last executing test programs: 8.750925219s ago: executing program 0 (id=1628): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="a00000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c00028005000100000000003c0002802c000180140003000000000000000000000200000000000014000400fe8000000000000000000000000000aa0c0002800500010000000000080007400000000004000e80080008"], 0xa0}, 0x1, 0xfffff000, 0x0, 0xa0}, 0xff84) 8.75045458s ago: executing program 1 (id=1629): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f000047d000/0x3000)=nil, 0x3000, 0x2, 0x12, r0, 0x0) syz_clone(0x81000000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x80) sendmmsg(r0, &(0x7f0000000000), 0x0, 0x30000040) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = io_uring_setup(0x1694, &(0x7f0000000080)={0x0, 0xfacb, 0x800, 0x100, 0x20001b5, 0x0, r0}) r3 = syz_open_dev$sndpcmc(&(0x7f0000000340), 0x1, 0x80) ioctl$SNDRV_PCM_IOCTL_UNLINK(r3, 0xc2604110, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x100000000000011a) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000100)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000040)={@my=0x1}) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f00000000c0)={@hyper, 0x1}) ioctl$UFFDIO_POISON(r5, 0xc020aa08, &(0x7f0000000240)={{&(0x7f00004bf000/0x1000)=nil, 0x1000}, 0x1}) setsockopt$sock_int(r4, 0x1, 0x2a, &(0x7f00000002c0)=0x8001, 0x4) splice(r4, 0x0, r6, 0x0, 0x39000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000180)={0x5, 0x3, 0x1, 'queue1\x00', 0x3}) 8.57509347s ago: executing program 0 (id=1630): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e23, 0x86, @mcast2, 0x6}, 0x1c) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00ba0100380a040008130500", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x8000002) r2 = syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00') preadv(r2, &(0x7f0000000080)=[{&(0x7f00000001c0)=""/133, 0x8a}], 0x1, 0x114a, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000002e00)="2210942272ce9a37c0fb001f95548ca7", 0x20) getsockopt$inet6_tcp_buf(r3, 0x6, 0x21, 0x0, &(0x7f0000000240)) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000300)={@empty, 0x1, 0x0, 0xfffffffffffffda3, 0x0, [{@private}, {@empty}, {@initdev}, {@empty}, {}, {@loopback}, {@local}, {@loopback}, {@remote}]}}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0xa) r5 = epoll_create(0x752) ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f00000003c0)={0xb, 0xe8c, 0x8, 0x2, 0x8, 0x1}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000100)={0x80000010}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) r7 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r8 = syz_open_dev$sndctrl(0x0, 0x0, 0x40800) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r8, 0x40045532, &(0x7f0000000040)) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r10 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r11, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r11, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r9, 0x40045010, &(0x7f0000000000)) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r10, 0x4112, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r4, 0x1, 0x7, &(0x7f00000002c0)=0x200, 0xffffffffffffff30) 8.166100014s ago: executing program 0 (id=1632): ptrace$setregs(0xd, 0x0, 0x400, &(0x7f0000000040)="209e8c2735f6b0fa4cfff4d87e053450d0964b") syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000fffffffffffffffd00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 8.071529641s ago: executing program 4 (id=1633): socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340), &(0x7f0000000280)) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x20044000}, 0x8042) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="68000000090603000000000000000000050000400900020073797a3100000000050001000700000040000780060004404e24800005000700ff0000000c00018008000140e00040000c00148008000140ac1e0100060005404e2100000c00168008000140ac1eed62"], 0x68}, 0x1, 0x0, 0x0, 0x20004000}, 0x80) 7.931443025s ago: executing program 0 (id=1634): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x121c02, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r2 = epoll_create1(0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000800)=@newsa={0xf0, 0x10, 0x1, 0x0, 0x0, {{@in=@private, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x16}, {@in6=@loopback, 0x4d2, 0x6c}, @in=@local, {0x0, 0x0, 0x0, 0x1}, {}, {}, 0x0, 0x0, 0x2, 0x1}}, 0xf0}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)={0x2}) socket$alg(0x26, 0x5, 0x0) r4 = syz_io_uring_setup(0x8d6, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x1, 0x3ca}, &(0x7f0000000200)=0x0, &(0x7f0000000080)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = syz_usb_connect$cdc_ecm(0x0, 0x21b, &(0x7f0000000340)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x209, 0x1, 0x1, 0x9, 0x0, 0x81, [{{0x9, 0x4, 0x0, 0x7, 0x3, 0x2, 0x6, 0x0, 0x80, {{0x7, 0x24, 0x6, 0x0, 0x0, "db55"}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x101, 0x4, 0x80, 0x3}, [@ncm={0x6, 0x24, 0x1a, 0x0, 0x2}, @mbim={0xc, 0x24, 0x1b, 0x8, 0x4, 0x7, 0x0, 0x5, 0x7}, @mdlm_detail={0xc4, 0x24, 0x13, 0x2, "8472785bf4803af44c7034a293e1669588da6baabab34e283c52327b50f6a1a1dfd7dc587f1a70add0f4c112da907c144ccb612194448edb0036c3e0479931ff46eaee83e5d56e92127deac728900595a63bb3a5b5248613a510eecfec5edc10655815cae5582a4c32f5ee60b6c55f2af10c6774ef09541f9f0db03a2a5e9cb15c8304514d79f0bbece34089f4b9764e8c608f26f52dfa5f114c8cd9d35ba7198769df7b106f7c92e9af7f33f133d681de3e90da93ae2a564b4b4c0cb911da0c"}, @dmm={0x7, 0x24, 0x14, 0x0, 0xfff}, @mdlm_detail={0xe6, 0x24, 0x13, 0xfd, "5eb96f799da55e2c3c1e9cdf7093bd82cfbbb81052c9db89cc718c38a3ff5c1839d4e3156dd8cc975ee79030d0a3324a2ce8375ed089c3aa809792d0353bdb0b92914f4cce19d6d66a42324bad1e7dfe8ee16e51fece36fc9ccf4138a4c70a48adfb765155fe60141934cdc77a0859c6800b930cc26b26b4a6b309884ddce6d83b61a4f24720d18f3eaef5047c6a49bdf90eea502c15b35b4a759007c070b905510b94a009433faa3bc6ab4613351850dcc5168441866f373282fcc52582185968fdfe7db8a66be620f17db729d490be56c306df7808638544886f0d37108b250bab"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0x2, 0xdc, 0xe5}}], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x9, 0x6, 0x8}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x5b, 0x4, 0x2}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x250, 0x81, 0x9, 0x5, 0xff, 0x5c}, 0x15, &(0x7f0000000280)={0x5, 0xf, 0x15, 0x1, [@ssp_cap={0x10, 0x10, 0xa, 0xe, 0x1, 0x5a0f, 0xf00, 0x6, [0xffff00]}]}, 0x1, [{0x66, &(0x7f0000000580)=@string={0x66, 0x3, "6a93d74598a580a661f33947bd9e757d2f38192b657dcd16db25ac954686288766171819a0be30b872fa4c4065a123b6543a2252e887dbe167d545cca67a99bf54f60627ccda57c4f4511288f7ccdab86e7d1c707faafaf1aa6ce5e8c5a548ab008c5ca5"}}]}) syz_usb_control_io$cdc_ecm(r8, &(0x7f0000000700)={0xc, &(0x7f0000000640)={0x40, 0x34, 0x6d, {0x6d, 0xb, "c80f8b3834354325e4ca3fad5c8106182915635a60bf6f0e634723b543358bc90506c974ff9429c169bcfe9e9168e407f1a7669aa882731807fe5299cb085e16932c2deb578c1f67af7d2660af0480edfffdee53142c74405441644aebfeec43888e4d957033ee83813ccf"}}, &(0x7f00000006c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000900)={0x10, &(0x7f0000000740)={0x20, 0xb, 0x4, "b7d52e28"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0xb4}}) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000001800010028bd7080fadbdf2502208004fe0400070002000008001e00f9ffffff08000500ac1e000192eb2e902a9d6ee7a358957ab68f"], 0x2c}, 0x1, 0x0, 0x0, 0xc0}, 0x20048000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0xffffffffffffffff, 0x0}) io_uring_enter(r4, 0x47bd, 0x3a82, 0x60, 0x0, 0x0) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000000)={0x0, &(0x7f0000000040)}) 7.735164086s ago: executing program 4 (id=1636): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CLOCK(0xffffffffffffffff, 0x4030ae7b, &(0x7f0000000000)={0xffffffffffffffff, 0xc, 0x5, 0x4, 0x35e}) (async) ioctl$KVM_SET_IRQCHIP(r1, 0x4020aeb2, &(0x7f0000000300)={0x0, 0x12c, @ioapic={0xffff1000, 0x8000, 0xfffff5a7, 0x7fffffff, 0x0, [{0x1, 0x81, 0x1, '\x00', 0x4}, {0xfe, 0x3, 0x0, '\x00', 0x6}, {0x7, 0xff, 0xe, '\x00', 0x3b}, {0x4e, 0xe, 0xd6, '\x00', 0x86}, {0xc, 0xb, 0x6, '\x00', 0x2}, {0xf, 0x1, 0xf9, '\x00', 0x3}, {0x2, 0xa, 0x50, '\x00', 0x6}, {0x8, 0x9, 0x2a, '\x00', 0x8}, {0x4, 0x0, 0xa, '\x00', 0xff}, {0x8, 0xd6, 0x3, '\x00', 0x8}, {0x9e, 0x6, 0x3, '\x00', 0x6}, {0x2, 0x9, 0x0, '\x00', 0x7f}, {0x45, 0x51, 0xa}, {0xe, 0xfc, 0x0, '\x00', 0x1}, {0x8, 0x2, 0x6, '\x00', 0x9}, {0x7, 0x1b, 0xfe, '\x00', 0x3}, {0x2, 0xa, 0xd6, '\x00', 0x7f}, {0xa, 0x0, 0xca, '\x00', 0x6}, {0x0, 0x60, 0x4, '\x00', 0x12}, {0xb, 0x8, 0x40, '\x00', 0xda}, {0x3, 0x3, 0x6, '\x00', 0x9}, {0x9, 0x3, 0x1, '\x00', 0x2}, {0xf9, 0x1, 0x4, '\x00', 0x7}, {0x8, 0xc, 0x0, '\x00', 0x6}]}}) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.535281493s ago: executing program 4 (id=1637): openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x460900, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$SNDCTL_DSP_GETOPTR(0xffffffffffffffff, 0x800c5012, &(0x7f0000000240)) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xd) r3 = openat$zero(0xffffff9c, 0x0, 0x2401, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f00000000c0)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x800038, 0x7, 0x3, 0x180, 0x6, 0x10, 0xf1, 0x100000001, 0x1, 0xca0, 0xffffffffffffffff, 0x2000000002c, 0x0, 0x6, 0x0, 0xbd9], 0xffff1001, 0x43100}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0xa7c, 0x68ff, 0x7, 0x100008000000009, 0x803, 0x0, 0x9], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x9, 0x75, 0x6, 0x36, 0x0, 0x2, 0xb4}, {0x0, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x1, 0x1, 0xa4, 0x5, 0x5}, {0x8000000, 0xeeee0000, 0x9, 0x6, 0x5, 0xdb, 0xb, 0xff, 0x8, 0x7, 0xe, 0x7}, {0x8000, 0xd000, 0xf, 0x3, 0x16, 0x7, 0xab, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0x6, 0xa0, 0xb, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x3000, 0xa, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x81, 0x40, 0x70}, {0xdddd0000, 0x4000, 0xa, 0x5, 0xcd, 0x7, 0x1, 0x9, 0x2, 0xc, 0xb0, 0x81}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x39, 0x0, 0x3000, 0x2024, 0x2, 0x800, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="500001040000000000000000070000090c000240fffffffffffffffa0c000640000000000000000809000100a0a46a65000000000c00024000000000000000090c0002400000000000000004602bdb175d7db012dfbc802bb3532bf66bd479daa958263398822d6dd91defc00248a855d7e7d08ea38d7e53096e90ee0ba55c9cd8ac3b76bcdee44c36"], 0x50}, 0x1, 0x0, 0x0, 0x4081}, 0x20000010) socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f00000002c0)="480000001400190d09004beafc0d8c560a8447608004000000000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff", 0x3c}], 0x1) socket$pppl2tp(0x18, 0x1, 0x1) r7 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_CLEAR_HALT(r7, 0x80045515, 0x0) 6.650142511s ago: executing program 4 (id=1638): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x2, 0x89, 0x8, 0xb319, 0x3}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000080)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0xc, 0x4, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa210104, @local, {[@timestamp_addr={0x44, 0x14, 0xa, 0x1, 0x0, [{@multicast1}, {@multicast1}]}, @generic={0x7, 0x8, "04030e0000"}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x45}, 0x8000002) syz_usb_connect(0x5, 0x24, &(0x7f0000002040)=ANY=[@ANYBLOB="12010000fe76181004160780a6af011703010902120001000000000904"], 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000380), 0x3, 0xbc01) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r2, 0x80dc5521, &(0x7f0000000180)=""/135) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, 0x0, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r4) socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x2, 0x0, 0x4, 0x1, {0xa, 0x4e21, 0x4, @empty, 0x1f}}}, 0x3a) 5.279210231s ago: executing program 1 (id=1640): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000400001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r1], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 5.261144238s ago: executing program 1 (id=1641): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e23, @broadcast}]}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x20, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = mq_open(&(0x7f0000000000)='batadv_slave_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x8000000000000000, 0x8, 0x1, 0xc05}) mq_getsetattr(r5, &(0x7f0000000040)={0x0, 0x40, 0x4, 0x7ff}, 0x0) mq_timedreceive(r5, &(0x7f0000000100)=""/90, 0x5a, 0x0, &(0x7f00000001c0)={0x77359400}) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x9, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xb, 0x2, &(0x7f0000006680)) syz_clone3(&(0x7f0000000080)={0x188801400, &(0x7f0000000000), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0) pipe(0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) io_setup(0xbf5, &(0x7f0000000200)=0x0) io_pgetevents(r7, 0xfffffffa, 0x2, &(0x7f0000000240)=[{}, {}], &(0x7f00000002c0), &(0x7f0000000340)={&(0x7f0000000300)={[0x8, 0xffff8001]}, 0x8}) setsockopt$inet_tcp_int(r6, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4) sendto$inet(r6, &(0x7f00000001c0)='\x00', 0x1, 0x800, 0x0, 0x0) splice(r6, 0x0, 0xffffffffffffffff, 0x0, 0x8a, 0xa) 4.569707917s ago: executing program 0 (id=1652): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f000047d000/0x3000)=nil, 0x3000, 0x2, 0x12, r0, 0x0) syz_clone(0x81000000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x80) sendmmsg(r0, &(0x7f0000000000), 0x0, 0x30000040) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r2 = io_uring_setup(0x1694, &(0x7f0000000080)={0x0, 0xfacb, 0x800, 0x100, 0x20001b5, 0x0, r0}) r3 = syz_open_dev$sndpcmc(&(0x7f0000000340), 0x1, 0x80) ioctl$SNDRV_PCM_IOCTL_UNLINK(r3, 0xc2604111, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x100000000000011a) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000100)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000040)={@my=0x1}) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f00000000c0)={@hyper, 0x1}) ioctl$UFFDIO_POISON(r5, 0xc020aa08, &(0x7f0000000240)={{&(0x7f00004bf000/0x1000)=nil, 0x1000}, 0x1}) setsockopt$sock_int(r4, 0x1, 0x2a, &(0x7f00000002c0)=0x8001, 0x4) splice(r4, 0x0, r6, 0x0, 0x39000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000180)={0x5, 0x3, 0x1, 'queue1\x00', 0x3}) 4.307823604s ago: executing program 3 (id=1643): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="a00000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c00028005000100000000003c0002802c000180140003000000000000000000000200000000000014000400fe8000000000000000000000000000aa0c0002800500010000000000080007400000000004000e80080008"], 0xa0}, 0x1, 0xfffff000, 0x0, 0xa0}, 0xff88) 4.222478195s ago: executing program 1 (id=1644): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_GET(r2, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000200)="9c30fb4d", 0x4}], 0x1) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000003c0)=0x1, r4, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r4, 0x7}}, 0x48) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000740)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000580)={0xe, 0x1, 0xfa00, @id_resuseaddr={&(0x7f00000005c0)=0x1, r6, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r5, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r6, 0x10, 0x0, @in={0x2, 0x4e23, @empty}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r6, 0x1}}, 0x10) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="c1c5988ad64c9814d7f96ca9a68e071f6d304919f9627ce8fb179d3e840a2c7892dfa36cf1d62e0232c5506a0adce2ab588737734cbc8ce732acbbc5bc5f93dbd4b77a0ecb8eddfac5280989a12d1afbd99a1ffeccbbf3766b4c2efd88dd75f0731713f53b9d87a56a5e721bd474f6b99621bc663895a361e069839c4a406bd9ddd20aed65732d1e0bbd5565b6fc3fca944fce355fccac134be881b5bd2fb9705f19a92ddf4738a4bae2c98cf2bcea9aba7649eafec7ebf68b15337087365d"], 0x48) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWSET={0x30, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14}}, 0x8c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xf, &(0x7f0000000d80)=ANY=[@ANYBLOB="180800"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000bf98000000000000b5080000000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x0}, 0x94) ioprio_set$pid(0x1, 0x0, 0x0) ioprio_get$pid(0x1, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) 4.171988348s