184 but max is 0 [ 395.919427][ T5915] usb 7-1: config 0 has no interface number 0 [ 395.926279][ T5915] usb 7-1: config 0 interface 184 has no altsetting 0 [ 395.936585][ T5915] usb 7-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 395.948631][ T5915] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.958999][ T5915] usb 7-1: Product: syz [ 395.964541][ T5915] usb 7-1: Manufacturer: syz [ 395.969203][ T5915] usb 7-1: SerialNumber: syz [ 395.976679][ T5915] usb 7-1: config 0 descriptor?? [ 395.985168][ T5915] smsc75xx v1.0.0 [ 396.222499][ T5915] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 396.251088][ T5915] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 396.291317][ T5915] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 396.304629][ T5915] smsc75xx 7-1:0.184: probe with driver smsc75xx failed with error -71 [ 396.322099][ T5915] usb 7-1: USB disconnect, device number 3 [ 396.452764][T13649] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 396.485221][ T5839] Bluetooth: hci1: command tx timeout [ 396.676826][T13657] kvm: kvm [13655]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010058) = 0x4 [ 396.688350][T13657] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1738'. [ 396.699811][T13656] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1738'. [ 396.753615][ T5915] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 396.804787][ T43] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 396.915675][ T5915] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 396.929243][ T5915] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 396.939899][ T5915] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 396.945587][ T43] usb 4-1: device descriptor read/64, error -71 [ 396.951842][ T5915] usb 7-1: config 0 descriptor?? [ 397.037418][ T5914] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 397.103076][T13666] overlayfs: failed to clone upperpath [ 397.110188][T13666] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 397.119422][T13666] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 397.130035][T13666] overlayfs: missing 'lowerdir' [ 397.204865][ T5914] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 397.213423][ T43] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 397.214129][ T5914] usb 2-1: config 1 has no interface number 0 [ 397.227676][ T5914] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 397.239450][ T5914] usb 2-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 397.248711][ T5914] usb 2-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 397.260445][ T5914] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 397.272854][ T5914] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 397.292734][ T5914] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 397.302093][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.310925][ T5914] usb 2-1: Product: syz [ 397.315644][ T5914] usb 2-1: Manufacturer: syz [ 397.321081][ T5914] usb 2-1: SerialNumber: syz [ 397.353567][ T43] usb 4-1: device descriptor read/64, error -71 [ 397.377774][ T5915] keytouch 0003:0926:3333.0022: fixing up Keytouch IEC report descriptor [ 397.391022][ T5915] input: HID 0926:3333 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:0926:3333.0022/input/input55 [ 397.464107][ T43] usb usb4-port1: attempt power cycle [ 397.496486][ T5915] keytouch 0003:0926:3333.0022: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.6-1/input0 [ 397.535719][T13659] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 397.584334][T13650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 397.593141][T13650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 397.607248][ C0] kbd_keycode: 342 callbacks suppressed [ 397.607267][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.621554][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.629298][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.636436][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.642899][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.649646][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.656247][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.663564][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.670237][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.678044][ C0] keyboard: can't emulate rawmode for keycode 240 [ 397.803524][ T43] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 397.825576][ T43] usb 4-1: device descriptor read/8, error -71 [ 398.032968][ T5915] usb 7-1: USB disconnect, device number 4 [ 398.063287][ T43] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 398.103967][ T43] usb 4-1: device descriptor read/8, error -71 [ 398.158382][T13659] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 398.168685][ T5914] cdc_ncm 2-1:1.1: bind() failure [ 398.224009][ T43] usb usb4-port1: unable to enumerate USB device [ 398.563901][ T5839] Bluetooth: hci1: command tx timeout [ 398.729388][T13687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.738849][T13687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.757341][ T5914] usb 2-1: USB disconnect, device number 83 [ 398.797033][T13691] fuse: Unknown parameter '00000000000000000000004' [ 398.836126][T13691] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1749'. [ 398.913468][ T5926] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 399.043948][ T5926] usb 7-1: device descriptor read/64, error -71 [ 399.284336][ T5926] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 399.413406][ T5926] usb 7-1: device descriptor read/64, error -71 [ 399.524339][ T5926] usb usb7-port1: attempt power cycle [ 399.754504][T13712] netlink: 'syz.5.1758': attribute type 64 has an invalid length. [ 399.754504][T13711] netlink: 'syz.5.1758': attribute type 64 has an invalid length. [ 399.754527][T13711] netlink: 5 bytes leftover after parsing attributes in process `syz.5.1758'. [ 399.762603][T13712] netlink: 5 bytes leftover after parsing attributes in process `syz.5.1758'. [ 399.883302][ T5926] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 399.904039][ T5926] usb 7-1: device descriptor read/8, error -71 [ 399.963301][ T5914] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 400.123357][ T5914] usb 4-1: Using ep0 maxpacket: 32 [ 400.131853][ T5914] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 400.141129][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.152720][ T5914] usb 4-1: config 0 descriptor?? [ 400.153312][ T5926] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 400.164740][ T5914] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 400.194129][ T5926] usb 7-1: device descriptor read/8, error -71 [ 400.305227][ T5926] usb usb7-port1: unable to enumerate USB device [ 400.370645][T13701] binder: BINDER_SET_CONTEXT_MGR already set [ 400.376734][T13701] binder: 13700:13701 ioctl 4018620d 200000000040 returned -16 [ 400.385005][T13701] binder: 13700:13701 ioctl c0306201 2000000003c0 returned -14 [ 400.628983][T13730] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1763'. [ 400.643300][ T5839] Bluetooth: hci1: command tx timeout [ 401.905154][ T5914] gspca_vc032x: reg_w err -71 [ 401.916491][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 401.929238][T13767] befs: (nullb0): invalid magic header [ 401.935288][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 401.941088][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 401.965358][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 401.970693][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 401.996424][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.002301][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.010241][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.036281][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.041600][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.059053][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.067345][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.073040][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.085502][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.091954][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.101718][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.108527][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.114152][ T5914] gspca_vc032x: I2c Bus Busy Wait 00 [ 402.121422][ T5914] gspca_vc032x: Unknown sensor... [ 402.127249][ T5914] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 402.140076][ T5914] usb 4-1: USB disconnect, device number 89 [ 402.333325][ T43] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 402.488707][ T43] usb 7-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 402.499403][ T43] usb 7-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 402.521843][ T43] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.542543][ T43] aiptek 7-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 402.742969][ T5914] usb 7-1: USB disconnect, device number 9 [ 403.063292][ T43] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 403.216185][ T43] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 403.224426][ T43] usb 4-1: config 1 has no interface number 0 [ 403.230535][ T43] usb 4-1: config 1 interface 7 altsetting 0 endpoint 0x2 has an invalid bInterval 144, changing to 11 [ 403.243689][ T43] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 403.261472][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.273298][ T43] usb 4-1: Product: syz [ 403.277497][ T43] usb 4-1: Manufacturer: syz [ 403.282108][ T43] usb 4-1: SerialNumber: syz [ 403.299799][T13806] netlink: 'syz.6.1786': attribute type 10 has an invalid length. [ 403.312834][T13806] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1786'. [ 403.314622][ T43] usb 4-1: Error in usbnet_get_endpoints (-22) [ 403.346999][T13806] team0: Port device geneve0 added [ 403.478991][T13810] netlink: 'syz.5.1788': attribute type 3 has an invalid length. [ 403.643370][ T5914] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 403.686808][T13819] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1791'. [ 403.803295][ T5914] usb 7-1: Using ep0 maxpacket: 16 [ 403.810239][ T5914] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 403.826648][ T5914] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 403.840354][ T5914] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 403.854596][ T5914] usb 7-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 403.864153][ T5914] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.878206][ T5914] usb 7-1: Product: syz [ 403.882464][ T5914] usb 7-1: Manufacturer: syz [ 403.887833][ T5914] usb 7-1: SerialNumber: syz [ 403.899115][ T5914] usb 7-1: config 0 descriptor?? [ 403.906673][T13808] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 403.917208][ T5914] hub 7-1:0.0: bad descriptor, ignoring hub [ 403.924527][ T5914] hub 7-1:0.0: probe with driver hub failed with error -5 [ 403.935281][ T5914] input: syz syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input57 [ 404.229650][T13828] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 404.238550][T13828] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.240260][ T43] usb 7-1: USB disconnect, device number 10 [ 405.188007][T13853] loop2: detected capacity change from 0 to 7 [ 405.198452][T13853] Dev loop2: unable to read RDB block 7 [ 405.205709][T13853] loop2: unable to read partition table [ 405.211557][T13853] loop2: partition table beyond EOD, truncated [ 405.218030][T13853] loop_reread_partitions: partition scan of loop2 (þ賫xü—ŸÑà– ) failed (rc=-5) [ 405.237625][ T6564] udevd[6564]: symlink '../../loop2' '/dev/disk/by-diskseq/94.tmp-b7:2' failed: Read-only file system [ 405.272109][ T6564] udevd[6564]: symlink '../../loop2' '/dev/disk/by-diskseq/94.tmp-b7:2' failed: Read-only file system [ 405.309874][T13859] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 405.320265][ T6564] udevd[6564]: symlink '../../loop2' '/dev/disk/by-diskseq/94.tmp-b7:2' failed: Read-only file system [ 405.723291][ T43] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 405.844712][T13828] [U] ^B [ 405.849244][ T5915] usb 4-1: USB disconnect, device number 90 [ 405.884239][ T43] usb 7-1: Using ep0 maxpacket: 32 [ 405.900534][ T43] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 405.920504][ T43] usb 7-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 405.930634][ T43] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.939646][ T43] usb 7-1: Product: syz [ 405.950297][ T43] usb 7-1: Manufacturer: syz [ 405.957403][ T43] usb 7-1: SerialNumber: syz [ 405.965382][ T43] usb 7-1: config 0 descriptor?? [ 405.985633][T13870] fuse: Bad value for 'fd' [ 406.009909][T13870] netlink: 'syz.5.1810': attribute type 25 has an invalid length. [ 406.015699][ T29] kauditd_printk_skb: 342 callbacks suppressed [ 406.015715][ T29] audit: type=1326 audit(1769448791.481:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13872 comm="syz.1.1811" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5ebaf9aeb9 code=0x0 [ 406.197036][T13863] netlink: 'syz.6.1807': attribute type 58 has an invalid length. [ 406.220814][ T6123] usb 7-1: USB disconnect, device number 11 [ 406.293295][ T5915] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 406.423274][ T5915] usb 4-1: device descriptor read/64, error -71 [ 406.676494][ T5915] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 406.813271][ T5915] usb 4-1: device descriptor read/64, error -71 [ 406.923655][ T5915] usb usb4-port1: attempt power cycle [ 407.263322][ T5915] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 407.306627][ T5915] usb 4-1: device descriptor read/8, error -71 [ 407.544517][ T5915] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 407.576036][ T5915] usb 4-1: device descriptor read/8, error -71 [ 407.669172][T13898] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 407.675631][T13898] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 407.695252][ T5915] usb usb4-port1: unable to enumerate USB device [ 407.763573][ T5914] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 407.903422][ T5914] usb 7-1: device descriptor read/64, error -71 [ 408.144146][ T5914] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 408.293302][ T5914] usb 7-1: device descriptor read/64, error -71 [ 408.403827][ T5914] usb usb7-port1: attempt power cycle [ 408.753288][ T5914] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 408.774009][ T5914] usb 7-1: device descriptor read/8, error -71 [ 409.023287][ T5914] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 409.044269][ T5914] usb 7-1: device descriptor read/8, error -71 [ 409.142572][T13921] af_packet: tpacket_rcv: packet too big, clamped from 36 to 4294967272. macoff=96 [ 409.165932][ T5914] usb usb7-port1: unable to enumerate USB device [ 409.323248][ T43] usb 4-1: new low-speed USB device number 95 using dummy_hcd [ 409.353743][T13931] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1832'. [ 409.362966][T13931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1832'. [ 409.378027][T13931] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1832'. [ 409.388151][T13931] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1832'. [ 409.475036][ T43] usb 4-1: No LPM exit latency info found, disabling LPM. [ 409.486541][ T43] usb 4-1: string descriptor 0 read error: -22 [ 409.492862][ T43] usb 4-1: New USB device found, idVendor=1415, idProduct=0003, bcdDevice=65.5d [ 409.525257][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.537757][ T43] usb 4-1: config 0 descriptor?? [ 409.748195][T13910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.760205][T13910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.771087][ T43] dvb-usb: found a 'Sony PlayTV' in cold state, will try to load a firmware [ 409.810108][ T43] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 409.818448][ T43] dib0700: firmware download failed at 7 with -22 [ 409.830927][ T43] usb 4-1: USB disconnect, device number 95 [ 410.569181][ T43] usb 4-1: new low-speed USB device number 96 using dummy_hcd [ 410.574612][T13969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.590612][T13969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.601237][T13969] netlink: 'syz.6.1842': attribute type 6 has an invalid length. [ 410.609089][T13969] netlink: 168 bytes leftover after parsing attributes in process `syz.6.1842'. [ 410.619224][ T5839] Bluetooth: hci1: unknown advertising packet type: 0x17 [ 410.664597][T13973] binder: Bad value for 'stats' [ 410.734851][ T43] usb 4-1: Invalid ep0 maxpacket: 32 [ 410.818537][ T29] audit: type=1326 audit(1769448796.291:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13978 comm="syz.5.1847" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6425b9aeb9 code=0x0 [ 410.873370][ T43] usb 4-1: new low-speed USB device number 97 using dummy_hcd [ 410.923264][ T922] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 411.033269][ T43] usb 4-1: Invalid ep0 maxpacket: 32 [ 411.039366][ T43] usb usb4-port1: attempt power cycle [ 411.053312][ T922] usb 7-1: device descriptor read/64, error -71 [ 411.305585][ T922] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 411.383503][ T43] usb 4-1: new low-speed USB device number 98 using dummy_hcd [ 411.403968][ T43] usb 4-1: Invalid ep0 maxpacket: 32 [ 411.453240][ T922] usb 7-1: device descriptor read/64, error -71 [ 411.533437][ T43] usb 4-1: new low-speed USB device number 99 using dummy_hcd [ 411.553889][ T43] usb 4-1: Invalid ep0 maxpacket: 32 [ 411.559549][ T43] usb usb4-port1: unable to enumerate USB device [ 411.566566][ T922] usb usb7-port1: attempt power cycle [ 411.898489][T13989] 9p: Bad value for 'rfdno' [ 411.914286][ T922] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 411.934021][ T922] usb 7-1: device descriptor read/8, error -71 [ 412.173425][ T922] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 412.194048][ T922] usb 7-1: device descriptor read/8, error -71 [ 412.304215][ T922] usb usb7-port1: unable to enumerate USB device [ 412.578041][T13995] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1853'. [ 412.587748][T13993] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1853'. [ 413.721058][ T29] audit: type=1326 audit(1769448799.191:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14016 comm="syz.6.1861" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7eff7659aeb9 code=0x0 [ 414.083435][ T922] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 414.243619][ T922] usb 7-1: Using ep0 maxpacket: 8 [ 414.251637][ T922] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 414.269917][ T6123] IPVS: starting estimator thread 0... [ 414.270247][ T922] usb 7-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 414.285601][ T922] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.295507][ T922] usb 7-1: Product: syz [ 414.299779][ T922] usb 7-1: Manufacturer: syz [ 414.305609][ T922] usb 7-1: SerialNumber: syz [ 414.315805][ T922] usb 7-1: config 0 descriptor?? [ 414.330789][ T922] gspca_main: stk014-2.14.0 probing 05e1:0893 [ 414.338037][ T922] usb 7-1: selecting invalid altsetting 1 [ 414.373814][T14034] IPVS: using max 32 ests per chain, 76800 per kthread [ 414.424429][T14039] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 414.431818][T14039] overlayfs: failed to set xattr on upper [ 414.440283][T14039] overlayfs: ...falling back to redirect_dir=nofollow. [ 414.447707][T14039] overlayfs: ...falling back to index=off. [ 414.454663][T14039] overlayfs: ...falling back to uuid=null. [ 414.460622][T14039] overlayfs: ...falling back to xino=off. [ 414.688760][T14055] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1874'. [ 414.782065][T14060] block device autoloading is deprecated and will be removed. [ 414.871460][ T922] gspca_stk014: reg_r err -110 [ 414.876524][ T922] stk014 7-1:0.0: probe with driver stk014 failed with error -110 [ 414.942894][T14069] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1878'. [ 415.145749][T14086] xt_NFQUEUE: number of queues (63489) out of range (got 96768) [ 415.216074][T14089] 9pnet_fd: Insufficient options for proto=fd [ 416.044209][T14124] overlayfs: failed to clone lowerpath [ 416.869863][ T6123] usb 7-1: USB disconnect, device number 20 [ 416.989215][T14142] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 416.989788][T14143] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 417.008485][T14142] fuse: Bad value for 'fd' [ 417.008485][T14143] fuse: Bad value for 'fd' [ 417.013040][ T29] audit: type=1326 