ago: executing program 3 (id=1645): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x183100, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') r2 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xe539, 0x800, 0x400001, 0x40000333}, &(0x7f00000000c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x7, 0x0, 0x0}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r5, 0x6, 0x23, &(0x7f00000000c0)=""/32, &(0x7f0000000080)=0x20) socket(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @counter={{0xc}, @void}}]}, @NFT_MSG_NEWSETELEM={0xc0, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x94, 0x3, 0x0, 0x1, [{0x90, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x84, 0x6, 0x1, 0x0, "2f11e7ef8e766bc851286d7b851917a8c4428e9e9e091293cae490c16826a3c85a205f678852b43a06c61d63ba42373a00bb7c1ad7f1758c6b2ce8b1f597542c5b20d1abf3d9cba06aa296695acaa0facffbd68f6cafc22503df4d5c27c256f0b4f6c49fa2d43becd9c27d04488658cebd38947517a7ab12195f2e5a26fccf5b"}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x154}, 0x1, 0x0, 0x0, 0x8000}, 0x0) quotactl$Q_QUOTAON(0xffffffff80000102, &(0x7f0000002640)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000980)=@newqdisc={0x30, 0x24, 0xd0f, 0x70bd30, 0x0, {0x60, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}}, 0x0) sendmmsg(r8, &(0x7f0000000000), 0x0, 0xa00) sendfile64(r6, r6, 0x0, 0x3) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) 4.009258552s ago: executing program 2 (id=1646): socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340), &(0x7f0000000280)) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x20044000}, 0x8042) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="68000000090603000000000000000000050000400900020073797a3100000000050001000700000040000780060004404e24800005000700ff0000000c00018008000140e00040000c00148008000140ac1e0100060005404e2100000c00168008000140ac1eed62"], 0x68}, 0x1, 0x0, 0x0, 0x20004000}, 0x80) 3.488178344s ago: executing program 4 (id=1647): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000600)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x38e38e38e38e56e, [{{0x9, 0x2, 0x48}}]}}, 0x0) r1 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'ip6gretap0\x00', 0x0}) bind$packet(r1, &(0x7f0000000180)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61}, 0x94) sendmsg$netlink(r1, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="3f011400dcdc14"], 0xdd12}], 0x1}, 0x20040051) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000340), r1) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000380)={'team0\x00', 0x0}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000003c0)={0x0, @loopback, @dev}, &(0x7f0000000400)=0xc) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000440)={&(0x7f0000000e40)={0x520, r3, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0x194, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0xea0, 0x0, 0x9, 0x6}, {0x7, 0xc, 0x1, 0xb}, {0x8, 0xc, 0x8, 0x101}, {0x64c, 0x8, 0x0, 0x1}, {0xca2b, 0x6, 0x6c, 0x6533}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r2}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r2}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0x164, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0xfff, 0xa, 0xf, 0xfffffff8}]}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0x170, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x79}}, {0x8, 0x6, r2}}}]}}]}, 0x520}, 0x1, 0x0, 0x0, 0x84}, 0x48000) r6 = syz_open_dev$loop(&(0x7f0000000040), 0x700, 0x492001) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000540)={0xa, &(0x7f00000004c0)=[{0xa, 0x6, 0xe, 0x7b0}, {0x3, 0x6, 0x6, 0x4}, {0x3, 0x1, 0x7, 0xfff}, {0x6, 0x2, 0x7f, 0xc}, {0x3a5, 0xcd, 0xf, 0x4}, {0xfff7, 0x1, 0x9, 0x1}, {0x3e8, 0x7f, 0x4, 0x2}, {0x2, 0x6a, 0x7, 0x1}, {0x40, 0xd, 0x3, 0x6}, {0x0, 0x3, 0x7}]}) ioctl$BLKROSET(r6, 0x125d, &(0x7f0000000080)=0x8) r7 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) r8 = openat$ptmx(0xffffff9c, &(0x7f0000000580), 0x22000, 0x0) ioctl$VT_ACTIVATE(r8, 0x5606, 0x339) r9 = openat$cgroup_ro(r7, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) read$FUSE(r9, &(0x7f00000031c0)={0x2020}, 0x2020) ioctl$sock_inet_SIOCSIFBRDADDR(r7, 0x891a, &(0x7f00000000c0)={'rose0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x25}}}) r10 = socket(0x10, 0x2, 0x0) r11 = syz_open_dev$vim2m(&(0x7f0000000000), 0xdcc2, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r11, 0xc02c564a, &(0x7f0000000080)={0x0, 0x100f, 0x0, @discrete={0x10}}) write(r10, &(0x7f0000000240)="1c000000003b9b301f000000000000000000000000fc1b7bce482f5c", 0x1c) r12 = syz_open_dev$dvb_demux(&(0x7f0000000140), 0x0, 0x62400) r13 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, r12, &(0x7f0000000080)={0x20000000}) recvmmsg(r10, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc, &(0x7f00000008c0)={[{0x8, 0x4e00, "9925acd7fe867355"}]}) 3.25526905s ago: executing program 2 (id=1648): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e23, 0x86, @mcast2, 0x6}, 0x1c) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00ba0100380a040008130500", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x8000002) r2 = syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00') preadv(r2, &(0x7f0000000080)=[{&(0x7f00000001c0)=""/133, 0x8a}], 0x1, 0x114a, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000002e00)="2210942272ce9a37c0fb001f95548ca7", 0x20) getsockopt$inet6_tcp_buf(r3, 0x6, 0x21, 0x0, &(0x7f0000000240)) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000300)={@empty, 0x1, 0x0, 0xfffffffffffffda3, 0x0, [{@private}, {@empty}, {@initdev}, {@empty}, {}, {@loopback}, {@local}, {@loopback}, {@remote}]}}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0xa) r5 = epoll_create(0x752) ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f00000003c0)={0xb, 0xe8c, 0x8, 0x2, 0x8, 0x1}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000100)={0x80000010}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) r7 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r8 = syz_open_dev$sndctrl(0x0, 0x0, 0x40800) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r8, 0x40045532, &(0x7f0000000040)) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r10 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r11, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r11, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r9, 0x40045010, &(0x7f0000000000)) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r10, 0x4112, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r4, 0x1, 0x7, &(0x7f00000002c0)=0x200, 0xffffffffffffff30) 3.087535s ago: executing program 1 (id=1649): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) fcntl$notify(0xffffffffffffffff, 0x402, 0x69) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x8}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) r4 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r4, 0x0, 0x0) syz_open_procfs$userns(0x0, &(0x7f0000000040)) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000019a00)=@raw={'raw\x00', 0x3c1, 0x3, 0x4b0, 0x0, 0x18c, 0x203, 0x0, 0x19030000, 0x3e8, 0x2e0, 0x2e0, 0x3e8, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d4, 0x2fc, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x1d}, {0x2, 0x0, 0x0, 0x16}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x10000}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3, 0x2}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7, 0x0, 0x0, 0x4000}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {0x2, 0x1}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0xfffd, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {0x0, 0xfe}, {}, {0x0, 0x0, 0x0, 0x31}, {0x0, 0x0, 0xff}, {}, {0x0, 0xae}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {0x1}, {0x4}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa4, 0xec}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c5}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x50c) 3.062281472s ago: executing program 2 (id=1650): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e23, 0x86, @mcast2, 0x6}, 0x1c) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00ba0100380a040008130500", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x8000002) r2 = syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00') preadv(r2, &(0x7f0000000080)=[{&(0x7f00000001c0)=""/133, 0x8a}], 0x1, 0x114a, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000002e00)="2210942272ce9a37c0fb001f95548ca7", 0x20) getsockopt$inet6_tcp_buf(r3, 0x6, 0x21, 0x0, &(0x7f0000000240)) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000300)={@empty, 0x1, 0x0, 0xfffffffffffffda3, 0x0, [{@private}, {@empty}, {@initdev}, {@empty}, {}, {@loopback}, {@local}, {@loopback}, {@remote}]}}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0xa) r5 = epoll_create(0x752) ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f00000003c0)={0xb, 0xe8c, 0x8, 0x2, 0x8, 0x1}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000100)={0x80000010}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) r7 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r8 = syz_open_dev$sndctrl(0x0, 0x0, 0x40800) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r8, 0x40045532, &(0x7f0000000040)) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r10 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r11, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r11, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r9, 0x40045010, &(0x7f0000000000)) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r10, 0x4112, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r4, 0x1, 0x7, &(0x7f00000002c0)=0x200, 0xffffffffffffff30) 2.990379673s ago: executing program 3 (id=1651): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e23, 0x86, @mcast2, 0x6}, 0x1c) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00ba0100380a040008130500", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x8000002) r2 = syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00') preadv(r2, &(0x7f0000000080)=[{&(0x7f00000001c0)=""/133, 0x8a}], 0x1, 0x114a, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r3, 0x6, 0x21, &(0x7f0000002e00)="2210942272ce9a37c0fb001f95548ca7", 0x20) getsockopt$inet6_tcp_buf(r3, 0x6, 0x21, 0x0, &(0x7f0000000240)) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r2, 0x89f5, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000300)={@empty, 0x1, 0x0, 0xfffffffffffffda3, 0x0, [{@private}, {@empty}, {@initdev}, {@empty}, {}, {@loopback}, {@local}, {@loopback}, {@remote}]}}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0xa) r5 = epoll_create(0x752) ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f00000003c0)={0xb, 0xe8c, 0x8, 0x2, 0x8, 0x1}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000100)={0x80000010}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) r7 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r8 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x40800) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r8, 0x40045532, 0x0) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r10 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r11, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r11, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r9, 0x40045010, &(0x7f0000000000)) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r10, 0x4112, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) setsockopt$sock_int(r4, 0x1, 0x7, &(0x7f00000002c0)=0x200, 0xffffffffffffff30) 2.811270715s ago: executing program 3 (id=1653): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x8, 0x3, 0x39c, 0x0, 0x11, 0x148, 0x308, 0x0, 0x308, 0x2a8, 0x2a8, 0x308, 0x2a8, 0x3, 0x0, {[{{@ip={@broadcast, @broadcast, 0xffffffff, 0xff, 'vxcan1\x00', 'veth0_to_batadv\x00', {}, {}, 0x21, 0x1, 0x4}, 0x0, 0x18c, 0x1d4, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x9, 0x0, 0x8000000, 0x5, 0x7}}}, @common=@unspec=@conntrack3={{0xc4}, {{@ipv4=@broadcast, [0xff, 0xff, 0x0, 0xff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffffff, 0xffffff00, 0x0, 0xffffffff], @ipv6=@dev={0xfe, 0x80, '\x00', 0x27}, [0xffffffff, 0x0, 0x0, 0xff000000], @ipv4=@multicast2, [0x0, 0x0, 0x0, 0xffffff00], 0x6, 0x6, 0x0, 0x4e23, 0x4e24, 0x4e22, 0x4e23, 0x81}, 0x0, 0x480, 0x0, 0x0, 0x0, 0x4e20}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00'}}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0xcc, 0x134, 0x0, {}, [@inet=@rpfilter={{0x24}}, @common=@unspec=@quota={{0x38}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x5, 0xd75, 0x1, 0xc3, 'pptp\x00', 'syz1\x00', {0x81}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x3f8) 2.750184846s ago: executing program 2 (id=1654): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x10, 0x10, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8001}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x14, 0x4, 0xcc, {0x7, 0x25, 0x1, 0x1, 0x7f, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x7, 0x4, 0x3, {0x7, 0x25, 0x1, 0x2, 0xf4}}}}}}}]}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0018001c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB="08ef0a00", @ANYRESOCT=r0], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 2.346029148s ago: executing program 3 (id=1655): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e23, @broadcast}]}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x20, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = mq_open(&(0x7f0000000000)='batadv_slave_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x8000000000000000, 0x8, 0x1, 0xc05}) mq_getsetattr(r5, &(0x7f0000000040)={0x0, 0x40, 0x4, 0x7ff}, 0x0) mq_timedreceive(r5, &(0x7f0000000100)=""/90, 0x5a, 0x0, &(0x7f00000001c0)={0x77359400}) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x9, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xb, 0x2, &(0x7f0000006680)) syz_clone3(&(0x7f0000000080)={0x188801400, &(0x7f0000000000), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0) pipe(0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) io_setup(0xbf5, &(0x7f0000000200)=0x0) io_pgetevents(r7, 0xfffffffa, 0x2, &(0x7f0000000240)=[{}, {}], &(0x7f00000002c0), &(0x7f0000000340)={&(0x7f0000000300)={[0x8, 0xffff8001]}, 0x8}) setsockopt$inet_tcp_int(r6, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4) sendto$inet(r6, &(0x7f00000001c0)='\x00', 0x1, 0x800, 0x0, 0x0) splice(r6, 0x0, 0xffffffffffffffff, 0x0, 0x8a, 0xa) 1.754258659s ago: executing program 1 (id=1656): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x20000000) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8e, 0x88, 0x5, 0x20, 0x8086, 0x9500, 0xb6d8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1, 0x0, 0x0, 0x15, 0xcc, 0x1c}}]}}]}}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000a40)={&(0x7f0000000100)=[{0x1e, 0x1, 0x2, &(0x7f0000000a80)="4dce"}, {0x1000, 0x1, 0x0, 0x0}], 0x2}) 1.433856275s ago: executing program 2 (id=1657): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x10, 0x10, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8001}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x14, 0x4, 0xcc, {0x7, 0x25, 0x1, 0x1, 0x7f, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x7, 0x4, 0x3, {0x7, 0x25, 0x1, 0x2, 0xf4}}}}}}}]}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000180)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0018001c0000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\nL', @ANYRESOCT=r0], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 1.2833723s ago: executing program 4 (id=1658): openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x460900, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$SNDCTL_DSP_GETOPTR(0xffffffffffffffff, 0x800c5012, &(0x7f0000000240)) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xd) r3 = openat$zero(0xffffff9c, 0x0, 0x2401, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f00000000c0)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x800038, 0x7, 0x3, 0x180, 0x6, 0x10, 0xf1, 0x100000001, 0x1, 0xca0, 0xffffffffffffffff, 0x2000000002c, 0x0, 0x6, 0x0, 0xbd9], 0xffff1001, 0x43100}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000003c0)={[0x7, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0xa7c, 0x68ff, 0x7, 0x100008000000009, 0x803, 0x0, 0x9], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x9, 0x75, 0x6, 0x36, 0x0, 0x2, 0xb4}, {0x0, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x1, 0x1, 0xa4, 0x5, 0x5}, {0x8000000, 0xeeee0000, 0x9, 0x6, 0x5, 0xdb, 0xb, 0xff, 0x8, 0x7, 0xe, 0x7}, {0x8000, 0xd000, 0xf, 0x3, 0x16, 0x7, 0xab, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0x6, 0xa0, 0xb, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x3000, 0xa, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x81, 0x40, 0x70}, {0xdddd0000, 0x4000, 0xa, 0x5, 0xcd, 0x7, 0x1, 0x9, 0x2, 0xc, 0xb0, 0x81}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x39, 0x0, 0x3000, 0x2024, 0x2, 0x800, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(r3, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="500001040000000000000000070000090c000240fffffffffffffffa0c000640000000000000000809000100a0a46a65000000000c00024000000000000000090c0002400000000000000004602bdb175d7db012dfbc802bb3532bf66bd479daa958263398822d6dd91defc00248a855d7e7d08ea38d7e53096e90ee0ba55c9cd8ac3b76bcdee44c36"], 0x50}, 0x1, 0x0, 0x0, 0x4081}, 0x20000010) socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f00000002c0)="480000001400190d09004beafc0d8c560a8447608004000000000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff", 0x3c}], 0x1) socket$pppl2tp(0x18, 0x1, 0x1) r7 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_CLEAR_HALT(r7, 0x80045515, 0x0) 1.283020809s ago: executing program 0 (id=1659): r0 = syz_open_dev$vcsn(0x0, 0xe82e, 0x100) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x1, 0x1, 0x500, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x50) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r4, 0x0) r5 = openat$sndseq(0xffffff9c, &(0x7f00000001c0), 0x480000) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r5, 0x40505331, &(0x7f0000000440)={{0x2, 0x3}, {0x6f, 0xac}, 0x506, 0x0, 0x81}) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000000c0)={0x6b30, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000500)=r6, 0x4) mremap(&(0x7f0000fa4000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000fa2000/0x1000)=nil) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000200)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x34, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1e000000390f0000ff7f00000600000000040000", @ANYRES32, @ANYBLOB="06000000ff000000180000000023ab618c84a709967e432beb3422b8000800008b6c78b87b09cffb92fc256640afffd49e42c80900000000000000dc0f7c5543e7cb4e07367b1c0084afe0a675e3601d5111ffffffffffffff7fc100000040c3fb416c839282b6421bd561d71051349cc8a4a7090e4da13b397c8497dc11be547e12f196dea81f99b7d7e7e4cd7929c2fb66742fe8049f621f548d50c75c284a81b82ee995e3d58d141bfeda36ce48af138a4c1cad4c63f6b188e98d6ea9f9ccb6f55ef56036b2d5d28e9a9a6e5836caca35bbe8252315eec847c78feba7b70acddcfb3194314dace4a595821f8991c2508b64d660700d8c3ec1abb77de08d07768048f0a424e6c45b5a3d3a93", @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="0200000001000000000000000c00"/28], 0x50) fsmount(0xffffffffffffffff, 0x0, 0x80) r9 = socket(0x9, 0x4, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000000880)) sendmsg$TEAM_CMD_PORT_LIST_GET(r8, &(0x7f0000000f00)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000ec0)={0x0, 0x3b8}}, 0x44800) r10 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001400010603000000000000002b040000547b2a3ea65d00dbb49f7e93a2f9133d724e85fc57dbe37af8fd2aa02bc264029f0292da6d8229e714edcfd9a60cf1042a3b57a459f06b51786a9866cf85aa59a6eb2fdf42e4fe5a7c2edff36fe81b33b1edd67ce351c4a23e8b3b3e58f2c06c1d78369fdb14d18e895f5f0eafd7f0feb35c13d80814eb2f88a69610d6a2790d15958739ba9aa4b9933a16447285cd25f8308d73cc"], 0x14}, 0x1, 0x0, 0x0, 0x4001}, 0x4000) 1.161010827s ago: executing program 3 (id=1660): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) fcntl$notify(0xffffffffffffffff, 0x402, 0x69) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x8}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) r4 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r4, 0x0, 0x0) syz_open_procfs$userns(0x0, &(0x7f0000000040)) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000019a00)=@raw={'raw\x00', 0x3c1, 0x3, 0x4b0, 0x0, 0x18c, 0x203, 0x0, 0x19030000, 0x3e8, 0x2e0, 0x2e0, 0x3e8, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d4, 0x2fc, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x1d}, {0x2, 0x0, 0x0, 0x300}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x10000}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3, 0x2}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7, 0x0, 0x0, 0x4000}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {0x2, 0x1}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0xfffd, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {0x0, 0xfe}, {}, {0x0, 0x0, 0x0, 0x31}, {0x0, 0x0, 0xff}, {}, {0x0, 0xae}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {0x1}, {0x4}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa4, 0xec}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c5}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x50c) 0s ago: executing program 2 (id=1661): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x3c1, 0x3, 0x4a4, 0x0, 0x18c, 0x203, 0x0, 0x19030000, 0x3dc, 0x2e0, 0x2e0, 0x3dc, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2f8, 0x318, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {0x60}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x16}, {}, {}, {}, {0x20e}, {}, {}, {}, {}, {}, {0x0, 0x6}, {}, {}, {}, {0x7c05}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}], {0xd}}}, @inet=@rpfilter={{0x24}, {0x8}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xa4, 0xc4}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x500) kernel console output (not intermixed with test programs): tlink: 24 bytes leftover after parsing attributes in process `syz.3.913'. [ 288.593569][ T5932] usb 1-1: USB disconnect, device number 45 [ 288.917028][ T894] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 289.196086][ T894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 289.217891][ T894] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 289.241434][ T894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.301385][ T894] usb 3-1: config 0 descriptor?? [ 289.512628][ T894] usbhid 3-1:0.0: can't add hid device: -71 [ 289.524782][ T894] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 289.640276][ T894] usb 3-1: USB disconnect, device number 36 [ 289.840429][ T797] usb 2-1: USB disconnect, device number 22 [ 290.017045][ T894] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 290.062178][ T9240] netlink: 8 bytes leftover after parsing attributes in process `syz.4.919'. [ 290.118003][ T9240] ip6tnl6: entered promiscuous mode [ 290.175153][ T9245] vlan2: entered promiscuous mode [ 290.201086][ T894] usb 3-1: Using ep0 maxpacket: 32 [ 290.210464][ T894] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 290.221609][ T894] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 290.231366][ T894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.241366][ T894] usb 3-1: config 0 descriptor?? [ 290.273570][ T894] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 290.275993][ T9247] xt_bpf: check failed: parse error [ 290.339395][ T894] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 290.450348][ T9243] Set syz1 is full, maxelem 65536 reached [ 290.473069][ T9253] netlink: 20 bytes leftover after parsing attributes in process `syz.0.925'. [ 290.485390][ T9253] netlink: 8 bytes leftover after parsing attributes in process `syz.0.925'. [ 290.593715][ T30] audit: type=1804 audit(1770556197.208:500): pid=9257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.923" name="/newroot/181/bus" dev="tmpfs" ino=954 res=1 errno=0 [ 290.660608][ T9260] netlink: 7060 bytes leftover after parsing attributes in process `syz.4.923'. [ 291.080302][ T9220] netlink: 68 bytes leftover after parsing attributes in process `syz.2.912'. [ 291.179239][ T9266] netlink: 8 bytes leftover after parsing attributes in process `syz.1.927'. [ 291.995722][ T9287] netlink: 12 bytes leftover after parsing attributes in process `syz.1.934'. [ 292.242633][ T5831] usb 3-1: USB disconnect, device number 37 [ 292.262721][ T5831] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 292.518929][ T9290] Set syz1 is full, maxelem 65536 reached [ 292.921902][ T9296] xt_CT: No such helper "netbios-ns" [ 293.147016][ T5831] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 293.347173][ T9312] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 293.482503][ T5831] usb 2-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 293.496996][ T5831] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.525513][ T5831] usb 2-1: Product: syz [ 293.535769][ T5831] usb 2-1: Manufacturer: syz [ 293.553819][ T5831] usb 2-1: SerialNumber: syz [ 293.581133][ T5831] usb 2-1: config 0 descriptor?? [ 293.605159][ T5831] hub 2-1:0.0: bad descriptor, ignoring hub [ 293.628152][ T5831] hub 2-1:0.0: probe with driver hub failed with error -5 [ 293.713955][ T9317] netlink: 4 bytes leftover after parsing attributes in process `syz.2.944'. [ 293.735894][ T9317] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 293.836680][ T5831] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 294.012346][ T5831] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 294.093338][ T5831] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 294.114989][ T5831] usb 2-1: media controller created [ 294.176122][ T5831] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 294.411132][ T5831] DVB: Unable to find symbol dib7000p_attach() [ 294.437203][ T5831] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 294.658378][ T9330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 294.703448][ T9330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.766995][ T5831] rc_core: IR keymap rc-dib0700-rc5 not found [ 294.773197][ T5831] Registered IR keymap rc-empty [ 294.781987][ T5831] dvb-usb: could not initialize remote control. [ 294.804600][ T5831] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 294.861021][ T5831] usb 2-1: USB disconnect, device number 23 [ 294.976578][ T5831] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 295.399622][ T9344] loop5: detected capacity change from 0 to 7 [ 295.430949][ T9344] Dev loop5: unable to read RDB block 7 [ 295.451721][ T9344] loop5: unable to read partition table [ 295.459119][ T9344] loop5: partition table beyond EOD, truncated [ 295.465474][ T9344] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 297.344679][ T9373] netlink: 8 bytes leftover after parsing attributes in process `syz.2.959'. [ 297.379818][ T9373] ip6tnl7: entered promiscuous mode [ 297.709416][ T9384] loop5: detected capacity change from 0 to 7 [ 297.734638][ T9384] Dev loop5: unable to read RDB block 7 [ 297.747795][ T9384] loop5: unable to read partition table [ 297.753626][ T9384] loop5: partition table beyond EOD, truncated [ 297.759934][ T9384] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 297.761887][ T9381] xt_CT: No such helper "netbios-ns" [ 298.257070][ T5831] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 298.407016][ T5831] usb 4-1: Using ep0 maxpacket: 16 [ 298.413601][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 298.425793][ T5831] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 298.434991][ T5831] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.443074][ T5831] usb 4-1: Product: syz [ 298.447406][ T5831] usb 4-1: Manufacturer: syz [ 298.452020][ T5831] usb 4-1: SerialNumber: syz [ 298.458744][ T5831] usb 4-1: config 0 descriptor?? [ 298.466224][ T5831] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 298.475673][ T5831] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 299.246137][ T5831] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 299.359608][ T9409] xt_connbytes: Forcing CT accounting to be enabled [ 299.616025][ T9417] netlink: 8 bytes leftover after parsing attributes in process `syz.2.973'. [ 299.687999][ T5831] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 299.703535][ T9417] ip6tnl8: entered promiscuous mode [ 299.845296][ T5831] em28xx 4-1:0.0: board has no eeprom [ 299.863856][ T9415] Set syz1 is full, maxelem 65536 reached [ 300.092678][ T9422] loop5: detected capacity change from 0 to 7 [ 300.119826][ T9422] Dev loop5: unable to read RDB block 7 [ 300.126371][ T9419] xt_CT: No such helper "netbios-ns" [ 300.144440][ T9422] loop5: unable to read partition table [ 300.157020][ T5831] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 300.165388][ T5831] em28xx 4-1:0.0: dvb set to bulk mode. [ 300.196784][ T797] em28xx 4-1:0.0: Binding DVB extension [ 300.207472][ T9422] loop5: partition table beyond EOD, truncated [ 300.216186][ T9422] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 300.270967][ T9424] netlink: 8 bytes leftover after parsing attributes in process `syz.1.976'. [ 300.299765][ T9386] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 300.695259][ T9437] netlink: 8 bytes leftover after parsing attributes in process `syz.1.980'. [ 301.219718][ T9447] syzkaller0: entered promiscuous mode [ 301.252858][ T9447] syzkaller0: entered allmulticast mode [ 301.297389][ T9445] tipc: Started in network mode [ 301.320959][ T9445] tipc: Node identity 4a93024f4d5d, cluster identity 4711 [ 301.337724][ T9445] tipc: Enabled bearer , priority 0 [ 301.375199][ T9445] tipc: Resetting bearer [ 301.403325][ T9445] tipc: Disabling bearer [ 301.450005][ T9407] em28xx 4-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 301.456397][ T797] em28xx 4-1:0.0: Registering input extension [ 301.468468][ T894] usb 4-1: USB disconnect, device number 34 [ 301.475219][ T894] em28xx 4-1:0.0: Disconnecting em28xx [ 301.520608][ T894] em28xx 4-1:0.0: Closing input extension [ 301.702125][ T894] em28xx 4-1:0.0: Freeing device [ 301.731236][ T5932] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 301.876670][ T9461] netlink: 8 bytes leftover after parsing attributes in process `syz.2.985'. [ 301.893535][ T9461] ip6tnl9: entered promiscuous mode [ 301.917219][ T5932] usb 2-1: device descriptor read/64, error -71 [ 302.091922][ T9463] Set syz1 is full, maxelem 65536 reached [ 302.166999][ T5932] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 302.175915][ T9467] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 302.586985][ T797] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 302.653304][ T5932] usb 2-1: device descriptor read/64, error -71 [ 302.767420][ T5932] usb usb2-port1: attempt power cycle [ 302.872936][ T797] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 302.917005][ T797] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.937060][ T797] usb 4-1: Product: syz [ 302.941324][ T797] usb 4-1: Manufacturer: syz [ 302.947407][ T797] usb 4-1: SerialNumber: syz [ 303.023424][ T9476] xt_CT: No such helper "netbios-ns" [ 303.128936][ T5932] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 303.181969][ T5932] usb 2-1: device descriptor read/8, error -71 [ 303.252854][ T9479] loop5: detected capacity change from 0 to 7 [ 303.261201][ T7200] Dev loop5: unable to read RDB block 7 [ 303.266824][ T7200] loop5: unable to read partition table [ 303.273574][ T7200] loop5: partition table beyond EOD, truncated [ 303.294862][ T9479] Dev loop5: unable to read RDB block 7 [ 303.304289][ T9479] loop5: unable to read partition table [ 303.314101][ T9479] loop5: partition table beyond EOD, truncated [ 303.320762][ T9479] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 303.455074][ T5932] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 303.497640][ T5932] usb 2-1: device descriptor read/8, error -71 [ 303.589889][ T9494] netlink: 8 bytes leftover after parsing attributes in process `syz.4.997'. [ 303.609186][ T9494] ip6tnl7: entered promiscuous mode [ 303.618224][ T5932] usb usb2-port1: unable to enumerate USB device [ 303.917973][ T9501] Set syz1 is full, maxelem 65536 reached [ 304.295376][ T797] rtl8150 4-1:1.0: couldn't reset the device [ 304.308687][ T797] rtl8150 4-1:1.0: probe with driver rtl8150 failed with error -5 [ 304.481878][ T9508] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 304.576569][ T9510] xt_CT: No such helper "netbios-ns" [ 305.196983][ T9518] xt_bpf: check failed: parse error [ 305.337174][ T894] usb 4-1: USB disconnect, device number 35 [ 305.599795][ T9521] loop5: detected capacity change from 0 to 7 [ 305.609583][ T9521] Dev loop5: unable to read RDB block 7 [ 305.619577][ T9521] loop5: unable to read partition table [ 305.626505][ T9521] loop5: partition table beyond EOD, truncated [ 305.648746][ T9521] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 306.077285][ T797] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 306.119340][ T9532] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1008'. [ 306.277779][ T797] usb 3-1: Using ep0 maxpacket: 32 [ 306.322186][ T9537] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1011'. [ 306.323584][ T797] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 306.365281][ T9531] Set syz1 is full, maxelem 65536 reached [ 306.370333][ T797] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 306.406997][ T797] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 306.444558][ T797] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.456812][ T9539] xt_CT: No such helper "netbios-ns" [ 306.475679][ T797] usb 3-1: config 0 descriptor?? [ 306.629274][ T9547] xt_bpf: check failed: parse error [ 306.983488][ T797] savu 0003:1E7D:2D5A.0007: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 307.240287][ T5932] usb 3-1: USB disconnect, device number 38 [ 307.265381][ T9561] loop5: detected capacity change from 0 to 7 [ 307.296829][ T7200] Dev loop5: unable to read RDB block 7 [ 307.316113][ T7200] loop5: unable to read partition table [ 307.337383][ T7200] loop5: partition table beyond EOD, truncated [ 307.352006][ T9561] Dev loop5: unable to read RDB block 7 [ 307.367261][ T9561] loop5: unable to read partition table [ 307.375456][ T9561] loop5: partition table beyond EOD, truncated [ 307.388812][ T9561] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 307.841041][ T9576] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 309.057012][ T797] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 309.287881][ T797] usb 2-1: Using ep0 maxpacket: 8 [ 309.388029][ T797] usb 2-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 309.407076][ T797] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.427151][ T797] usb 2-1: Product: syz [ 309.437977][ T797] usb 2-1: Manufacturer: syz [ 309.447836][ T797] usb 2-1: SerialNumber: syz [ 309.475710][ T797] usb 2-1: config 0 descriptor?? [ 309.534527][ T797] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 309.856670][ T5932] usb 3-1: new full-speed USB device number 39 using dummy_hcd [ 310.230542][ T5932] usb 3-1: unable to get BOS descriptor or descriptor too short [ 310.251622][ T5932] usb 3-1: not running at top speed; connect to a high speed hub [ 310.288361][ T5932] usb 3-1: config 251 has an invalid interface number: 156 but max is 0 [ 310.299216][ T5932] usb 3-1: config 251 has no interface number 0 [ 310.310295][ T5932] usb 3-1: config 251 interface 156 has no altsetting 0 [ 310.346083][ T5932] usb 3-1: New USB device found, idVendor=103d, idProduct=0101, bcdDevice=5b.c8 [ 310.355691][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.365580][ T5932] usb 3-1: Product: syz [ 310.381741][ T5932] usb 3-1: Manufacturer: syz [ 310.387148][ T5932] usb 3-1: SerialNumber: syz [ 310.694145][ T5932] usb 3-1: unknown interface protocol 0x2c, assuming v1 [ 310.706021][ T5932] usb 3-1: cannot find UAC_HEADER [ 310.818150][ T5932] snd-usb-audio 3-1:251.156: probe with driver snd-usb-audio failed with error -22 [ 310.844011][ T5932] usb 3-1: USB disconnect, device number 39 [ 310.852403][ T6495] udevd[6495]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:251.156/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 311.112062][ T9627] Set syz1 is full, maxelem 65536 reached [ 311.222429][ T9633] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 311.380110][ T9637] tipc: Enabled bearer , priority 0 [ 311.388192][ T9637] syzkaller0: entered promiscuous mode [ 311.393866][ T9637] syzkaller0: entered allmulticast mode [ 311.406447][ T9637] syzkaller0: mtu less than device minimum [ 311.637527][ T9634] tipc: Resetting bearer [ 312.106825][ T9634] tipc: Disabling bearer [ 312.798380][ T797] gspca_sonixj: reg_w1 err -110 [ 312.892757][ T797] sonixj 2-1:0.0: probe with driver sonixj failed with error -110 [ 312.984110][ T9658] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1042'. [ 313.574478][ T9665] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1044'. [ 313.927611][ T797] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 314.270571][ T9667] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1045'. [ 314.287894][ T9667] vlan4: entered promiscuous mode [ 314.455115][ T797] usb 1-1: unable to get BOS descriptor or descriptor too short [ 314.501238][ T797] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 314.522183][ T797] usb 1-1: can't read configurations, error -71 [ 314.693415][ T5831] usb 2-1: USB disconnect, device number 29 [ 314.735089][ T9679] Set syz1 is full, maxelem 65536 reached [ 314.829722][ T9683] xt_bpf: check failed: parse error [ 314.842087][ T9686] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1050'. [ 315.328538][ T9716] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 316.467001][ T5932] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 316.617046][ T5932] usb 3-1: Using ep0 maxpacket: 16 [ 316.662818][ T5932] usb 3-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 316.673720][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.722659][ T5932] usb 3-1: Product: syz [ 316.755431][ T5932] usb 3-1: Manufacturer: syz [ 316.770426][ T5932] usb 3-1: SerialNumber: syz [ 316.788844][ T5932] usb 3-1: config 0 descriptor?? [ 316.832764][ T5932] safe_serial 3-1:0.0: safe_serial converter detected [ 316.877409][ T5932] usb 3-1: safe_serial converter now attached to ttyUSB0 [ 317.466123][ T9728] Set syz1 is full, maxelem 65536 reached [ 317.889860][ T9754] xt_bpf: check failed: parse error [ 318.317001][ T5932] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 318.522220][ T9761] syzkaller0: entered promiscuous mode [ 318.547240][ T9761] syzkaller0: entered allmulticast mode [ 318.590671][ T9762] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1068'. [ 318.617605][ T9756] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1066'. [ 318.788807][ T9756] vlan5: entered promiscuous mode [ 318.824290][ T9762] ip6tnl6: entered promiscuous mode [ 318.877312][ T5932] usb 2-1: unable to get BOS descriptor or descriptor too short [ 318.892810][ T5932] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 318.913441][ T5932] usb 2-1: can't read configurations, error -71 [ 319.113999][ T9771] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 320.012099][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 320.023444][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 320.277932][ T9763] syz.0.1067 (9763): drop_caches: 2 [ 320.324517][ T894] usb 3-1: USB disconnect, device number 40 [ 320.369219][ T894] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 320.397125][ T5932] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 320.406782][ T894] safe_serial 3-1:0.0: device disconnected [ 320.598394][ T9787] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1077'. [ 320.603165][ T5932] usb 2-1: Using ep0 maxpacket: 32 [ 320.647348][ T5932] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 320.649253][ T9787] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1077'. [ 320.671153][ T5932] usb 2-1: config 0 has no interface number 0 [ 320.685035][ T9783] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1076'. [ 320.694440][ T5932] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 320.755826][ T5932] usb 2-1: config 0 interface 85 has no altsetting 0 [ 320.798844][ T5932] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 320.810812][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.823157][ T5932] usb 2-1: Product: syz [ 320.827988][ T5932] usb 2-1: Manufacturer: syz [ 320.832599][ T5932] usb 2-1: SerialNumber: syz [ 320.844567][ T5932] usb 2-1: config 0 descriptor?? [ 320.997682][ T9781] Set syz1 is full, maxelem 65536 reached [ 321.415255][ T9808] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1081'. [ 321.547126][ T9808] ip6tnl10: entered promiscuous mode [ 322.393081][ T9820] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 322.411957][ T9822] xt_bpf: check failed: parse error [ 322.756517][ T9831] fuse: root generation should be zero [ 322.807057][ T5932] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 322.829715][ T9835] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1089'. [ 322.977060][ T5932] usb 4-1: Using ep0 maxpacket: 16 [ 322.998651][ T5932] usb 4-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 323.037017][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.044507][ T9842] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1092'. [ 323.045131][ T5932] usb 4-1: Product: syz [ 323.045149][ T5932] usb 4-1: Manufacturer: syz [ 323.045162][ T5932] usb 4-1: SerialNumber: syz [ 323.085444][ T9842] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1092'. [ 323.094995][ T894] usb 2-1: USB disconnect, device number 32 [ 323.119559][ T5932] usb 4-1: config 0 descriptor?? [ 323.130223][ T5932] safe_serial 4-1:0.0: safe_serial converter detected [ 323.178323][ T5932] usb 4-1: safe_serial converter now attached to ttyUSB0 [ 323.310228][ T9845] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1093'. [ 323.618379][ T9856] program syz.4.1094 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 323.651559][ T9840] Set syz1 is full, maxelem 65536 reached [ 323.937296][ T894] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 324.458915][ T894] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 324.494187][ T894] usb 3-1: config 4 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 324.726609][ T894] usb 3-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 324.771188][ T894] usb 3-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 324.781722][ T894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.832121][ T894] usb 3-1: Product: syz [ 324.842994][ T894] usb 3-1: Manufacturer: syz [ 324.875010][ T894] usb 3-1: SerialNumber: syz [ 324.913737][ T894] usblp0: Disabling reads from problematic bidirectional printer [ 325.091983][ T9875] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1099'. [ 325.124547][ T894] usblp 3-1:4.0: usblp0: USB Unidirectional printer dev 41 if 0 alt 0 proto 1 vid 0x03F0 pid 0x0004 [ 325.124825][ T9875] ip6tnl8: entered promiscuous mode [ 325.323825][ T5831] usb 3-1: USB disconnect, device number 41 [ 325.333743][ T5831] usblp0: removed [ 325.338476][ T797] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 325.506965][ T797] usb 1-1: Using ep0 maxpacket: 16 [ 325.519341][ T797] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 325.532960][ T797] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 325.547960][ T797] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 325.714136][ T797] usb 1-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 325.794438][ T5831] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 325.813502][ T797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.914246][ T5911] usb 4-1: USB disconnect, device number 36 [ 325.967974][ T797] usb 1-1: config 0 descriptor?? [ 325.990970][ T5911] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 326.000480][ T5831] usb 5-1: Using ep0 maxpacket: 16 [ 326.079121][ T5911] safe_serial 4-1:0.0: device disconnected [ 326.134061][ T5831] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 326.151062][ T5831] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 326.247754][ T5831] usb 5-1: Product: syz [ 326.256774][ T5831] usb 5-1: Manufacturer: syz [ 326.276643][ T5831] usb 5-1: SerialNumber: syz [ 326.302768][ T9891] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1104'. [ 326.315893][ T5831] usb 5-1: config 0 descriptor?? [ 326.397889][ T9891] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1104'. [ 326.481313][ T9876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 326.520847][ T9876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.851791][ T797] usbhid 1-1:0.0: can't add hid device: -71 [ 326.860501][ T797] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 326.898566][ T797] usb 1-1: USB disconnect, device number 48 [ 327.668211][ T9914] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1112'. [ 327.802673][ T9914] ip6tnl4: entered promiscuous mode [ 328.297020][ T5831] usb 1-1: new full-speed USB device number 49 using dummy_hcd [ 328.304863][ T797] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 328.385174][ T9904] syz.3.1109 (9904): drop_caches: 2 [ 328.437054][ T5831] usb 1-1: device descriptor read/64, error -71 [ 328.466985][ T797] usb 2-1: Using ep0 maxpacket: 16 [ 328.476465][ T797] usb 2-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 328.486546][ T797] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.502987][ T797] usb 2-1: Product: syz [ 328.512924][ T797] usb 2-1: Manufacturer: syz [ 328.522621][ T797] usb 2-1: SerialNumber: syz [ 328.535599][ T797] usb 2-1: config 0 descriptor?? [ 328.550063][ T797] safe_serial 2-1:0.0: safe_serial converter detected [ 328.564432][ T9922] xt_bpf: check failed: parse error [ 328.572006][ T797] usb 2-1: safe_serial converter now attached to ttyUSB0 [ 328.692251][ T5831] usb 1-1: new full-speed USB device number 50 using dummy_hcd [ 328.713511][ T894] usb 5-1: USB disconnect, device number 30 [ 328.763624][ T9925] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1117'. [ 328.780923][ T9925] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1117'. [ 328.927055][ T5831] usb 1-1: device descriptor read/64, error -71 [ 329.064446][ T5831] usb usb1-port1: attempt power cycle [ 329.294458][ T9946] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1122'. [ 329.544249][ T5831] usb 1-1: new full-speed USB device number 51 using dummy_hcd [ 329.626260][ T5831] usb 1-1: device descriptor read/8, error -71 [ 329.887014][ T5831] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 329.907677][ T5831] usb 1-1: device descriptor read/8, error -71 [ 329.930251][ T9953] xt_CT: You must specify a L4 protocol and not use inversions on it [ 330.090179][ T5831] usb usb1-port1: unable to enumerate USB device [ 330.617842][ T9965] xt_bpf: check failed: parse error [ 331.155865][ T894] usb 2-1: USB disconnect, device number 33 [ 331.166725][ T894] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 331.262152][ T9973] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1129'. [ 331.311405][ T9973] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1129'. [ 331.386524][ T894] safe_serial 2-1:0.0: device disconnected [ 331.511865][ T9980] xt_hashlimit: Unknown mode mask 4000, kernel too old? [ 331.537183][ T5831] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 331.661169][ T9985] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1133'. [ 331.721438][ T5831] usb 4-1: Using ep0 maxpacket: 16 [ 331.740829][ T5831] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 331.751280][ T5831] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 331.759534][ T5831] usb 4-1: Product: syz [ 331.764407][ T5831] usb 4-1: Manufacturer: syz [ 331.769149][ T5831] usb 4-1: SerialNumber: syz [ 331.775875][ T5831] usb 4-1: config 0 descriptor?? [ 333.025661][T10008] xt_bpf: check failed: parse error [ 333.327376][T10010] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1140'. [ 333.379305][T10012] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1140'. [ 333.717493][ T894] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 333.717821][T10024] lo: entered promiscuous mode [ 333.791704][T10024] lo: entered allmulticast mode [ 333.809069][T10024] tunl0: entered promiscuous mode [ 333.846763][T10024] tunl0: entered allmulticast mode [ 333.865160][T10024] gre0: entered promiscuous mode [ 333.874430][T10024] gre0: entered allmulticast mode [ 333.887270][ T894] usb 2-1: Using ep0 maxpacket: 16 [ 333.967993][T10024] gretap0: entered allmulticast mode [ 333.974317][T10024] erspan0: entered promiscuous mode [ 333.992614][T10024] erspan0: entered allmulticast mode [ 333.998507][ T894] usb 2-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 334.016653][ T894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.032506][T10024] ip_vti0: entered promiscuous mode [ 334.068444][ T894] usb 2-1: Product: syz [ 334.072626][ T894] usb 2-1: Manufacturer: syz [ 334.087183][T10024] ip_vti0: entered allmulticast mode [ 334.093200][T10024] ip6_vti0: entered promiscuous mode [ 334.100435][ T894] usb 2-1: SerialNumber: syz [ 334.117127][ T894] usb 2-1: config 0 descriptor?? [ 334.130423][T10024] ip6_vti0: entered allmulticast mode [ 334.141444][ T894] safe_serial 2-1:0.0: safe_serial converter detected [ 334.158378][T10024] sit0: entered