audit(1769448802.326:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14141 comm="syz.6.1904" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7eff7659aeb9 code=0x0 [ 417.013139][ T29] audit: type=1326 audit(1769448802.326:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14141 comm="syz.6.1904" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7eff7659aeb9 code=0x0 [ 418.242715][T14173] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 418.272305][T14173] CIFS mount error: No usable UNC path provided in device string! [ 418.272305][T14173] [ 418.283255][T14173] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 419.667222][T14212] overlayfs: failed to clone upperpath [ 419.708716][ T29] audit: type=1326 audit(1769448804.851:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14213 comm="syz.6.1927" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7eff7659aeb9 code=0x0 [ 420.846975][T14229] Invalid source name [ 420.851107][T14229] UBIFS error (pid: 14229): cannot open "./file0", error -22 [ 421.302066][T14246] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1941'. [ 421.322999][T14246] openvswitch: netlink: Missing key (keys=40, expected=80) [ 421.644147][T14266] netlink: 'syz.3.1944': attribute type 28 has an invalid length. [ 441.695486][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 441.701923][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 452.549892][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 452.566281][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 452.576041][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 452.628841][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 452.648718][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 452.659798][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 452.753505][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 452.766086][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 452.776086][T14285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1947'. [ 453.943901][T14346] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1964'. [ 454.070211][T14346] pim6reg: entered allmulticast mode [ 454.249542][T14366] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 454.272213][T14368] overlayfs: failed to clone lowerpath [ 454.281529][T14368] fuse: Bad value for 'fd' [ 454.351176][T14370] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 454.408010][T14374] @0Ù: renamed from bond_slave_1 (while UP) [ 455.802905][T14426] netlink: 'syz.6.1990': attribute type 21 has an invalid length. [ 455.810935][T14426] netlink: 'syz.6.1990': attribute type 22 has an invalid length. [ 456.933193][T14470] sit0: entered promiscuous mode [ 456.941005][T14470] netlink: 'syz.1.2007': attribute type 1 has an invalid length. [ 457.322533][T14493] netlink: 'syz.1.2014': attribute type 13 has an invalid length. [ 457.458473][T14502] openvswitch: netlink: Multiple metadata blocks provided [ 457.562157][T14510] ptrace attach of "./syz-executor exec"[13568] was attempted by "./syz-executor exec"[14510] [ 457.862149][T14529] CIFS mount error: No usable UNC path provided in device string! [ 457.862149][T14529] [ 457.872538][T14529] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 457.911624][T14635] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 458.326171][T14747] IPv6: NLM_F_CREATE should be specified when creating new route [ 458.334562][T14747] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 458.341857][T14747] IPv6: NLM_F_CREATE should be set when creating new route [ 458.349128][T14747] IPv6: NLM_F_CREATE should be set when creating new route [ 458.358456][T14747] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 458.473955][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.474081][ T5839] Bluetooth: hci0: connection err: -111 [ 458.493350][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.493391][ T5839] Bluetooth: hci0: connection err: -111 [ 458.506174][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.506209][ T5839] Bluetooth: hci0: connection err: -111 [ 458.519278][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.519319][ T5839] Bluetooth: hci0: connection err: -111 [ 458.533129][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.533166][ T5839] Bluetooth: hci0: connection err: -111 [ 458.546049][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.546085][ T5839] Bluetooth: hci0: connection err: -111 [ 458.558844][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.558876][ T5839] Bluetooth: hci0: connection err: -111 [ 458.571714][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.571751][ T5839] Bluetooth: hci0: connection err: -111 [ 458.584535][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.584573][ T5839] Bluetooth: hci0: connection err: -111 [ 458.599445][ T5839] Bluetooth: hci0: unexpected event 0x04 length: 12 > 10 [ 458.599483][ T5839] Bluetooth: hci0: connection err: -111 [ 458.613636][ T5839] Bluetooth: hci0: connection err: -111 [ 458.620004][ T5839] Bluetooth: hci0: connection err: -111 [ 458.625665][ T5839] Bluetooth: hci0: connection err: -111 [ 458.631761][ T5839] Bluetooth: hci0: connection err: -111 [ 458.637413][ T5839] Bluetooth: hci0: connection err: -111 [ 458.643138][ T5839] Bluetooth: hci0: connection err: -111 [ 458.648780][ T5839] Bluetooth: hci0: connection err: -111 [ 458.654825][ T5839] Bluetooth: hci0: connection err: -111 [ 458.660472][ T5839] Bluetooth: hci0: connection err: -111 [ 458.666214][ T5839] Bluetooth: hci0: connection err: -111 [ 458.671946][ T5839] Bluetooth: hci0: connection err: -111 [ 458.678019][ T5839] Bluetooth: hci0: connection err: -111 [ 458.685003][ T5839] Bluetooth: hci0: connection err: -111 [ 458.690660][ T5839] Bluetooth: hci0: connection err: -111 [ 458.697866][ T5839] Bluetooth: hci0: connection err: -111 [ 458.703533][ T5839] Bluetooth: hci0: connection err: -111 [ 458.712689][ T5839] Bluetooth: hci0: connection err: -111 [ 458.718724][ T5839] Bluetooth: hci0: connection err: -111 [ 458.724368][ T5839] Bluetooth: hci0: connection err: -111 [ 458.730171][ T5839] Bluetooth: hci0: connection err: -111 [ 458.735993][ T5839] Bluetooth: hci0: connection err: -111 [ 458.741655][ T5839] Bluetooth: hci0: connection err: -111 [ 458.747357][ T5839] Bluetooth: hci0: connection err: -111 [ 458.798673][T14764] netlink: 'syz.3.2037': attribute type 11 has an invalid length. [ 458.808947][T14764] __nla_validate_parse: 6 callbacks suppressed [ 458.808966][T14764] netlink: 199828 bytes leftover after parsing attributes in process `syz.3.2037'. [ 460.026949][ T29] audit: type=1800 audit(1769448842.555:39): pid=14795 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2048" name="bus" dev="tmpfs" ino=843 res=0 errno=0 [ 460.905455][T14822] infiniband: Added to hash: ib_dev=ffff8880585e4000 (0)() ndev=ffff88805c498000 (11)(syzkaller0) [ 460.938283][T14822] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 460.958798][T14822] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 461.328765][T14840] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2061'. [ 461.330164][T14845] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2061'. [ 461.342081][T14840] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2061'. [ 461.358133][T14844] overlayfs: failed to clone upperpath [ 461.367418][T14845] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2061'. [ 461.588387][T14857] netlink: 'syz.5.2068': attribute type 9 has an invalid length. [ 461.597647][T14857] netlink: 'syz.5.2068': attribute type 11 has an invalid length. [ 461.606817][T14857] netlink: 'syz.5.2068': attribute type 12 has an invalid length. [ 461.617260][T14857] netlink: 210020 bytes leftover after parsing attributes in process `syz.5.2068'. [ 461.627107][T14857] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2068'. [ 462.664686][T14982] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2077'. [ 462.867799][T14998] netlink: 'syz.3.2081': attribute type 39 has an invalid length. [ 462.922003][T15004] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 464.033426][T15022] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2091'. [ 464.639726][T15041] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 465.819821][T15073] infiniband: Added to hash: ib_dev=ffff888047a70000 (0)() ndev=ffff88807e98e000 (22)(lo) [ 465.831212][T15073] infiniband: Removed from hash: ib_dev=ffff888047a70000 (0)() ndev=ffff88807e98e000 (22)(lo) [ 465.842864][T15073] rdma_rxe: rxe_newlink: failed to add lo [ 465.917136][T15075] netlink: 236 bytes leftover after parsing attributes in process `syz.5.2108'. [ 465.929944][T15075] netlink: 236 bytes leftover after parsing attributes in process `syz.5.2108'. [ 467.028310][T15123] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 467.690867][T15145] IPv4: Oversized IP packet from 172.20.20.170 [ 467.700767][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 467.707409][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 467.746613][T15145] IPv4: Oversized IP packet from 172.20.20.170 [ 467.753432][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 467.759831][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 467.769532][T15145] IPv4: Oversized IP packet from 172.20.20.170 [ 467.776380][ C1] IPv4: Oversized IP packet from 172.20.20.170 [ 468.198206][T15163] tipc: Started in network mode [ 468.203342][T15163] tipc: Node identity ac141441, cluster identity 4711 [ 468.224383][T15163] tipc: Enabled bearer , priority 10 [ 468.233738][ T29] audit: type=1326 audit(1769448850.232:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15165 comm="syz.5.2140" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6425b9aeb9 code=0x0 [ 468.784805][T15192] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2146'. [ 469.227196][T15203] cgroup: name respecified [ 469.233935][T15210] cgroup: name respecified [ 469.416123][ T5926] tipc: Node number set to 2886997057 [ 469.498667][T15230] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 469.516703][T15230] futex_wake_op: syz.5.2157 tries to shift op by -1; fix this program [ 469.650956][T15240] 9p: Bad value for 'rfdno' [ 469.676090][T15241] 9p: Bad value for 'rfdno' [ 469.763044][T15247] netlink: 'syz.5.2163': attribute type 10 has an invalid length. [ 469.791919][T15247] bridge0: port 2(bridge_slave_1) entered disabled state [ 469.804624][T15247] bridge_slave_1: left allmulticast mode [ 469.810335][T15247] bridge_slave_1: left promiscuous mode [ 469.825738][T15247] bridge0: port 2(bridge_slave_1) entered disabled state [ 469.843408][T15247] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 470.327717][T15262] netlink: 'syz.1.2168': attribute type 2 has an invalid length. [ 470.338983][T15262] netlink: 164 bytes leftover after parsing attributes in process `syz.1.2168'. [ 470.460665][T15269] netlink: 'syz.1.2171': attribute type 21 has an invalid length. [ 470.539202][T15273] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2172'. [ 470.548626][T15272] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2172'. [ 470.558807][T15273] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2172'. [ 470.569431][T15272] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2172'. [ 470.863172][T15283] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2175'. [ 471.797259][T15315] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2186'. [ 471.834154][T15315] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2186'. [ 471.843796][T15315] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2186'. [ 471.853711][T15315] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2186'. [ 471.882684][ T5840] Bluetooth: hci0: command 0x2016 tx timeout [ 472.050857][T15332] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2189'. [ 472.663265][T15348] netlink: 'syz.1.2196': attribute type 9 has an invalid length. [ 472.671622][T15348] netlink: 'syz.1.2196': attribute type 11 has an invalid length. [ 472.679456][T15348] netlink: 'syz.1.2196': attribute type 12 has an invalid length. [ 472.693227][T15348] netlink: 210020 bytes leftover after parsing attributes in process `syz.1.2196'. [ 472.703478][T15348] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2196'. [ 472.748131][T15353] netlink: 'syz.3.2197': attribute type 1 has an invalid length. [ 472.757453][T15354] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2197'. [ 472.774501][T15354] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2197'. [ 472.784442][T15354] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2197'. [ 473.225729][T15372] netlink: 'syz.6.2204': attribute type 39 has an invalid length. [ 473.734043][T15386] netlink: 'syz.5.2209': attribute type 27 has an invalid length. [ 473.756282][T15386] net_ratelimit: 88 callbacks suppressed [ 473.756293][T15386] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 474.103036][ T5839] Bluetooth: hci0: command 0x2016 tx timeout [ 474.659600][T15420] netlink: 'syz.5.2221': attribute type 10 has an invalid length. [ 474.694044][T15420] team0: Port device dummy0 added [ 475.528612][T15444] netlink: 'syz.5.2230': attribute type 1 has an invalid length. [ 475.608886][T15450] netlink: 'syz.5.2231': attribute type 32 has an invalid length. [ 476.191454][T15463] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 476.200905][T15463] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 476.209277][T15463] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 476.218802][T15463] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 476.929439][T15501] netlink: 'syz.3.2252': attribute type 2 has an invalid length. [ 476.969566][ T29] audit: type=1326 audit(1769448858.405:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15503 comm="syz.5.2253" exe="/root/syz-executor" sig=31 arch=c000003e syscall=317 compat=0 ip=0x7f6425b9aeb9 code=0x0 [ 477.603621][T15529] sctp: [Deprecated]: syz.6.2261 (pid 15529) Use of struct sctp_assoc_value in delayed_ack socket option. [ 477.603621][T15529] Use struct sctp_sack_info instead [ 478.222043][T15542] __nla_validate_parse: 69 callbacks suppressed [ 478.222060][T15542] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2267'. [ 478.586345][T15552] netlink: 592 bytes leftover after parsing attributes in process `syz.5.2270'. [ 478.695222][T15559] syz.1.2273 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 479.270668][T15574] 8021q: VLANs not supported on ipvlan0 [ 479.365979][T15578] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 479.933593][T15608] netlink: 'syz.6.2289': attribute type 10 has an invalid length. [ 479.949449][T15608] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 480.229196][T15616] netlink: zone id is out of range [ 480.234786][T15616] netlink: zone id is out of range [ 480.240096][T15616] netlink: zone id is out of range [ 480.245853][T15616] netlink: zone id is out of range [ 480.329184][T15623] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2295'. [ 480.480779][T15633] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2298'. [ 480.563593][T15637] 9p: Invalid uid '0x00000000ffffffff' [ 480.618505][T15640] netlink: 'syz.6.2301': attribute type 2 has an invalid length. [ 480.629368][T15640] netlink: 'syz.6.2301': attribute type 1 has an invalid length. [ 480.685977][T15642] netlink: 'syz.6.2302': attribute type 4 has an invalid length. [ 480.690674][T15644] netlink: 'syz.6.2302': attribute type 4 has an invalid length. [ 480.753605][T15646] netlink: 'syz.6.2303': attribute type 21 has an invalid length. [ 480.766709][T15646] netlink: 132 bytes leftover after parsing attributes in process `syz.6.2303'. [ 481.070156][T15670] IPVS: sync thread started: state = MASTER, mcast_ifn = batadv_slave_1, syncid = 0, id = 0 [ 482.376059][T15703] netlink: 'syz.1.2324': attribute type 1 has an invalid length. [ 482.392800][T15703] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2324'. [ 482.844540][T15725] 9p: Bad value for 'rfdno' [ 483.032546][ T29] audit: type=1326 audit(1769448864.072:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15738 comm="syz.1.2337" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5ebaf9aeb9 code=0x0 [ 483.392722][T15742] netlink: 'syz.6.2338': attribute type 10 has an invalid length. [ 483.421315][T15742] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 485.603813][T15822] netlink: 'syz.5.2368': attribute type 6 has an invalid length. [ 485.686783][T15824] tipc: Enabling of bearer rejected, failed to enable media [ 485.701148][T15825] tipc: Enabling of bearer rejected, failed to enable media [ 485.744864][T15829] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.2370'. [ 485.755289][T15829] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 485.977169][ T5839] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 485.988591][ T5839] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 485.999823][ T5839] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 486.010332][ T5839] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 486.018746][ T5839] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 486.343794][ T58] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.415512][ T58] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.459469][T15836] chnl_net:caif_netlink_parms(): no params data found [ 486.483715][ T58] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.567470][ T58] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.612174][T15836] bridge0: port 1(bridge_slave_0) entered blocking state [ 486.621269][T15836] bridge0: port 1(bridge_slave_0) entered disabled state [ 486.629799][T15836] bridge_slave_0: entered allmulticast mode [ 486.638916][T15836] bridge_slave_0: entered promiscuous mode [ 486.652309][T15836] bridge0: port 2(bridge_slave_1) entered blocking state [ 486.661446][T15836] bridge0: port 2(bridge_slave_1) entered disabled state [ 486.670248][T15836] bridge_slave_1: entered allmulticast mode [ 486.678591][T15836] bridge_slave_1: entered promiscuous mode [ 486.738381][T15836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 486.770180][T15836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 486.817417][T15836] team0: Port device team_slave_0 added [ 486.847787][T15836] team0: Port device team_slave_1 added [ 486.855305][ T58] bridge_slave_1: left allmulticast mode [ 486.862337][ T58] bridge_slave_1: left promiscuous mode [ 486.868146][ T58] bridge0: port 2(bridge_slave_1) entered disabled state [ 486.881330][ T58] bridge_slave_0: left allmulticast mode [ 486.887569][ T58] bridge_slave_0: left promiscuous mode [ 486.895155][ T58] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.223915][ T58] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 487.300240][ T58] ***** Releasing 0 refcount on 0000000000000000 [ 487.309580][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 487.322955][ T58] bond0 (unregistering): (slave c@0Ù): Releasing backup interface [ 487.336420][ T58] bond0 (unregistering): Released all slaves [ 487.407611][T15836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 487.424030][T15836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 487.450643][T15836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 487.466241][T15836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 487.473950][T15836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 487.504844][T15836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 487.603646][T15836] hsr_slave_0: entered promiscuous mode [ 487.614797][T15836] hsr_slave_1: entered promiscuous mode [ 487.622557][T15836] debugfs: 'hsr0' already exists in 'hsr' [ 487.628827][T15836] Cannot create hsr debugfs directory [ 488.219156][ T5839] Bluetooth: hci4: command tx timeout [ 488.284046][ T58] hsr_slave_0: left promiscuous mode [ 488.296853][ T58] hsr_slave_1: left promiscuous mode [ 488.322582][ T58] veth1_macvtap: left promiscuous mode [ 488.328291][ T58] veth0_macvtap: left promiscuous mode [ 488.442068][ T58] pimreg (unregistering): left allmulticast mode [ 488.815548][ T58] team0 (unregistering): Port device team_slave_1 removed [ 488.864118][ T58] team0 (unregistering): Port device team_slave_0 removed [ 489.562845][T15836] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 489.581317][T15836] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 489.612257][T15836] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 489.638763][ T58] IPVS: stop unused estimator thread 0... [ 489.647920][T15836] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 489.867452][T15836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 489.909447][T15836] 8021q: adding VLAN 0 to HW filter on device team0 [ 489.924770][ T1129] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.932018][ T1129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 489.949717][ T3513] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.956870][ T3513] bridge0: port 2(bridge_slave_1) entered forwarding state [ 490.182940][T15836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 490.230140][T15836] veth0_vlan: entered promiscuous mode [ 490.242808][T15836] veth1_vlan: entered promiscuous mode [ 490.271525][T15836] veth0_macvtap: entered promiscuous mode [ 490.281752][T15836] veth1_macvtap: entered promiscuous mode [ 490.300952][T15836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 490.316737][T15836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 490.331665][ T58] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.342883][ T58] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.352671][ T58] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.363133][ T58] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 490.438053][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.446759][ T5839] Bluetooth: hci4: command tx timeout [ 490.456779][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.494090][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.503464][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.523235][T15945] netlink: 'syz.5.2393': attribute type 9 has an invalid length. [ 490.534147][T15945] netlink: 'syz.5.2393': attribute type 11 has an invalid length. [ 490.542167][T15945] netlink: 'syz.5.2393': attribute type 12 has an invalid length. [ 490.550411][T15945] netlink: 210020 bytes leftover after parsing attributes in process `syz.5.2393'. [ 490.559913][T15945] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2393'. [ 491.308329][ T922] IPVS: starting estimator thread 0... [ 491.416914][T15969] IPVS: using max 39 ests per chain, 93600 per kthread [ 491.735672][T16002] gretap0: entered promiscuous mode [ 491.743429][T16002] gretap0: entered allmulticast mode [ 491.759531][T16002] netlink: 'syz.1.2411': attribute type 2 has an invalid length. [ 492.292510][T16025] 9p: Bad value for 'rfdno' [ 492.668935][ T5839] Bluetooth: hci4: command tx timeout [ 492.732793][T16034] netlink: 'syz.6.2422': attribute type 27 has an invalid length. [ 492.741376][T16034] netlink: 212368 bytes leftover after parsing attributes in process `syz.6.2422'. [ 494.631154][T16098] netlink: 76 bytes leftover after parsing attributes in process `syz.5.2446'. [ 494.873883][ T5839] Bluetooth: hci4: command tx timeout [ 495.042556][T16104] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 495.049522][T16104] overlayfs: failed to set xattr on upper [ 495.056411][T16104] overlayfs: ...falling back to redirect_dir=nofollow. [ 495.063801][T16104] overlayfs: ...falling back to index=off. [ 495.070371][T16104] overlayfs: ...falling back to uuid=null. [ 495.076277][T16104] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 495.884087][ T5840] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 495.896702][ T5840] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 495.907720][ T5840] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 495.916175][ T5840] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 495.923991][ T5840] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 496.222102][T16123] chnl_net:caif_netlink_parms(): no params data found [ 496.276538][T16133] netlink: 'syz.5.2458': attribute type 21 has an invalid length. [ 496.286360][T16133] netlink: 128 bytes leftover after parsing attributes in process `syz.5.2458'. [ 496.308361][T16133] netlink: 'syz.5.2458': attribute type 5 has an invalid length. [ 496.318855][T16133] netlink: 3 bytes leftover after parsing attributes in process `syz.5.2458'. [ 496.333416][T16133] fuse: blksize only supported for fuseblk [ 496.340095][T16135] netlink: 'syz.5.2458': attribute type 21 has an invalid length. [ 496.348734][T16135] netlink: 128 bytes leftover after parsing attributes in process `syz.5.2458'. [ 496.362046][T16135] netlink: 'syz.5.2458': attribute type 5 has an invalid length. [ 496.370362][T16135] netlink: 3 bytes leftover after parsing attributes in process `syz.5.2458'. [ 496.439306][ T13] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.460653][T16123] bridge0: port 1(bridge_slave_0) entered blocking state [ 496.468233][T16123] bridge0: port 1(bridge_slave_0) entered disabled state [ 496.476337][T16123] bridge_slave_0: entered allmulticast mode [ 496.484891][T16123] bridge_slave_0: entered promiscuous mode [ 496.494256][T16123] bridge0: port 2(bridge_slave_1) entered blocking state [ 496.501706][T16123] bridge0: port 2(bridge_slave_1) entered disabled state [ 496.509271][T16123] bridge_slave_1: entered allmulticast mode [ 496.520259][T16123] bridge_slave_1: entered promiscuous mode [ 496.564791][ T13] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.609603][T16123] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 496.625574][T16123] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 496.660162][ T13] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.742653][ T13] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.800109][T16123] team0: Port device team_slave_0 added [ 496.808863][T16123] team0: Port device team_slave_1 added [ 496.900442][T16123] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 496.912054][T16123] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 496.940111][T16123] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 496.954110][T16123] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 496.961973][T16123] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 496.990814][T16123] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 497.112952][T16123] hsr_slave_0: entered promiscuous mode [ 497.119873][T16123] hsr_slave_1: entered promiscuous mode [ 497.126959][T16123] debugfs: 'hsr0' already exists in 'hsr' [ 497.132703][T16123] Cannot create hsr debugfs directory [ 497.173744][ T13] bridge_slave_1: left allmulticast mode [ 497.182139][ T13] bridge_slave_1: left promiscuous mode [ 497.190091][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.200745][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.600466][ T13] dvmrp12 (unregistering): left allmulticast mode [ 497.722933][ T29] audit: type=1800 audit(1769448877.858:43): pid=16188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2469" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 497.768590][ T5840] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 497.852452][ T13] ***** Releasing 0 refcount on 0000000000000000 [ 497.852510][T16192] overlayfs: failed to clone lowerpath [ 497.869163][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 497.881537][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 497.892276][ T13] bond0 (unregistering): Released all slaves [ 498.007840][ T13] tipc: Disabling bearer [ 498.025518][ T13] tipc: Left network mode [ 498.074483][ T5840] Bluetooth: hci2: command tx timeout [ 498.103438][T16198] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2472'. [ 498.169886][ T13] IPVS: stopping master sync thread 15670 ... [ 498.194956][ T13] IPVS: stopping backup sync thread 10648 ... [ 498.330604][T16203] dvmrp1: entered allmulticast mode [ 498.505321][T16203] dvmrp1: left allmulticast mode [ 498.589414][ T5840] Bluetooth: hci0: command 0x2016 tx timeout [ 498.664059][ T13] hsr_slave_0: left promiscuous mode [ 498.683721][ T13] hsr_slave_1: left promiscuous mode [ 498.692975][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 498.701523][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 498.712800][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 498.720728][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 498.748143][ T13] veth1_macvtap: left promiscuous mode [ 498.759828][ T13] veth0_macvtap: left promiscuous mode [ 498.765446][ T13] veth1_vlan: left promiscuous mode [ 498.773765][ T13] veth0_vlan: left promiscuous mode [ 499.434831][ T13] team0 (unregistering): Port device team_slave_1 removed [ 499.482410][ T13] team0 (unregistering): Port device team_slave_0 removed [ 500.008804][T16234] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.2476'. [ 500.268000][ T5839] Bluetooth: hci2: command tx timeout [ 500.461143][T16123] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 500.502583][T16123] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 500.513651][T16123] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 500.547219][T16123] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 500.765389][T16123] 8021q: adding VLAN 0 to HW filter on device bond0 [ 500.821556][T16123] 8021q: adding VLAN 0 to HW filter on device team0 [ 500.843553][ T1129] bridge0: port 1(bridge_slave_0) entered blocking state [ 500.850826][ T1129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 500.884869][ T1129] bridge0: port 2(bridge_slave_1) entered blocking state [ 500.892115][ T1129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 500.979094][T16290] tmpfs: Unknown parameter 'usrquotaþÿÿÿ' [ 501.127450][T16302] xt_l2tp: unknown flags: 51 [ 501.285160][T16123] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 501.309871][T16310] fuse: Bad value for 'fd' [ 501.371564][T16123] veth0_vlan: entered promiscuous mode [ 501.391429][T16123] veth1_vlan: entered promiscuous mode [ 501.444974][T16123] veth0_macvtap: entered promiscuous mode [ 501.473152][T16123] veth1_macvtap: entered promiscuous mode [ 501.506519][T16123] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 501.533309][T16123] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 501.572708][ T1129] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.593239][ T1129] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.602903][ T1129] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.632823][ T1129] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 501.757973][ T3068] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 501.793542][ T3068] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 501.848945][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 501.868855][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 502.407625][T16338] batadv_slave_0: entered promiscuous mode [ 