promiscuous mode [ 334.163345][T10024] sit0: entered allmulticast mode [ 334.171458][ T894] usb 2-1: safe_serial converter now attached to ttyUSB0 [ 334.181056][ T5932] usb 4-1: USB disconnect, device number 37 [ 334.200132][T10024] ip6tnl0: entered promiscuous mode [ 334.218947][T10024] ip6tnl0: entered allmulticast mode [ 334.226790][T10024] ip6gre0: entered promiscuous mode [ 334.245796][T10024] ip6gre0: entered allmulticast mode [ 334.258025][T10024] syz_tun: entered promiscuous mode [ 334.266472][T10024] syz_tun: entered allmulticast mode [ 334.306010][T10024] ip6gretap0: entered promiscuous mode [ 334.315323][T10024] ip6gretap0: entered allmulticast mode [ 334.336357][T10024] bridge0: entered allmulticast mode [ 334.459154][ T5831] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 334.510773][T10040] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1149'. [ 334.547664][T10040] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1149'. [ 334.632342][ T5831] usb 1-1: Using ep0 maxpacket: 16 [ 334.641757][ T5831] usb 1-1: config 9 has an invalid interface number: 118 but max is 2 [ 334.654739][ T5831] usb 1-1: config 9 contains an unexpected descriptor of type 0x2, skipping [ 334.822237][ T5831] usb 1-1: config 9 contains an unexpected descriptor of type 0x2, skipping [ 334.900573][ T5831] usb 1-1: config 9 has an invalid interface number: 142 but max is 2 [ 334.990187][ T5831] usb 1-1: config 9 has an invalid interface number: 3 but max is 2 [ 335.029309][T10050] xt_bpf: check failed: parse error [ 335.064199][ T5831] usb 1-1: config 9 contains an unexpected descriptor of type 0x1, skipping [ 335.094202][ T5831] usb 1-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 335.122129][ T5831] usb 1-1: config 9 has no interface number 0 [ 335.226544][ T5831] usb 1-1: config 9 has no interface number 1 [ 335.248804][ T5831] usb 1-1: config 9 has no interface number 2 [ 335.292660][ T5831] usb 1-1: config 9 interface 118 altsetting 5 bulk endpoint 0x6 has invalid maxpacket 16 [ 335.317480][ T5831] usb 1-1: config 9 interface 118 altsetting 5 endpoint 0x3 has invalid wMaxPacketSize 0 [ 335.330267][ T5831] usb 1-1: config 9 interface 118 altsetting 5 has a duplicate endpoint with address 0x3, skipping [ 335.545158][ T5831] usb 1-1: config 9 interface 118 altsetting 5 endpoint 0x5 has invalid maxpacket 1072, setting to 1024 [ 335.586515][ T5831] usb 1-1: config 9 interface 118 altsetting 5 has a duplicate endpoint with address 0xE, skipping [ 335.837007][ T5831] usb 1-1: config 9 interface 142 altsetting 134 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 336.034541][ T5831] usb 1-1: too many endpoints for config 9 interface 3 altsetting 202: 229, using maximum allowed: 30 [ 336.057760][ T5831] usb 1-1: config 9 interface 3 altsetting 202 has 0 endpoint descriptors, different from the interface descriptor's value: 229 [ 336.076698][ T5831] usb 1-1: config 9 interface 118 has no altsetting 0 [ 336.114265][ T5831] usb 1-1: config 9 interface 142 has no altsetting 0 [ 336.127665][ T5831] usb 1-1: config 9 interface 3 has no altsetting 0 [ 336.144670][ T5831] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0123, bcdDevice=30.1b [ 336.159538][ T5831] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.169188][ T5831] usb 1-1: Product: syz [ 336.173509][ T5831] usb 1-1: Manufacturer: ఌ [ 336.178761][ T5831] usb 1-1: SerialNumber: syz [ 336.199370][T10055] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1153'. [ 336.220714][T10033] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 336.231413][T10033] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 336.254144][T10055] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1153'. [ 336.871324][T10055] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 336.932564][T10033] netlink: 'syz.0.1147': attribute type 1 has an invalid length. [ 336.942163][ T5932] usb 2-1: USB disconnect, device number 34 [ 336.952814][T10033] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 336.982937][ T5932] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 337.018689][T10055] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 337.032510][ T5932] safe_serial 2-1:0.0: device disconnected [ 337.079090][T10033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.095000][T10055] bond0 (unregistering): Released all slaves [ 337.194577][T10033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.451959][T10033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.474867][T10033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.526425][ T5831] kvaser_usb 1-1:9.118: error -ENODEV: Cannot get usb endpoint(s) [ 337.552734][ T5831] kvaser_usb 1-1:9.142: error -ENODEV: Cannot get usb endpoint(s) [ 337.565456][ T5831] kvaser_usb 1-1:9.3: error -ENODEV: Cannot get usb endpoint(s) [ 337.628124][ T5831] usb 1-1: USB disconnect, device number 53 [ 337.715133][T10071] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1157'. [ 337.732048][T10071] ip6tnl11: entered promiscuous mode [ 337.921279][T10083] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1160'. [ 338.204912][ T5932] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 338.387159][ T5932] usb 2-1: Using ep0 maxpacket: 16 [ 338.403361][ T5932] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 338.417380][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 338.427905][ T5831] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 338.453432][ T5932] usb 2-1: Product: syz [ 338.656979][ T5932] usb 2-1: Manufacturer: syz [ 338.667419][ T5932] usb 2-1: SerialNumber: syz [ 338.702392][ T5831] usb 3-1: Using ep0 maxpacket: 16 [ 338.703428][ T5932] usb 2-1: config 0 descriptor?? [ 338.723921][ T5831] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 338.757217][ T5831] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 338.777115][ T5831] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 338.877874][T10097] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 339.113109][ T5831] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.263116][ T5831] usb 3-1: config 0 descriptor?? [ 339.709232][ T5831] corsair 0003:1B1C:1B02.0008: item fetching failed at offset 2/5 [ 339.742688][ T5831] corsair 0003:1B1C:1B02.0008: parse failed [ 339.759809][ T5831] corsair 0003:1B1C:1B02.0008: probe with driver corsair failed with error -22 [ 339.951945][ T5932] usb 3-1: USB disconnect, device number 42 [ 340.135935][T10106] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1167'. [ 340.189253][T10106] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1167'. [ 340.701134][T10113] loop5: detected capacity change from 0 to 7 [ 340.785693][ T5911] usb 2-1: USB disconnect, device number 35 [ 340.807297][T10113] Dev loop5: unable to read RDB block 7 [ 340.851911][T10116] xt_bpf: check failed: parse error [ 340.862910][T10113] loop5: unable to read partition table [ 340.882993][T10113] loop5: partition table beyond EOD, truncated [ 340.902557][T10113] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 341.667061][T10134] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1172'. [ 341.702090][T10134] ip6tnl7: entered promiscuous mode [ 342.662316][T10157] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 342.765931][T10166] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1178'. [ 342.786555][T10166] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1178'. [ 342.833734][T10168] netlink: 'syz.4.1177': attribute type 10 has an invalid length. [ 343.120803][T10168] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.128328][T10168] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.157421][T10168] bridge0: left allmulticast mode [ 343.245898][T10168] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.253202][T10168] bridge0: port 2(bridge_slave_1) entered forwarding state [ 343.261896][T10168] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.269124][T10168] bridge0: port 1(bridge_slave_0) entered forwarding state [ 343.532394][T10168] team0: Port device bridge0 added [ 344.527788][T10205] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1186'. [ 344.630957][T10205] ip6tnl9: entered promiscuous mode [ 344.767534][T10201] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1185'. [ 344.928769][T10207] bridge_slave_0: left allmulticast mode [ 344.928796][T10207] bridge_slave_0: left promiscuous mode [ 344.929015][T10207] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.072416][T10207] bridge_slave_1: left allmulticast mode [ 345.072443][T10207] bridge_slave_1: left promiscuous mode [ 345.072732][T10207] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.182061][T10207] team0: Port device team_slave_0 removed [ 345.234505][T10207] team0: Port device team_slave_1 removed [ 345.235381][T10207] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 345.235405][T10207] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 345.330522][T10207] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 345.330550][T10207] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 345.342900][T10207] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 346.837402][T10265] xt_hashlimit: Unknown mode mask 8000000, kernel too old? [ 349.091324][T10307] bridge0: port 2(bridge_slave_1) entered disabled state [ 349.098622][T10307] bridge0: port 1(bridge_slave_0) entered disabled state [ 349.104700][T10315] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1211'. [ 349.122557][T10317] xt_hashlimit: Unknown mode mask 20000000, kernel too old? [ 349.235554][T10307] team0: Port device bridge0 removed [ 349.324046][T10307] bridge_slave_0: left allmulticast mode [ 349.329946][T10307] bridge_slave_0: left promiscuous mode [ 349.335831][T10307] bridge0: port 1(bridge_slave_0) entered disabled state [ 349.538051][ T5912] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 349.673193][T10307] bridge_slave_1: left allmulticast mode [ 349.680715][T10307] bridge_slave_1: left promiscuous mode [ 349.686537][T10307] bridge0: port 2(bridge_slave_1) entered disabled state [ 349.722724][T10307] team0: Port device team_slave_0 removed [ 349.740906][T10307] team0: Port device team_slave_1 removed [ 349.765543][T10307] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 349.788219][T10307] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 349.810830][T10307] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 349.819578][T10307] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 349.839284][T10307] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 349.861264][ T5912] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 349.906038][ T5912] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 349.947450][T10326] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 349.964985][ T5912] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.995614][ T5912] usb 1-1: config 0 descriptor?? [ 351.016987][ T5911] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 351.032255][ T5912] usbhid 1-1:0.0: can't add hid device: -71 [ 351.043454][ T5912] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 351.111982][ T5912] usb 1-1: USB disconnect, device number 54 [ 351.256959][ T5911] usb 4-1: Using ep0 maxpacket: 16 [ 351.729061][ T5911] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 351.736936][T10352] xt_bpf: check failed: parse error [ 351.747026][ T5911] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 351.747054][ T5911] usb 4-1: Product: syz [ 351.747068][ T5911] usb 4-1: Manufacturer: syz [ 351.747081][ T5911] usb 4-1: SerialNumber: syz [ 351.750719][ T5911] usb 4-1: config 0 descriptor?? [ 352.115149][T10363] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1222'. [ 352.368882][ T5912] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 352.666811][ T5912] usb 5-1: Using ep0 maxpacket: 16 [ 352.749522][ T5912] usb 5-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 352.758611][ T5912] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.766653][ T5912] usb 5-1: Product: syz [ 352.772418][ T5912] usb 5-1: Manufacturer: syz [ 352.782694][ T5912] usb 5-1: SerialNumber: syz [ 352.800748][ T5912] usb 5-1: config 0 descriptor?? [ 352.819828][ T5912] safe_serial 5-1:0.0: safe_serial converter detected [ 352.885904][ T5912] usb 5-1: safe_serial converter now attached to ttyUSB0 [ 353.648165][ T5912] usb 4-1: USB disconnect, device number 38 [ 354.325576][T10399] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1227'. [ 354.761922][T10400] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 354.841257][T10400] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 355.065672][ T5911] usb 5-1: USB disconnect, device number 31 [ 355.195767][ T5911] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 355.217968][ T5911] safe_serial 5-1:0.0: device disconnected [ 355.634542][T10414] sch_tbf: burst 22 is lower than device lo mtu (1550) ! [ 356.557047][ T5911] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 356.776139][ T5911] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 356.803541][ T5911] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 356.834516][ T5911] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 356.881796][ T5911] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.003444][T10436] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1234'. [ 357.056280][T10426] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 357.145831][ T5911] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 357.274948][T10426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 357.284533][T10426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 357.683528][ T30] audit: type=1326 audit(1770556264.348:501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 357.733724][ T30] audit: type=1326 audit(1770556264.348:502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=327 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 357.747066][ T5911] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 357.773906][ T30] audit: type=1326 audit(1770556264.348:503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 357.797466][ T30] audit: type=1326 audit(1770556264.348:504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=329 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 357.868877][ T30] audit: type=1326 audit(1770556264.348:505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 357.896594][ T30] audit: type=1326 audit(1770556264.348:506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 357.922291][ T30] audit: type=1326 audit(1770556264.348:507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 357.952433][ T5912] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 357.998148][ T30] audit: type=1326 audit(1770556264.348:508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=6 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 358.037026][ T5911] usb 2-1: Using ep0 maxpacket: 32 [ 358.055015][ T5911] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 358.063649][ T5911] usb 2-1: config 0 has no interface number 0 [ 358.072799][ T5911] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 358.155830][ T5912] usb 5-1: Using ep0 maxpacket: 16 [ 358.202549][ T5911] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.215584][ T5911] usb 2-1: Product: syz [ 358.225853][ T5911] usb 2-1: Manufacturer: syz [ 358.241473][ T30] audit: type=1326 audit(1770556264.348:509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 358.269800][ T5912] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 358.293910][ T5912] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 358.314305][ T5911] usb 2-1: SerialNumber: syz [ 358.314378][ T30] audit: type=1326 audit(1770556264.348:510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10419 comm="syz.3.1231" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 358.341925][ T5912] usb 5-1: Product: syz [ 358.349954][ T5912] usb 5-1: Manufacturer: syz [ 358.357825][ T5912] usb 5-1: SerialNumber: syz [ 358.367926][ T5912] usb 5-1: config 0 descriptor?? [ 358.437220][ T5911] usb 2-1: config 0 descriptor?? [ 358.447799][ T5911] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 358.723690][ T5911] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 358.759555][ T5911] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 359.210270][ T5912] usb 4-1: USB disconnect, device number 39 [ 359.564951][T10456] xt_CT: No such helper "netbios-ns" [ 359.803177][T10454] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.819528][T10454] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.063699][T10454] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 