502.414550][T16339] batadv_slave_0: left promiscuous mode [ 502.475089][ T5839] Bluetooth: hci2: command tx timeout [ 502.757558][T16354] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2503'. [ 503.131404][T16368] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2509'. [ 503.179944][T16373] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2510'. [ 504.276189][T16391] netlink: 'syz.5.2517': attribute type 28 has an invalid length. [ 504.660983][ T5839] Bluetooth: hci2: command tx timeout [ 505.255401][T16434] pimreg: entered allmulticast mode [ 505.328354][T16438] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 505.765226][T16450] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2539'. [ 505.774287][T16450] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2539'. [ 505.921457][T16454] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2541'. [ 506.295755][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2544'. [ 506.306501][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2544'. [ 506.315825][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2544'. [ 506.325187][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2544'. [ 506.334910][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2544'. [ 506.344083][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2544'. [ 506.353617][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2544'. [ 506.857526][T16491] netlink: 'syz.6.2555': attribute type 2 has an invalid length. [ 506.872702][T16491] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 507.205512][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 507.212884][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 509.131907][T16561] netlink: 'syz.1.2582': attribute type 9 has an invalid length. [ 509.142178][T16561] netlink: 'syz.1.2582': attribute type 11 has an invalid length. [ 509.159497][T16561] netlink: 'syz.1.2582': attribute type 12 has an invalid length. [ 510.617838][ T29] audit: type=1326 audit(1769448890.058:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16584 comm="syz.5.2591" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6425b9aeb9 code=0x0 [ 511.136990][T16580] Process accounting resumed [ 511.379037][T16593] __nla_validate_parse: 6 callbacks suppressed [ 511.379049][T16593] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2594'. [ 511.400728][T16593] IPv4: Oversized IP packet from 172.20.20.24 [ 511.407943][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 511.414255][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 511.780003][T16616] overlayfs: failed to clone upperpath [ 512.838199][T16653] netlink: 'syz.3.2613': attribute type 21 has an invalid length. [ 514.413372][T16692] PKCS7: Unknown OID: [4] 5.25.287.112.81.102.117.87.150326315.2007.15776.1 [ 514.452929][T16692] PKCS7: Only support pkcs7_signedData type [ 515.096844][T16721] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2639'. [ 515.166221][T16725] dvmrp0: entered allmulticast mode [ 515.206339][T16730] fuse: Unknown parameter '' [ 515.280469][T16734] netlink: 'syz.6.2644': attribute type 1 has an invalid length. [ 515.547827][T16743] openvswitch: netlink: Flow key attr not present in new flow. [ 515.625806][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805ec98800: rx timeout, send abort [ 516.156155][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805ec98c00: rx timeout, send abort [ 516.165916][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805ec98800: abort rx timeout. Force session deactivation [ 516.402935][T16776] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 516.694774][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805ec98c00: abort rx timeout. Force session deactivation [ 516.952109][ T29] audit: type=1326 audit(1769448896.040:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16788 comm="syz.1.2663" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa13539aeb9 code=0x0 [ 517.663513][T16806] netlink: 'syz.6.2669': attribute type 1 has an invalid length. [ 517.671363][T16806] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2669'. [ 517.914238][T16820] fuse: Bad value for 'user_id' [ 517.919128][T16820] fuse: Bad value for 'user_id' [ 518.337229][T16823] overlayfs: failed to clone lowerpath [ 518.347146][T16824] overlayfs: failed to clone lowerpath [ 518.474353][T16835] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2680'. [ 518.478447][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.478447][T16836] Use struct sctp_sack_info instead [ 518.484545][T16835] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2680'. [ 518.503550][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.503550][T16836] Use struct sctp_sack_info instead [ 518.580312][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.580312][T16836] Use struct sctp_sack_info instead [ 518.585322][T16839] netlink: 132 bytes leftover after parsing attributes in process `syz.5.2682'. [ 518.612165][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.612165][T16836] Use struct sctp_sack_info instead [ 518.629890][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.629890][T16836] Use struct sctp_sack_info instead [ 518.684956][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.684956][T16836] Use struct sctp_sack_info instead [ 518.709404][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.709404][T16836] Use struct sctp_sack_info instead [ 518.730484][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.730484][T16836] Use struct sctp_sack_info instead [ 518.749858][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.749858][T16836] Use struct sctp_sack_info instead [ 518.767347][T16836] sctp: [Deprecated]: syz.3.2680 (pid 16836) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.767347][T16836] Use struct sctp_sack_info instead [ 519.605062][T16881] €Â: renamed from bridge_slave_1 (while UP) [ 519.725667][T16889] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2698'. [ 520.974295][T16929] netlink: 'syz.1.2714': attribute type 11 has an invalid length. [ 520.983867][T16929] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2714'. [ 521.457765][T16947] netlink: 'syz.3.2721': attribute type 21 has an invalid length. [ 521.467160][T16947] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2721'. [ 521.477096][T16947] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2721'. [ 522.552879][T16973] netlink: 763 bytes leftover after parsing attributes in process `syz.1.2730'. [ 522.826203][T16987] netlink: 6032 bytes leftover after parsing attributes in process `syz.3.2736'. [ 522.918716][T16995] tipc: Trying to set illegal importance in message [ 523.173897][T17010] veth0_vlan: mtu less than device minimum [ 523.250412][ T29] audit: type=1804 audit(1769448901.975:46): pid=17017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.2744" name="cgroup.controllers" dev="tmpfs" ino=1691 res=1 errno=0 [ 523.281832][ T29] audit: type=1800 audit(1769448901.984:47): pid=17017 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2744" name="cgroup.controllers" dev="tmpfs" ino=1691 res=0 errno=0 [ 523.459569][T17033] netlink: 'syz.6.2751': attribute type 4 has an invalid length. [ 524.119033][T17048] netlink: 72 bytes leftover after parsing attributes in process `syz.6.2756'. [ 524.995947][T17091] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2771'. [ 525.693434][ T5840] Bluetooth: hci1: command 0x0406 tx timeout [ 526.153533][T17122] netlink: 822 bytes leftover after parsing attributes in process `syz.6.2783'. [ 526.175341][T17127] netlink: 88 bytes leftover after parsing attributes in process `syz.5.2784'. [ 526.185823][T17127] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2784'. [ 526.627338][T17140] netlink: 'syz.3.2788': attribute type 23 has an invalid length. [ 527.866859][T17186] bpf: Bad value for 'uid' [ 529.396519][T17225] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2817'. [ 529.625635][T17240] openvswitch: netlink: IP tunnel TTL not specified. [ 530.380967][T17260] netlink: 'syz.6.2830': attribute type 1 has an invalid length. [ 530.389622][T17260] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2830'. [ 530.761564][T17284] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2839'. [ 530.885598][T17291] IPv6: NLM_F_CREATE should be specified when creating new route [ 530.914074][T17291] overlayfs: missing 'lowerdir' [ 532.261390][T17320] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2853'. [ 532.526789][T17332] 9p: Bad value for 'rfdno' [ 532.533925][T17331] 9p: Bad value for 'rfdno' [ 532.560823][T17335] netlink: 'syz.6.2859': attribute type 10 has an invalid length. [ 532.596275][T17335] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 532.759746][ T5839] Bluetooth: hci1: unexpected event for opcode 0x200a [ 532.759996][T17346] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2863'. [ 533.496213][T17361] overlayfs: failed to clone upperpath [ 535.061622][T17415] 9p: Bad value for 'version' [ 535.212441][T17429] netlink: 'syz.5.2894': attribute type 33 has an invalid length. [ 535.220499][T17429] netlink: 164 bytes leftover after parsing attributes in process `syz.5.2894'. [ 535.976124][T17452] 9p: Bad value for 'rfdno' [ 536.073678][T17454] raw_sendmsg: syz.5.2903 forgot to set AF_INET. Fix it! [ 536.188487][T17460] openvswitch: netlink: Duplicate key (type 21). [ 536.196020][T17462] openvswitch: netlink: Duplicate key (type 21). [ 536.900259][T17486] dvmrp0: entered allmulticast mode [ 537.013809][T17489] netlink: 'syz.3.2917': attribute type 12 has an invalid length. [ 537.601145][T17510] netlink: 'syz.1.2924': attribute type 10 has an invalid length. [ 537.609101][T17510] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2924'. [ 537.640911][T17510] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2924'. [ 537.657984][T17510] : entered promiscuous mode [ 537.697456][T17512] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2925'. [ 538.096349][T17520] netlink: 'syz.5.2929': attribute type 44 has an invalid length. [ 538.225110][T17532] netlink: 112 bytes leftover after parsing attributes in process `syz.5.2933'. [ 538.714829][T17548] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2939'. [ 538.729193][T17548] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2939'. [ 539.114256][ T29] audit: type=1326 audit(1769448916.895:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17565 comm="syz.5.2944" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6425b9aeb9 code=0x0 [ 540.150218][T17594] infiniband: Added to hash: ib_dev=ffff888027f60000 (0)() ndev=ffff8880379ac000 (17)(ipvlan0) [ 540.497458][T17594] infiniband syz1: set down [ 540.516984][T17594] infiniband syz1: added ipvlan0 [ 540.631189][T17594] RDS/IB: syz1: added [ 540.669127][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (21)(ipvlan0) cookie=ffff888076498000 (4)(erspan0) start [ 540.687840][T17594] smc: adding ib device syz1 with port count 1 [ 540.695225][T17594] smc: ib device syz1 port 1 has no pnetid [ 540.723522][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (14)(syz1) rdma_ndev=ffff8880379ac000 (21)(ipvlan0) cookie=ffff888076498000 (3)(erspan0) end [ 540.772128][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (14)(syz1) rdma_ndev=ffff8880379ac000 (21)(ipvlan0) cookie=ffff888032658000 (3)(gretap0) start [ 540.803104][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (14)(syz1) rdma_ndev=ffff8880379ac000 (21)(ipvlan0) cookie=ffff888032658000 (3)(gretap0) end [ 541.960085][T17639] netlink: 104 bytes leftover after parsing attributes in process `syz.5.2969'. [ 541.969572][T17639] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 542.212642][T17649] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2972'. [ 542.557014][T17671] netlink: 84 bytes leftover after parsing attributes in process `syz.5.2981'. [ 543.510852][T17711] sctp: [Deprecated]: syz.5.2995 (pid 17711) Use of int in maxseg socket option. [ 543.510852][T17711] Use struct sctp_assoc_value instead [ 543.822258][ T1341] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (20)(ipvlan0) cookie=ffff88803525a000 (11)(erspan0) start [ 543.863424][ T1341] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (20)(ipvlan0) cookie=ffff88803525a000 (4)(erspan0) end [ 543.882993][ T1341] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (20)(ipvlan0) cookie=ffff8880334dc000 (3)(gretap0) start [ 543.900775][ T1341] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (20)(ipvlan0) cookie=ffff8880334dc000 (3)(gretap0) end [ 544.194607][ T29] audit: type=1800 audit(1769449177.651:49): pid=17735 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3004" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 544.577466][T17739] overlayfs: failed to clone upperpath [ 544.684162][T17747] tmpfs: Unknown parameter 'q' [ 544.692933][T17748] afs: Unknown parameter 'B*u13¾á8+†o½Eoõ-' [ 544.784725][T17754] netlink: 'syz.6.3012': attribute type 30 has an invalid length. [ 546.792354][T17799] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3030'. [ 546.809463][T17799] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3030'. [ 546.819135][T17799] netlink: 31 bytes leftover after parsing attributes in process `syz.1.3030'. [ 546.828691][T17799] netlink: 'syz.1.3030': attribute type 2 has an invalid length. [ 546.836440][T17799] netlink: 31 bytes leftover after parsing attributes in process `syz.1.3030'. [ 547.796177][T17835] netlink: 'syz.1.3043': attribute type 4 has an invalid length. [ 547.808311][T17835] netlink: 'syz.1.3043': attribute type 4 has an invalid length. [ 548.146944][T17849] netlink: 1030 bytes leftover after parsing attributes in process `syz.6.3050'. [ 548.158269][T17849] bridge: RTM_NEWNEIGH with invalid ether address [ 548.461783][ T29] audit: type=1326 audit(1769449181.644:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17858 comm="syz.6.3052" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7eff7659aeb9 code=0x0 [ 548.965365][T17885] netlink: 'syz.5.3063': attribute type 10 has an invalid length. [ 549.396394][ T5839] Bluetooth: hci4: command 0x0406 tx timeout [ 549.716848][T17906] netlink: 840 bytes leftover after parsing attributes in process `syz.3.3068'. [ 549.774910][T17908] IPVS: set_ctl: invalid protocol: 58 255.255.255.255:20003 [ 549.892270][T17915] netlink: 'syz.3.3072': attribute type 1 has an invalid length. [ 549.902914][T17915] netlink: 'syz.3.3072': attribute type 2 has an invalid length. [ 549.912381][T17915] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3072'. [ 549.923901][T17915] netlink: 'syz.3.3072': attribute type 6 has an invalid length. [ 549.933403][T17915] netlink: 'syz.3.3072': attribute type 4 has an invalid length. [ 549.942285][T17915] netlink: 'syz.3.3072': attribute type 6 has an invalid length. [ 549.950148][T17915] netlink: 3684 bytes leftover after parsing attributes in process `syz.3.3072'. [ 550.034395][ T1583] IPVS: starting estimator thread 0... [ 550.156343][T17924] IPVS: using max 35 ests per chain, 84000 per kthread [ 551.472622][T17973] netlink: 830 bytes leftover after parsing attributes in process `syz.6.3090'. [ 551.859501][T17987] overlayfs: failed to clone upperpath [ 551.869169][T17987] overlayfs: failed to clone upperpath [ 551.900823][T17989] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3096'. [ 554.184423][T18080] overlayfs: failed to clone upperpath [ 554.210722][T18080] netlink: 'syz.5.3126': attribute type 11 has an invalid length. [ 554.727279][T18115] validate_nla: 3 callbacks suppressed [ 554.727296][T18115] netlink: 'syz.3.3134': attribute type 5 has an invalid length. [ 554.965022][T18127] PKCS8: Unsupported PKCS#8 version [ 555.328744][ T3439] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (20)(ipvlan0) cookie=ffff88807d60a000 (11)(erspan0) start [ 555.374130][ T3439] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (20)(ipvlan0) cookie=ffff88807d60a000 (4)(erspan0) end [ 555.397539][ T3439] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (20)(ipvlan0) cookie=ffff88801ee8e000 (3)(gretap0) start [ 555.417605][ T3439] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888027f60000 (13)(syz1) rdma_ndev=ffff8880379ac000 (20)(ipvlan0) cookie=ffff88801ee8e000 (3)(gretap0) end [ 556.650094][T18176] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3155'. [ 556.664691][T18176] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3155'. [ 556.677566][T18176] overlayfs: failed to clone upperpath [ 556.903722][T18181] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3157'. [ 557.531631][T18201] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3165'. [ 557.634177][T18205] 9p: Bad value for 'rfdno' [ 558.383830][T18226] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3175'. [ 558.671367][T18248] trusted_key: encrypted_key: insufficient parameters specified [ 559.154722][T18256] netlink: 'syz.1.3188': attribute type 10 has an invalid length. [ 559.162720][T18256] netlink: 'syz.1.3188': attribute type 12 has an invalid length. [ 559.351534][T18265] overlayfs: failed to clone upperpath [ 559.990194][ T29] audit: type=1326 audit(1769449192.424:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18278 comm="syz.1.3197" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa13539aeb9 code=0x0 [ 560.105557][ T29] audit: type=1326 audit(1769449192.527:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18284 comm="syz.3.3199" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff8a639aeb9 code=0x0 [ 560.162695][T18288] netlink: 'syz.3.3199': attribute type 83 has an invalid length. [ 560.618797][T18291] overlayfs: failed to clone upperpath [ 561.135882][T18310] netlink: 'syz.3.3208': attribute type 27 has an invalid length. [ 561.146632][T18310] tipc: Enabling of bearer rejected, failed to enable media [ 562.212423][T18348] 9p: Could not find request transport: xen [ 562.906580][T18361] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 562.952044][T18363] netlink: 'syz.6.3225': attribute type 9 has an invalid length. [ 562.959896][T18363] netlink: 212368 bytes leftover after parsing attributes in process `syz.6.3225'. [ 563.636827][T18395] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 563.743183][T18401] tmpfs: Bad value for 'mpol' [ 563.834264][T18404] overlayfs: missing 'lowerdir' [ 563.952525][T18406] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3239'. [ 563.961420][T18406] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3239'. [ 563.972462][T18406] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3239'. [ 564.790747][T18429] netlink: 'syz.5.3247': attribute type 9 has an invalid length. [ 564.799263][T18429] netlink: 'syz.5.3247': attribute type 11 has an invalid length. [ 564.812070][T18429] netlink: 'syz.5.3247': attribute type 12 has an invalid length. [ 564.819999][T18429] netlink: 210020 bytes leftover after parsing attributes in process `syz.5.3247'. [ 564.829991][T18429] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3247'. [ 564.843543][T18430] netlink: 'syz.5.3247': attribute type 9 has an invalid length. [ 564.851610][T18430] netlink: 'syz.5.3247': attribute type 11 has an invalid length. [ 564.860002][T18430] netlink: 'syz.5.3247': attribute type 12 has an invalid length. [ 564.868397][T18430] netlink: 210020 bytes leftover after parsing attributes in process `syz.5.3247'. [ 564.878477][T18430] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3247'. [ 565.782495][T18464] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3258'. [ 566.556490][T18478] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3264'. [ 567.188811][T18493] overlayfs: regular lower layers cannot follow data lower layers [ 567.760759][T18499] trusted_key: encrypted_key: master key parameter '' is invalid [ 567.760859][T18500] cgroup: Invalid name [ 567.818219][T18504] tc_dump_action: action bad kind [ 567.839634][ T29] audit: type=1326 audit(1769449199.764:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18507 comm="syz.3.3273" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff8a639aeb9 code=0x0 [ 568.985629][T18517] IPv4: Oversized IP packet from 172.20.20.170 [ 568.992502][ C0] IPv4: Oversized IP packet from 172.20.20.170 [ 568.998904][ C0] IPv4: Oversized IP packet from 172.20.20.170 [ 569.007549][T18517] IPv4: Oversized IP packet from 172.20.20.170 [ 569.014374][ C0] IPv4: Oversized IP packet from 172.20.20.170 [ 569.020837][ C0] IPv4: Oversized IP packet from 172.20.20.170 [ 569.029054][T18517] IPv4: Oversized IP packet from 172.20.20.170 [ 569.035820][ C0] IPv4: Oversized IP packet from 172.20.20.170 [ 569.042294][ C0] IPv4: Oversized IP packet from 172.20.20.170 [ 569.062396][T18517] IPv4: Oversized IP packet from 172.20.20.170 [ 572.399552][T18569] 9p: Bad value for 'rfdno' [ 572.673317][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 572.679916][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 572.746401][T18578] netlink: 'syz.1.3298': attribute type 3 has an invalid length. [ 572.754360][T18578] __nla_validate_parse: 34 callbacks suppressed [ 572.754380][T18578] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3298'. [ 572.863542][T18584] ================================================================== [ 572.871629][T18584] BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x4e/0x130 [ 572.880214][T18584] Read of size 8 at addr ffff88801c2e5400 by task syz.5.3301/18584 [ 572.888120][T18584] [ 572.890447][T18584] CPU: 0 UID: 0 PID: 18584 Comm: syz.5.3301 Tainted: G L syzkaller #0 PREEMPT(full) [ 572.890465][T18584] Tainted: [L]=SOFTLOCKUP [ 572.890470][T18584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 572.890481][T18584] Call Trace: [ 572.890487][T18584] [ 572.890493][T18584] dump_stack_lvl+0xe8/0x150 [ 572.890511][T18584] print_report+0xba/0x230 [ 572.890524][T18584] ? __list_add_valid_or_report+0x4e/0x130 [ 572.890537][T18584] kasan_report+0x117/0x150 [ 572.890554][T18584] ? __list_add_valid_or_report+0x4e/0x130 [ 572.890568][T18584] __list_add_valid_or_report+0x4e/0x130 [ 572.890581][T18584] clone_mnt+0x447/0x9a0 [ 572.890598][T18584] vfs_open_tree+0x507/0x1040 [ 572.890614][T18584] ? __pfx_vfs_open_tree+0x10/0x10 [ 572.890627][T18584] ? do_raw_spin_unlock+0xf5/0x210 [ 572.890642][T18584] ? _raw_spin_unlock+0x28/0x50 [ 572.890656][T18584] ? alloc_fd+0x64b/0x6c0 [ 572.890668][T18584] __x64_sys_open_tree+0x96/0x110 [ 572.890679][T18584] do_syscall_64+0xe2/0xf80 [ 572.890695][T18584] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.890706][T18584] ? trace_irq_disable+0x37/0x100 [ 572.890719][T18584] ? clear_bhb_loop+0x40/0x90 [ 572.890730][T18584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.890743][T18584] RIP: 0033:0x7f6425b9aeb9 [ 572.890755][T18584] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 572.890764][T18584] RSP: 002b:00007f6426a40028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac [ 572.890776][T18584] RAX: ffffffffffffffda RBX: 00007f6425e15fa0 RCX: 00007f6425b9aeb9 [ 572.890784][T18584] RDX: 0000000000001802 RSI: 0000200000000000 RDI: 0000000000000003 [ 572.890792][T18584] RBP: 00007f6425c08c1f R08: 0000000000000000 R09: 0000000000000000 [ 572.890798][T18584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 572.890805][T18584] R13: 00007f6425e16038 R14: 00007f6425e15fa0 R15: 00007fff40815fb8 [ 572.890817][T18584] [ 572.890821][T18584] [ 573.089795][T18584] Allocated by task 18548: [ 573.094208][T18584] kasan_save_track+0x3e/0x80 [ 573.098899][T18584] __kasan_slab_alloc+0x6c/0x80 [ 573.103756][T18584] kmem_cache_alloc_noprof+0x2bc/0x650 [ 573.109213][T18584] alloc_vfsmnt+0x23/0x420 [ 573.113626][T18584] clone_mnt+0x4b/0x9a0 [ 573.117776][T18584] vfs_open_tree+0x507/0x1040 [ 573.122445][T18584] __x64_sys_open_tree+0x96/0x110 [ 573.127454][T18584] do_syscall_64+0xe2/0xf80 [ 573.131948][T18584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.137828][T18584] [ 573.140135][T18584] Freed by task 18543: [ 573.144183][T18584] kasan_save_track+0x3e/0x80 [ 573.148855][T18584] kasan_save_free_info+0x46/0x50 [ 573.153870][T18584] __kasan_slab_free+0x5c/0x80 [ 573.158627][T18584] kmem_cache_free+0x180/0x610 [ 573.163384][T18584] rcu_core+0x7cd/0x1070 [ 573.167612][T18584] handle_softirqs+0x22a/0x7c0 [ 573.172366][T18584] __irq_exit_rcu+0x5f/0x150 [ 573.176962][T18584] irq_exit_rcu+0x9/0x30 [ 573.181202][T18584] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 573.186827][T18584] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 573.192877][T18584] [ 573.195185][T18584] Last potentially related work creation: [ 573.200964][T18584] kasan_save_stack+0x3e/0x60 [ 573.205634][T18584] kasan_record_aux_stack+0xbd/0xd0 [ 573.210820][T18584] call_rcu+0xee/0x890 [ 573.214875][T18584] task_work_run+0x1d9/0x270 [ 573.219455][T18584] exit_to_user_mode_loop+0xed/0x480 [ 573.224723][T18584] do_syscall_64+0x2b7/0xf80 [ 573.229309][T18584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.235186][T18584] [ 573.237502][T18584] Second to last potentially related work creation: [ 573.244077][T18584] kasan_save_stack+0x3e/0x60 [ 573.248758][T18584] kasan_record_aux_stack+0xbd/0xd0 [ 573.253953][T18584] task_work_add+0xb6/0x440 [ 573.258456][T18584] mntput_no_expire_slowpath+0x70c/0xbd0 [ 573.264085][T18584] vfs_open_tree+0xe17/0x1040 [ 573.268756][T18584] __x64_sys_open_tree+0x96/0x110 [ 573.273773][T18584] do_syscall_64+0xe2/0xf80 [ 573.278268][T18584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.284145][T18584] [ 573.286451][T18584] The buggy address belongs to the object at ffff88801c2e5340 [ 573.286451][T18584] which belongs to the cache mnt_cache of size 352 [ 573.300311][T18584] The buggy address is located 192 bytes inside of [ 573.300311][T18584] freed 352-byte region [ffff88801c2e5340, ffff88801c2e54a0) [ 573.314099][T18584] [ 573.316409][T18584] The buggy address belongs to the physical page: [ 573.322822][T18584] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c2e4 [ 573.331568][T18584] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 573.340047][T18584] memcg:ffff888033706b01 [ 573.344270][T18584] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 573.351803][T18584] page_type: f5(slab) [ 573.355776][T18584] raw: 00fff00000000040 ffff88801c2fa640 dead000000000100 dead000000000122 [ 573.364344][T18584] raw: 0000000000000000 0000000800120012 00000000f5000000 ffff888033706b01 [ 573.372916][T18584] head: 00fff00000000040 ffff88801c2fa640 dead000000000100 dead000000000122 [ 573.381576][T18584] head: 0000000000000000 0000000800120012 00000000f5000000 ffff888033706b01 [ 573.390234][T18584] head: 00fff00000000001 ffffea000070b901 00000000ffffffff 00000000ffffffff [ 573.398891][T18584] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 573.407541][T18584] page dumped because: kasan: bad access detected [ 573.413946][T18584] page_owner tracks the page as allocated [ 573.419647][T18584] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 0, tgid 0 (swapper/0), ts 2017040735, free_ts 0 [ 573.437691][T18584] post_alloc_hook+0x231/0x280 [ 573.442458][T18584] get_page_from_freelist+0x24dc/0x2580 [ 573.447998][T18584] __alloc_frozen_pages_noprof+0x18d/0x380 [ 573.453798][T18584] allocate_slab+0x7b/0x660 [ 573.458287][T18584] refill_objects+0x33a/0x3d0 [ 573.462951][T18584] refill_sheaf+0x29/0x50 [ 573.467268][T18584] __pcs_replace_empty_main+0x3ef/0x620 [ 573.472832][T18584] kmem_cache_alloc_noprof+0x37d/0x650 [ 573.478276][T18584] alloc_vfsmnt+0x23/0x420 [ 573.482689][T18584] vfs_create_mount+0x69/0x320 [ 573.487445][T18584] vfs_kern_mount+0x1ce/0x220 [ 573.492114][T18584] kern_mount+0x43/0x90 [ 573.496259][T18584] shmem_init+0x37/0x170 [ 573.500488][T18584] mnt_init+0x1ac/0x210 [ 573.504629][T18584] vfs_caches_init+0x22/0x30 [ 573.509209][T18584] start_kernel+0x33f/0x3d0 [ 573.513701][T18584] page_owner free stack trace missing [ 573.519049][T18584] [ 573.521352][T18584] Memory state around the buggy address: [ 573.526972][T18584] ffff88801c2e5300: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 573.535016][T18584] ffff88801c2e5380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 573.543075][T18584] >ffff88801c2e5400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 573.551131][T18584] ^ [ 573.555194][T18584] ffff88801c2e5480: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 573.563245][T18584] ffff88801c2e5500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 573.571293][T18584] ================================================================== [ 573.606199][T18584] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 573.613437][T18584] CPU: 0 UID: 0 PID: 18584 Comm: syz.5.3301 Tainted: G L syzkaller #0 PREEMPT(full) [ 573.624381][T18584] Tainted: [L]=SOFTLOCKUP [ 573.628702][T18584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 573.638739][T18584] Call Trace: [ 573.642006][T18584] [ 573.644930][T18584] vpanic+0x1e0/0x670 [ 573.648898][T18584] panic+0xc5/0xd0 [ 573.652603][T18584] ? __pfx_panic+0x10/0x10 [ 573.657014][T18584] ? preempt_schedule_thunk+0x16/0x30 [ 573.662377][T18584] ? preempt_schedule_thunk+0x16/0x30 [ 573.667835][T18584] ? __list_add_valid_or_report+0x4e/0x130 [ 573.673635][T18584] check_panic_on_warn+0x89/0xb0 [ 573.678564][T18584] ? __list_add_valid_or_report+0x4e/0x130 [ 573.684355][T18584] end_report+0x6f/0x140 [ 573.688585][T18584] kasan_report+0x128/0x150 [ 573.693163][T18584] ? __list_add_valid_or_report+0x4e/0x130 [ 573.698961][T18584] __list_add_valid_or_report+0x4e/0x130 [ 573.704608][T18584] clone_mnt+0x447/0x9a0 [ 573.708860][T18584] vfs_open_tree+0x507/0x1040 [ 573.713555][T18584] ? __pfx_vfs_open_tree+0x10/0x10 [ 573.718681][T18584] ? do_raw_spin_unlock+0xf5/0x210 [ 573.723812][T18584] ? _raw_spin_unlock+0x28/0x50 [ 573.728662][T18584] ? alloc_fd+0x64b/0x6c0 [ 573.732990][T18584] __x64_sys_open_tree+0x96/0x110 [ 573.738006][T18584] do_syscall_64+0xe2/0xf80 [ 573.742507][T18584] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.748559][T18584] ? trace_irq_disable+0x37/0x100 [ 573.753578][T18584] ? clear_bhb_loop+0x40/0x90 [ 573.758244][T18584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.764124][T18584] RIP: 0033:0x7f6425b9aeb9 [ 573.768531][T18584] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 573.788134][T18584] RSP: 002b:00007f6426a40028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac [ 573.796552][T18584] RAX: ffffffffffffffda RBX: 00007f6425e15fa0 RCX: 00007f6425b9aeb9 [ 573.804518][T18584] RDX: 0000000000001802 RSI: 0000200000000000 RDI: 0000000000000003 [ 573.812484][T18584] RBP: 00007f6425c08c1f R08: 0000000000000000 R09: 0000000000000000 [ 573.820458][T18584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 573.828416][T18584] R13: 00007f6425e16038 R14: 00007f6425e15fa0 R15: 00007fff40815fb8 [ 573.836387][T18584] [ 573.839814][T18584] Kernel Offset: disabled [ 573.844118][T18584] Rebooting in 86400 seconds..