360.622983][T10454] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.693815][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 360.704233][ T5911] usb 2-1: USB disconnect, device number 36 [ 360.712708][ T5911] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 360.739724][ T5911] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 360.773271][ T5911] quatech2 2-1:0.51: device disconnected [ 360.888489][ T5932] usb 5-1: USB disconnect, device number 32 [ 361.202290][T10479] sch_tbf: burst 22 is lower than device lo mtu (1550) ! [ 361.300934][ T797] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 361.357205][ T5932] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 361.467281][ T797] usb 3-1: Using ep0 maxpacket: 16 [ 361.483741][ T797] usb 3-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 361.495940][ T797] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.608382][ T797] usb 3-1: Product: syz [ 361.612598][ T797] usb 3-1: Manufacturer: syz [ 361.617238][ T797] usb 3-1: SerialNumber: syz [ 361.623693][ T797] usb 3-1: config 0 descriptor?? [ 361.632117][ T5932] usb 2-1: device descriptor read/64, error -71 [ 361.635099][ T797] safe_serial 3-1:0.0: safe_serial converter detected [ 361.650791][ T797] usb 3-1: safe_serial converter now attached to ttyUSB0 [ 361.907134][ T5932] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 362.462371][T10487] Set syz1 is full, maxelem 65536 reached [ 362.508010][T10490] xt_CT: You must specify a L4 protocol and not use inversions on it [ 363.040496][T10496] loop5: detected capacity change from 0 to 7 [ 363.056548][T10496] Dev loop5: unable to read RDB block 7 [ 363.079233][T10496] loop5: unable to read partition table [ 363.095376][T10496] loop5: partition table beyond EOD, truncated [ 363.122945][T10496] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 363.337172][ T797] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 363.538571][ T797] usb 4-1: Using ep0 maxpacket: 8 [ 363.564985][ T797] usb 4-1: config 64 has an invalid interface number: 19 but max is 0 [ 363.589072][ T797] usb 4-1: config 64 has no interface number 0 [ 363.643154][ T797] usb 4-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=3f.e0 [ 363.691386][ T797] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.829570][ T797] usb 4-1: probing VID:PID(2201:012C) [ 363.847029][ T5932] usb 2-1: device descriptor read/64, error -71 [ 363.878243][ T5911] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 363.899838][ T797] usb 4-1: Could not find two sets of bulk-in/out endpoint pairs [ 363.947723][ T797] vub300 4-1:64.19: probe with driver vub300 failed with error -22 [ 363.959202][ T5932] usb usb2-port1: attempt power cycle [ 364.120491][ T5911] usb 5-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 364.147631][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.210900][ T5912] usb 3-1: USB disconnect, device number 43 [ 364.221597][ T5912] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 364.242761][T10515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.255063][ T5911] usb 5-1: Product: syz [ 364.274801][ T5911] usb 5-1: Manufacturer: syz [ 364.285443][ T5911] usb 5-1: SerialNumber: syz [ 364.303568][ T5911] usb 5-1: config 0 descriptor?? [ 364.324942][ T5912] safe_serial 3-1:0.0: device disconnected [ 364.331176][ T5932] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 364.349494][T10515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.379812][ T5911] hub 5-1:0.0: bad descriptor, ignoring hub [ 364.385858][ T5911] hub 5-1:0.0: probe with driver hub failed with error -5 [ 364.387781][ T5932] usb 2-1: Using ep0 maxpacket: 16 [ 364.489627][ T5932] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 364.519163][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 364.528143][ T5932] usb 2-1: Product: syz [ 364.532345][ T5932] usb 2-1: Manufacturer: syz [ 364.538251][ T5932] usb 2-1: SerialNumber: syz [ 364.554425][ T5932] usb 2-1: config 0 descriptor?? [ 364.554614][T10518] xt_bpf: check failed: parse error [ 364.628273][ T5911] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 364.656198][ T797] usb 4-1: USB disconnect, device number 40 [ 364.748107][ T5911] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 364.831233][ T5911] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 364.877182][ T5911] usb 5-1: media controller created [ 364.949173][ T5911] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 364.986542][T10524] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 365.197048][ T5932] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 365.299681][ T5911] DVB: Unable to find symbol dib7000p_attach() [ 365.306169][ T5911] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 365.362326][T10522] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1256'. [ 365.386217][T10522] vlan5: entered promiscuous mode [ 365.617114][ T5911] rc_core: IR keymap rc-dib0700-rc5 not found [ 365.647130][ T5911] Registered IR keymap rc-empty [ 365.667669][ T5911] dvb-usb: could not initialize remote control. [ 365.687276][ T5911] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 365.915136][ T5932] usb 3-1: unable to get BOS descriptor or descriptor too short [ 365.931784][ T5932] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 366.129963][ T5932] usb 3-1: can't read configurations, error -71 [ 366.152282][ T5912] usb 5-1: USB disconnect, device number 33 [ 366.261302][ T5912] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 366.510807][T10534] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1258'. [ 366.559575][ T24] usb 2-1: USB disconnect, device number 39 [ 366.812124][T10540] xt_CT: You must specify a L4 protocol and not use inversions on it [ 367.057965][T10548] loop5: detected capacity change from 0 to 7 [ 367.097462][T10548] Dev loop5: unable to read RDB block 7 [ 367.108408][T10548] loop5: unable to read partition table [ 367.114347][T10548] loop5: partition table beyond EOD, truncated [ 367.281897][T10548] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 367.313043][T10556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1266'. [ 367.377648][T10552] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.457114][T10552] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 367.479779][T10556] ip6tnl12: entered promiscuous mode [ 367.608146][T10551] Set syz1 is full, maxelem 65536 reached [ 368.600409][ T5911] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 368.627138][ T5932] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 368.657960][T10566] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 368.869090][ T5932] usb 3-1: Using ep0 maxpacket: 16 [ 368.979328][T10571] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1271'. [ 369.064872][ T5932] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 369.082859][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 369.093931][T10571] vlan4: entered promiscuous mode [ 369.103590][ T5932] usb 3-1: Product: syz [ 369.130177][ T5932] usb 3-1: Manufacturer: syz [ 369.159026][ T5932] usb 3-1: SerialNumber: syz [ 369.217503][ T5932] usb 3-1: config 0 descriptor?? [ 369.274175][ T5911] usb 5-1: unable to get BOS descriptor or descriptor too short [ 369.293296][ T5911] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 369.321760][ T5911] usb 5-1: can't read configurations, error -71 [ 369.506764][T10578] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1272'. [ 369.537649][T10578] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1272'. [ 370.330730][T10591] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1278'. [ 370.438538][T10594] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1278'. [ 370.659824][T10594] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.774838][T10594] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 370.810706][T10594] bond0 (unregistering): Released all slaves [ 370.993485][T10602] xt_bpf: check failed: parse error [ 371.071291][T10604] loop5: detected capacity change from 0 to 7 [ 371.085294][T10147] Dev loop5: unable to read RDB block 7 [ 371.103766][T10147] loop5: unable to read partition table [ 371.112438][T10147] loop5: partition table beyond EOD, truncated [ 371.140120][T10604] Dev loop5: unable to read RDB block 7 [ 371.179499][T10604] loop5: unable to read partition table [ 371.193186][T10604] loop5: partition table beyond EOD, truncated [ 371.218446][ T5911] usb 3-1: USB disconnect, device number 46 [ 371.245596][T10604] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 371.285887][T10608] vlan2: entered promiscuous mode [ 371.537960][T10619] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1284'. [ 371.570138][T10621] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1286'. [ 371.760205][T10632] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1290'. [ 371.808169][T10632] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1290'. [ 371.854394][T10635] xt_bpf: check failed: parse error [ 372.089625][T10644] loop5: detected capacity change from 0 to 7 [ 372.098009][T10644] Dev loop5: unable to read RDB block 7 [ 372.103629][T10644] loop5: unable to read partition table [ 372.207153][T10644] loop5: partition table beyond EOD, truncated [ 372.267031][T10644] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 372.531239][ T5911] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 372.667189][T10654] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1297'. [ 372.737473][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 372.768590][T10654] ip6tnl8: entered promiscuous mode [ 372.776766][ T5911] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 372.788924][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 372.799182][ T5911] usb 3-1: Product: syz [ 372.803492][ T5911] usb 3-1: Manufacturer: syz [ 372.810371][ T5911] usb 3-1: SerialNumber: syz [ 372.819922][ T5911] usb 3-1: config 0 descriptor?? [ 372.967026][ T797] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 373.161634][ T797] usb 5-1: device descriptor read/64, error -71 [ 373.407045][ T797] usb 5-1: new full-speed USB device number 37 using dummy_hcd [ 373.426735][T10669] xt_CT: No such helper "netbios-ns" [ 373.448372][T10667] dlm: no locking on control device [ 373.538411][ T797] usb 5-1: device descriptor read/64, error -71 [ 373.602028][T10677] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1304'. [ 373.637194][T10677] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1304'. [ 373.651764][ T797] usb usb5-port1: attempt power cycle [ 373.682301][T10677] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1304'. [ 374.366483][ T797] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 374.404557][ T797] usb 5-1: device descriptor read/8, error -71 [ 374.651705][ T797] usb 5-1: new full-speed USB device number 39 using dummy_hcd [ 374.698023][ T797] usb 5-1: device descriptor read/8, error -71 [ 374.728737][T10697] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1310'. [ 374.753913][T10697] ip6tnl5: entered promiscuous mode [ 374.817433][ T797] usb usb5-port1: unable to enumerate USB device [ 375.108612][ T5932] usb 3-1: USB disconnect, device number 47 [ 376.213642][T10732] syz.0.1320 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 376.243315][T10734] openvswitch: netlink: Flow key attr not present in new flow. [ 376.321528][T10732] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1320'. [ 376.645594][ T5932] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 377.231514][ T5911] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 377.240761][ T5932] usb 2-1: device descriptor read/64, error -71 [ 377.408591][ T5911] usb 5-1: Using ep0 maxpacket: 16 [ 377.621612][ T5932] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 377.860764][ T5911] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 377.898507][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 377.927029][ T5932] usb 2-1: device descriptor read/64, error -71 [ 377.947342][ T5911] usb 5-1: Product: syz [ 378.005473][ T5911] usb 5-1: Manufacturer: syz [ 378.039942][ T5911] usb 5-1: SerialNumber: syz [ 378.087192][ T5932] usb usb2-port1: attempt power cycle [ 378.096287][T10767] tipc: Started in network mode [ 378.105124][ T5911] usb 5-1: config 0 descriptor?? [ 378.161138][T10767] tipc: Node identity 6e11e94576f6, cluster identity 4711 [ 378.241088][T10767] tipc: Enabled bearer , priority 0 [ 378.279581][T10773] syzkaller0: entered promiscuous mode [ 378.285410][T10773] syzkaller0: entered allmulticast mode [ 378.323546][T10767] tipc: Resetting bearer [ 378.360354][T10766] tipc: Resetting bearer [ 378.398605][T10766] tipc: Disabling bearer [ 378.427039][ T5932] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 378.468770][ T5932] usb 2-1: device descriptor read/8, error -71 [ 378.717083][ T5932] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 379.221494][ T5932] usb 2-1: device not accepting address 43, error -71 [ 379.231872][ T5932] usb usb2-port1: unable to enumerate USB device [ 379.847005][ T5932] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 380.007148][ T5932] usb 4-1: Using ep0 maxpacket: 32 [ 380.016159][ T5932] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 380.024645][ T5932] usb 4-1: config 0 has no interface number 0 [ 380.033233][ T5932] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 380.042667][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.051090][ T5932] usb 4-1: Product: syz [ 380.055366][ T5932] usb 4-1: Manufacturer: syz [ 380.060557][ T5932] usb 4-1: SerialNumber: syz [ 380.067126][ T5932] usb 4-1: config 0 descriptor?? [ 380.075005][ T5932] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 380.288840][ T5932] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 380.301409][ T5932] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 380.471931][ T5932] usb 5-1: USB disconnect, device number 40 [ 380.944050][T10791] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.978627][T10791] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.145689][T10791] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.158701][T10791] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.302649][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 381.310736][ T5932] usb 4-1: USB disconnect, device number 41 [ 381.381900][ T5932] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 381.457684][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 381.464162][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.573813][ T5932] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 381.648028][ T5932] quatech2 4-1:0.51: device disconnected [ 382.137139][ T5932] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 382.617133][ T5932] usb 4-1: device descriptor read/64, error -71 [ 382.762838][T10817] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1337'. [ 382.802372][T10822] xt_CT: You must specify a L4 protocol and not use inversions on it [ 383.114670][T10817] ip6tnl6: entered promiscuous mode [ 383.461644][T10833] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 383.627275][ T5911] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 383.828444][T10841] Set syz1 is full, maxelem 65536 reached [ 383.847004][ T5911] usb 5-1: Using ep0 maxpacket: 16 [ 383.902232][ T5911] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 383.937534][ T5932] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 383.948668][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.986029][ T5911] usb 5-1: Product: syz [ 384.001795][ T5911] usb 5-1: Manufacturer: syz [ 384.025071][ T5911] usb 5-1: SerialNumber: syz [ 384.052774][ T5911] usb 5-1: config 0 descriptor?? [ 384.088634][ T5911] mcba_usb 5-1:0.0: Can't find endpoints [ 384.113942][ T5932] usb 4-1: Using ep0 maxpacket: 16 [ 384.208248][ T5932] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 384.262628][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 384.312841][T10835] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 384.327171][ T5932] usb 4-1: Product: syz [ 384.331482][ T5932] usb 4-1: Manufacturer: syz [ 384.346356][ T5932] usb 4-1: SerialNumber: syz [ 384.351574][T10835] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.372374][ T5932] usb 4-1: config 0 descriptor?? [ 384.407154][ T5911] usb 5-1: USB disconnect, device number 41 [ 384.693987][T10854] qrtr: Invalid version 225 [ 385.057322][ T5911] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 385.288412][ T5911] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 385.297843][ T5911] usb 2-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 385.333094][ T5911] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.384995][ T5911] usb 2-1: config 0 descriptor?? [ 385.445706][T10861] xt_CT: No such helper "netbios-ns" [ 385.529443][T10866] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1353'. [ 386.243595][T10880] Set syz1 is full, maxelem 65536 reached [ 386.681749][ T5911] usb 4-1: USB disconnect, device number 44 [ 386.707155][ T5932] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 386.873515][ T5932] usb 5-1: Using ep0 maxpacket: 32 [ 386.885512][ T5932] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 387.102693][ T5932] usb 5-1: config 0 has no interface number 0 [ 387.118164][ T5932] usb 5-1: config 0 interface 184 has no altsetting 0 [ 387.174687][ T5932] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 387.192725][ T5932] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.202795][ T5932] usb 5-1: Product: syz [ 387.208660][ T5932] usb 5-1: Manufacturer: syz [ 387.225331][ T5932] usb 5-1: SerialNumber: syz [ 387.241286][ T5932] usb 5-1: config 0 descriptor?? [ 387.309555][ T5932] smsc75xx v1.0.0 [ 387.715067][ T5911] usb 2-1: USB disconnect, device number 44 [ 387.907986][ T5932] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 387.937161][ T5932] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 388.169992][T10912] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1364'. [ 388.179225][ T5932] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 388.214230][ T5932] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 388.244971][T10914] xt_CT: No such helper "netbios-ns" [ 388.253425][T10912] ip6tnl9: entered promiscuous mode [ 388.260569][ T5932] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 388.287659][ T5932] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -61 [ 388.432102][T10920] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1368'. [ 388.667426][ T5932] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 388.754072][T10927] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1360'. [ 388.831408][ T5932] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 388.844077][ T5932] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 388.854172][ T5932] usb 2-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 388.863547][ T5932] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.879011][ T5932] usb 2-1: config 0 descriptor?? [ 389.310758][ T5932] elan 0003:04F3:0755.0009: failed to start in urb: -90 [ 389.323788][ T5932] elan 0003:04F3:0755.0009: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.1-1/input0 [ 389.525382][T10918] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 389.534387][T10918] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 389.545072][ T5911] usb 2-1: USB disconnect, device number 45 [ 389.814850][ T5932] usb 5-1: USB disconnect, device number 42 [ 390.290328][T10953] xt_CT: No such helper "netbios-ns" [ 390.567000][ T5911] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 390.807179][ T5911] usb 5-1: Using ep0 maxpacket: 16 [ 391.037009][ T5911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8 has an invalid bInterval 0, changing to 7 [ 391.048237][ T5911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 391.060508][ T5911] usb 5-1: New USB device found, idVendor=077d, idProduct=0410, bcdDevice=ec.c1 [ 391.069865][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.078060][ T5911] usb 5-1: Product: syz [ 391.082339][ T5911] usb 5-1: Manufacturer: syz [ 391.087452][ T5911] usb 5-1: SerialNumber: syz [ 391.100951][ T5911] usb 5-1: config 0 descriptor?? [ 391.314468][T10971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 391.323306][T10971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 391.346601][ T5911] powermate 5-1:0.0: probe with driver powermate failed with error -5 [ 391.367895][ T5911] usb 5-1: USB disconnect, device number 43 [ 392.025590][T10982] openvswitch: netlink: Flow key attr not present in new flow. [ 392.335516][T10989] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1372'. [ 392.349836][T10989] vlan4: entered promiscuous mode [ 392.587231][ T5932] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 392.847378][ T5932] usb 4-1: device descriptor read/64, error -71 [ 393.128356][ T5932] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 393.220225][T10994] xt_CT: You must specify a L4 protocol and not use inversions on it [ 393.369652][ T5932] usb 4-1: device descriptor read/64, error -71 [ 393.489760][ T5932] usb usb4-port1: attempt power cycle [ 393.849803][ T5932] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 393.880213][ T5932] usb 4-1: device descriptor read/8, error -71 [ 393.947060][ T5911] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 394.138638][ T5911] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 394.154395][ T5911] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 394.164243][ T5932] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 394.189265][ T5932] usb 4-1: device descriptor read/8, error -71 [ 394.216085][ T5911] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 394.266275][ T5911] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 394.283673][ T5911] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 394.297951][ T5932] usb usb4-port1: unable to enumerate USB device [ 394.311414][ T5911] usb 2-1: config 0 descriptor?? [ 394.786646][T11012] sch_tbf: burst 22 is lower than device lo mtu (1550) ! [ 395.405816][T11023] xt_CT: No such helper "netbios-ns" [ 395.695703][T11031] loop5: detected capacity change from 0 to 7 [ 395.703619][ T7200] Dev loop5: unable to read RDB block 7 [ 395.709530][ T7200] loop5: unable to read partition table [ 395.716775][ T7200] loop5: partition table beyond EOD, truncated [ 395.759529][T11031] Dev loop5: unable to read RDB block 7 [ 395.774543][T11031] loop5: unable to read partition table [ 395.790230][T11031] loop5: partition table beyond EOD, truncated [ 395.812641][T11031] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 395.888837][T11037] xt_CT: You must specify a L4 protocol and not use inversions on it [ 396.190641][T11040] vlan2: entered promiscuous mode [ 396.707714][T11046] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1401'. [ 396.762632][ T5911] usbhid 2-1:0.0: can't add hid device: -71 [ 396.769865][ T5911] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 396.808907][ T5911] usb 2-1: USB disconnect, device number 46 [ 397.401712][ T5932] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 397.667004][ T5932] usb 2-1: Using ep0 maxpacket: 16 [ 397.776566][ T5932] usb 2-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 397.807804][T11066] xt_CT: No such helper "netbios-ns" [ 397.813536][T11063] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1405'. [ 397.857050][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.865095][ T5932] usb 2-1: Product: syz [ 397.895958][ T5932] usb 2-1: Manufacturer: syz [ 397.900947][ T5932] usb 2-1: SerialNumber: syz [ 398.192328][ T5932] usb 2-1: config 0 descriptor?? [ 398.215947][ T5932] safe_serial 2-1:0.0: safe_serial converter detected [ 398.256705][ T5932] usb 2-1: safe_serial converter now attached to ttyUSB0 [ 398.731738][T11086] xt_CT: You must specify a L4 protocol and not use inversions on it [ 398.815877][T11085] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1412'. [ 398.957198][ T5911] usb 3-1: new full-speed USB device number 48 using dummy_hcd [ 399.120346][ T5911] usb 3-1: not running at top speed; connect to a high speed hub [ 399.134581][ T5911] usb 3-1: config 7 has an invalid interface number: 126 but max is 3 [ 399.155331][ T5911] usb 3-1: config 7 has an invalid interface number: 8 but max is 3 [ 399.178647][ T5911] usb 3-1: config 7 has an invalid interface number: 93 but max is 3 [ 399.193795][ T5911] usb 3-1: config 7 contains an unexpected descriptor of type 0x2, skipping [ 399.273053][ T5911] usb 3-1: config 7 contains an unexpected descriptor of type 0x1, skipping [ 399.289376][ T5911] usb 3-1: config 7 has an invalid interface number: 125 but max is 3 [ 399.300549][ T5911] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 399.315229][ T5911] usb 3-1: config 7 has no interface number 0 [ 399.344753][ T5911] usb 3-1: config 7 has no interface number 1 [ 399.350983][ T5911] usb 3-1: config 7 has no interface number 2 [ 399.360600][ T5911] usb 3-1: config 7 has no interface number 3 [ 399.389417][ T5911] usb 3-1: config 7 interface 8 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 399.416179][ T5911] usb 3-1: config 7 interface 8 altsetting 4 endpoint 0x5 has invalid maxpacket 1023, setting to 64 [ 399.438396][ T5911] usb 3-1: config 7 interface 8 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 399.522340][ T5911] usb 3-1: config 7 interface 93 altsetting 7 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 399.536557][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has a duplicate endpoint with address 0x4, skipping [ 399.585187][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has a duplicate endpoint with address 0x1, skipping [ 399.622502][ T5911] usb 3-1: config 7 interface 93 altsetting 7 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 399.633679][ T797] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 399.657646][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 399.685246][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has a duplicate endpoint with address 0x3, skipping [ 399.750574][T11106] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 399.760575][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has a duplicate endpoint with address 0x4, skipping [ 399.800477][ T5911] usb 3-1: config 7 interface 93 altsetting 7 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 399.827599][ T797] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 399.967018][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has a duplicate endpoint with address 0x4, skipping [ 399.997222][ T797] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 400.007750][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has a duplicate endpoint with address 0x3, skipping [ 400.018710][ T797] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 400.092752][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 400.114751][ T797] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 400.127041][ T5911] usb 3-1: config 7 interface 93 altsetting 7 has an invalid descriptor for endpoint zero, skipping [ 400.141033][ T797] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.155735][ T5911] usb 3-1: config 7 interface 93 altsetting 7 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 400.183442][ T797] usb 4-1: config 0 descriptor?? [ 400.222892][ T5911] usb 3-1: config 7 interface 125 altsetting 147 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 400.340780][ T5911] usb 3-1: config 7 interface 126 has no altsetting 0 [ 400.384661][ T5911] usb 3-1: config 7 interface 8 has no altsetting 0 [ 400.457030][ T5911] usb 3-1: config 7 interface 93 has no altsetting 0 [ 400.517936][ T5911] usb 3-1: config 7 interface 125 has no altsetting 0 [ 400.598668][ T5911] usb 3-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice= 1.1a [ 400.656959][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.724771][ T5911] usb 3-1: Product: Ў [ 400.762120][ T5911] usb 3-1: Manufacturer: з [ 400.779125][ T5911] usb 3-1: SerialNumber: 繆뷉풃ㅉꙺ⿦ལ⠗ꮾ蕗嬚邕댞쯒઒躥䀸鷨굥콩鐆箇ኘ挃ꀽಛ犛굺﹞紏鯅퉁በ㤁扤焧牔⋬㠷エ햴냂삙杞㶢ፗ䮲Э퓫䆩ᴭ虽헙 [ 400.804624][ T5831] usb 2-1: USB disconnect, device number 47 [ 400.862094][ T5831] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 400.940303][ T5831] safe_serial 2-1:0.0: device disconnected [ 401.137977][ T5911] ums-realtek 3-1:7.126: USB Mass Storage device detected [ 401.405432][ T5911] ums-realtek 3-1:7.8: USB Mass Storage device detected [ 401.630819][ T5911] ums-realtek 3-1:7.93: USB Mass Storage device detected [ 401.647128][ T24] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 401.793806][ T5911] ums-realtek 3-1:7.125: USB Mass Storage device detected [ 401.837776][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 401.858222][ T24] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 401.869977][ T24] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 401.890815][ T24] usb 2-1: Product: syz [ 401.901288][ T24] usb 2-1: Manufacturer: syz [ 401.920733][ T24] usb 2-1: SerialNumber: syz [ 401.950714][ T24] usb 2-1: config 0 descriptor?? [ 402.148686][ T5911] usb 3-1: USB disconnect, device number 48 [ 402.795723][ T797] usbhid 4-1:0.0: can't add hid device: -71 [ 402.802209][ T797] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 402.888193][ T797] usb 4-1: USB disconnect, device number 49 [ 403.185327][T11145] xt_CT: You must specify a L4 protocol and not use inversions on it [ 403.357505][ T24] usb 5-1: new full-speed USB device number 44 using dummy_hcd [ 403.458332][T11152] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1427'. [ 403.596090][T11155] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1429'. [ 403.622517][ T24] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 403.622543][ T24] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 403.625203][ T24] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 403.625231][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.625247][ T24] usb 5-1: Product: syz [ 403.625259][ T24] usb 5-1: Manufacturer: syz [ 403.625270][ T24] usb 5-1: SerialNumber: syz [ 403.745854][T11155] ip6tnl10: entered promiscuous mode [ 403.833875][ T24] usb 5-1: 0:2 : does not exist [ 403.845107][ T24] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 403.933962][ T24] usb 5-1: USB disconnect, device number 44 [ 403.989662][T10147] udevd[10147]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 404.630186][T11165] Set syz1 is full, maxelem 65536 reached [ 404.731372][T11172] loop5: detected capacity change from 0 to 7 [ 404.793575][T11172] Dev loop5: unable to read RDB block 7 [ 404.819241][T11172] loop5: unable to read partition table [ 404.844424][T11172] loop5: partition table beyond EOD, truncated [ 404.977289][T11172] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 405.270578][ T24] usb 2-1: USB disconnect, device number 48 [ 405.646569][T11179] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1435'. [ 405.683113][T11180] IPVS: set_ctl: invalid protocol: 98 224.0.0.2:21 [ 405.946985][ T24] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 406.449533][T11194] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 406.507795][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 406.809629][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 406.841018][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 406.864664][ T24] usb 2-1: New USB device found, idVendor=258a, idProduct=0033, bcdDevice= 0.00 [ 406.884251][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.924365][ T24] usb 2-1: config 0 descriptor?? [ 406.967346][T11199] xt_CT: You must specify a L4 protocol and not use inversions on it [ 407.335594][ T5932] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 407.362385][ T5932] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 407.612380][ T24] glorious 0003:258A:0033.000B: item fetching failed at offset 0/3 [ 407.640701][ T24] glorious 0003:258A:0033.000B: probe with driver glorious failed with error -22 [ 407.937891][T11209] Set syz1 is full, maxelem 65536 reached [ 408.066976][ T797] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 408.204037][T11180] bond0: Removing last ns target with arp_interval on [ 408.230294][T11218] loop5: detected capacity change from 0 to 7 [ 408.243863][T11218] Dev loop5: unable to read RDB block 7 [ 408.256617][T11218] loop5: unable to read partition table [ 408.266840][T11218] loop5: partition table beyond EOD, truncated [ 408.279237][ T797] usb 5-1: Using ep0 maxpacket: 8 [ 408.280088][T11218] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 408.296270][ T797] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 408.359694][ T797] usb 5-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice=d9.40 [ 408.388357][ T797] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.396716][ T797] usb 5-1: Product: syz [ 408.401278][ T797] usb 5-1: Manufacturer: syz [ 408.405881][ T797] usb 5-1: SerialNumber: syz [ 408.411709][ T5911] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 408.486957][T11177] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1434'. [ 408.517461][ T797] usb 5-1: config 0 descriptor?? [ 408.627103][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 408.705941][ T5911] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 408.715462][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 408.723928][ T5911] usb 3-1: Product: syz [ 408.732239][ T5911] usb 3-1: Manufacturer: syz [ 408.746415][ T5911] usb 3-1: SerialNumber: syz [ 408.764245][ T5911] usb 3-1: config 0 descriptor?? [ 409.057468][ T797] usb 5-1: USB disconnect, device number 45 [ 409.477303][T11234] tipc: Enabled bearer , priority 0 [ 409.488936][T11234] syzkaller0: entered promiscuous mode [ 409.494733][T11234] syzkaller0: entered allmulticast mode [ 409.528937][T11234] tipc: Resetting bearer [ 409.552735][T11233] tipc: Resetting bearer [ 409.573831][T11233] tipc: Disabling bearer [ 409.685148][ T797] usb 2-1: USB disconnect, device number 49 [ 409.804592][T11239] xt_CT: You must specify a L4 protocol and not use inversions on it [ 410.083042][T11241] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 411.252981][ T797] usb 3-1: USB disconnect, device number 49 [ 411.436603][T11261] xt_hashlimit: size too large, truncated to 1048576 [ 411.711740][T11261] xt_CT: No such helper "netbios-ns" [ 411.725369][T11268] loop5: detected capacity change from 0 to 7 [ 411.757259][T11268] Dev loop5: unable to read RDB block 7 [ 411.762911][T11268] loop5: unable to read partition table [ 411.803565][T11268] loop5: partition table beyond EOD, truncated [ 411.823769][T11268] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 412.146328][T11278] xt_CT: You must specify a L4 protocol and not use inversions on it [ 412.159058][T11277] tipc: Started in network mode [ 412.164046][T11277] tipc: Node identity c6f6cd031d8a, cluster identity 4711 [ 412.190115][T11277] tipc: Enabled bearer , priority 0 [ 412.223007][T11280] syzkaller0: entered promiscuous mode [ 412.248370][T11280] syzkaller0: entered allmulticast mode [ 412.298267][T11282] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1463'. [ 412.349333][T11277] tipc: Resetting bearer [ 412.351659][T11282] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1463'. [ 412.370321][T11279] FAULT_INJECTION: forcing a failure. [ 412.370321][T11279] name failslab, interval 1, probability 0, space 0, times 0 [ 412.383290][T11279] CPU: 0 UID: 0 PID: 11279 Comm: syz.1.1456 Tainted: G L syzkaller #0 PREEMPT(full) [ 412.383312][T11279] Tainted: [L]=SOFTLOCKUP [ 412.383316][T11279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 412.383325][T11279] Call Trace: [ 412.383332][T11279] [ 412.383337][T11279] dump_stack_lvl+0xe8/0x150 [ 412.383358][T11279] should_fail_ex+0x412/0x560 [ 412.383374][T11279] should_failslab+0xa8/0x100 [ 412.383386][T11279] __kmalloc_noprof+0xde/0x7e0 [ 412.383396][T11279] ? kfree+0x4d/0x650 [ 412.383407][T11279] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 412.383424][T11279] tomoyo_realpath_from_path+0xe3/0x5d0 [ 412.383436][T11279] ? tomoyo_domain+0xd7/0x130 [ 412.383451][T11279] ? tomoyo_path_number_perm+0x219/0x630 [ 412.383460][T11279] tomoyo_path_number_perm+0x246/0x630 [ 412.383472][T11279] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 412.383481][T11279] ? __lock_acquire+0x6b5/0x2cf0 [ 412.383512][T11279] ? __fget_files+0x2a/0x420 [ 412.383524][T11279] ? __fget_files+0x3a0/0x420 [ 412.383533][T11279] ? __fget_files+0x2a/0x420 [ 412.383545][T11279] security_file_ioctl_compat+0xc3/0x2a0 [ 412.383556][T11279] __ia32_compat_sys_ioctl+0x139/0x950 [ 412.383572][T11279] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 412.383586][T11279] ? __fget_files+0x3a0/0x420 [ 412.383599][T11279] ? fput+0xa0/0xd0 [ 412.383609][T11279] ? ksys_write+0x242/0x270 [ 412.383624][T11279] ? __pfx_ksys_write+0x10/0x10 [ 412.383640][T11279] __do_fast_syscall_32+0x1d2/0x540 [ 412.383653][T11279] ? lockdep_hardirqs_on+0x7a/0x110 [ 412.383662][T11279] ? do_fast_syscall_32+0x33/0x70 [ 412.383671][T11279] ? asm_int80_emulation+0x1a/0x20 [ 412.383679][T11279] ? do_int80_emulation+0x20e/0x400 [ 412.383691][T11279] do_fast_syscall_32+0x33/0x70 [ 412.383701][T11279] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 412.383715][T11279] RIP: 0023:0xf742d539 [ 412.383725][T11279] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 412.383733][T11279] RSP: 002b:00000000f543550c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 412.383744][T11279] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000004161 [ 412.383751][T11279] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 412.383756][T11279] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 412.383761][T11279] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 412.383766][T11279] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 412.383780][T11279] [ 412.383785][T11279] ERROR: Out of memory at tomoyo_realpath_from_path. [ 412.672399][T11291] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1463'. [ 412.702879][T11276] tipc: Resetting bearer [ 412.764080][T11276] tipc: Disabling bearer [ 413.037074][ T797] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 413.228192][ T797] usb 4-1: Using ep0 maxpacket: 8 [ 413.257554][ T797] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 413.274007][ T797] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 413.286574][ T797] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 413.432610][ T797] usb 4-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 413.441905][ T797] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.467160][ T797] usb 4-1: Product: syz [ 413.483985][ T797] usb 4-1: Manufacturer: syz [ 413.494137][ T797] usb 4-1: SerialNumber: syz [ 413.596916][ T797] usb 4-1: config 0 descriptor?? [ 413.639874][ T797] streamzap 4-1:0.0: streamzap_probe: endpoint Max Packet Size is 0!?! [ 413.922134][T11295] syz_tun: entered allmulticast mode [ 413.939598][T11294] syz_tun: left allmulticast mode [ 413.947881][ T24] usb 4-1: USB disconnect, device number 50 [ 414.247114][ T797] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 414.427323][ T797] usb 5-1: Using ep0 maxpacket: 32 [ 414.447805][ T797] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 414.458154][ T797] usb 5-1: config 0 has no interface number 0 [ 414.472993][ T797] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 414.484470][ T797] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.497042][ T797] usb 5-1: Product: syz [ 414.501422][ T797] usb 5-1: Manufacturer: syz [ 414.538299][ T797] usb 5-1: SerialNumber: syz [ 414.619671][ T797] usb 5-1: config 0 descriptor?? [ 414.711526][T11321] loop5: detected capacity change from 0 to 7 [ 414.718581][T11321] Dev loop5: unable to read RDB block 7 [ 414.724481][T11321] loop5: unable to read partition table [ 414.749344][ T797] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 414.761675][ T797] usb 5-1: selecting invalid altsetting 1 [ 414.771138][T11321] loop5: partition table beyond EOD, truncated [ 414.780660][ T797] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 414.800256][T11321] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 414.818087][ T797] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 414.860854][ T797] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 414.890429][ T797] usb 5-1: media controller created [ 414.911929][T11330] xt_CT: You must specify a L4 protocol and not use inversions on it [ 414.954916][ T797] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 414.965524][T11312] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 415.062396][ T797] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 415.070948][ T797] zl10353_read_register: readreg error (reg=127, ret==-71) [ 415.087714][ T797] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 415.106999][T11335] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1477'. [ 415.136298][T11335] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1477'. [ 415.167666][ T797] usb 5-1: USB disconnect, device number 46 [ 415.192342][T11337] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1477'. [ 415.287647][ T5911] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 415.304197][T11342] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1479'. [ 415.457024][ T5911] usb 2-1: Using ep0 maxpacket: 32 [ 415.488617][ T5911] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 415.496747][ T5911] usb 2-1: config 0 has no interface number 0 [ 415.516062][ T5911] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 415.527792][ T5911] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.535997][ T5911] usb 2-1: Product: syz [ 415.553052][ T5911] usb 2-1: Manufacturer: syz [ 415.562345][ T5911] usb 2-1: SerialNumber: syz [ 415.577581][ T5911] usb 2-1: config 0 descriptor?? [ 415.600004][ T5911] smsc95xx v2.0.0 [ 416.079977][ T5911] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 416.137108][ T5911] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 416.763708][T11366] xt_bpf: check failed: parse error [ 416.952156][T11370] xt_CT: You must specify a L4 protocol and not use inversions on it [ 417.042365][T11369] FAULT_INJECTION: forcing a failure. [ 417.042365][T11369] name failslab, interval 1, probability 0, space 0, times 0 [ 417.135414][T11369] CPU: 1 UID: 0 PID: 11369 Comm: syz.4.1485 Tainted: G L syzkaller #0 PREEMPT(full) [ 417.135440][T11369] Tainted: [L]=SOFTLOCKUP [ 417.135445][T11369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 417.135453][T11369] Call Trace: [ 417.135461][T11369] [ 417.135469][T11369] dump_stack_lvl+0xe8/0x150 [ 417.135492][T11369] should_fail_ex+0x412/0x560 [ 417.135525][T11369] should_failslab+0xa8/0x100 [ 417.135544][T11369] __kmalloc_noprof+0xde/0x7e0 [ 417.135559][T11369] ? tomoyo_encode+0x28b/0x550 [ 417.135582][T11369] tomoyo_encode+0x28b/0x550 [ 417.135606][T11369] tomoyo_realpath_from_path+0x58d/0x5d0 [ 417.135633][T11369] ? tomoyo_path_number_perm+0x219/0x630 [ 417.135650][T11369] tomoyo_path_number_perm+0x246/0x630 [ 417.135670][T11369] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 417.135687][T11369] ? __lock_acquire+0x6b5/0x2cf0 [ 417.135742][T11369] ? __fget_files+0x2a/0x420 [ 417.135762][T11369] ? __fget_files+0x3a0/0x420 [ 417.135778][T11369] ? __fget_files+0x2a/0x420 [ 417.135798][T11369] security_file_ioctl_compat+0xc3/0x2a0 [ 417.135818][T11369] __ia32_compat_sys_ioctl+0x139/0x950 [ 417.135841][T11369] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 417.135864][T11369] ? __fget_files+0x3a0/0x420 [ 417.135885][T11369] ? fput+0xa0/0xd0 [ 417.135903][T11369] ? ksys_write+0x242/0x270 [ 417.135925][T11369] ? __pfx_ksys_write+0x10/0x10 [ 417.135949][T11369] __do_fast_syscall_32+0x1d2/0x540 [ 417.135965][T11369] ? lockdep_hardirqs_on+0x7a/0x110 [ 417.135978][T11369] ? do_fast_syscall_32+0x33/0x70 [ 417.135993][T11369] ? asm_int80_emulation+0x1a/0x20 [ 417.136006][T11369] ? do_int80_emulation+0x20e/0x400 [ 417.136026][T11369] do_fast_syscall_32+0x33/0x70 [ 417.136042][T11369] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 417.136060][T11369] RIP: 0023:0xf7f97539 [ 417.136074][T11369] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 417.136087][T11369] RSP: 002b:00000000f543550c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 417.136104][T11369] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000004161 [ 417.136114][T11369] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 417.136123][T11369] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 417.136132][T11369] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 417.136140][T11369] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 417.136163][T11369] [ 417.136184][T11369] ERROR: Out of memory at tomoyo_realpath_from_path. [ 417.711648][T11387] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1490'. [ 417.723315][T11387] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1490'. [ 417.733943][T11387] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1490'. [ 418.392531][T11400] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1494'. [ 418.423109][T11400] ip6tnl13: entered promiscuous mode [ 419.725523][T11416] xt_CT: You must specify a L4 protocol and not use inversions on it [ 419.862243][T11418] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1501'. [ 419.903541][T11418] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1501'. [ 420.977144][ T797] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 421.147047][ T797] usb 5-1: Using ep0 maxpacket: 16 [ 421.156649][ T797] usb 5-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 421.166294][ T797] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.244925][ T797] usb 5-1: Product: syz [ 421.249903][ T797] usb 5-1: Manufacturer: syz [ 421.254602][ T797] usb 5-1: SerialNumber: syz [ 421.263664][ T797] usb 5-1: config 0 descriptor?? [ 421.277588][ T797] safe_serial 5-1:0.0: safe_serial converter detected [ 421.316174][ T797] usb 5-1: safe_serial converter now attached to ttyUSB0 [ 423.130376][ T5911] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000006c: -110 [ 423.182889][ T5911] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -110 [ 423.318194][ T5911] usb 2-1: USB disconnect, device number 50 [ 423.356699][T11471] __nla_validate_parse: 1 callbacks suppressed [ 423.356713][T11471] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1513'. [ 423.448600][T11473] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1514'. [ 423.585697][T11473] ip6tnl7: entered promiscuous mode [ 423.614459][T11471] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1513'. [ 423.630210][T11471] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1513'. [ 424.528999][ T24] usb 5-1: USB disconnect, device number 47 [ 424.563063][ T24] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 424.575018][ T24] safe_serial 5-1:0.0: device disconnected [ 424.722762][T11488] xt_hashlimit: size too large, truncated to 1048576 [ 424.836524][T11488] xt_CT: No such helper "netbios-ns" [ 425.062784][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 425.062804][ T30] audit: type=1326 audit(1770556331.728:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11490 comm="syz.1.1519" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf742d539 code=0x0 [ 426.013392][T11513] xt_CT: You must specify a L4 protocol and not use inversions on it [ 426.659853][T11518] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1526'. [ 426.705550][T11522] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1526'. [ 426.806659][T11520] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1527'. [ 426.921863][T11526] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1527'. [ 427.013823][T11520] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1527'. [ 427.299465][T11532] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1529'. [ 427.314243][T11532] : entered promiscuous mode [ 427.459928][T11535] netlink: 'syz.3.1530': attribute type 3 has an invalid length. [ 427.557407][ T30] audit: type=1326 audit(1770556334.218:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 427.586143][T11541] xt_hashlimit: size too large, truncated to 1048576 [ 427.600711][T11545] netlink: 'syz.4.1533': attribute type 1 has an invalid length. [ 427.637040][ T30] audit: type=1326 audit(1770556334.218:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 427.660687][ T30] audit: type=1326 audit(1770556334.218:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 427.717127][ T30] audit: type=1326 audit(1770556334.218:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 427.755463][T11545] 8021q: adding VLAN 0 to HW filter on device bond8 [ 427.778186][ T30] audit: type=1326 audit(1770556334.218:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 427.852426][ T30] audit: type=1326 audit(1770556334.218:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 427.954909][T11541] xt_CT: No such helper "netbios-ns" [ 428.006603][ T30] audit: type=1326 audit(1770556334.218:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 428.150523][ T30] audit: type=1326 audit(1770556334.218:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 428.189608][ T30] audit: type=1326 audit(1770556334.218:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11534 comm="syz.3.1530" exe="/root/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 428.366641][T11563] __nla_validate_parse: 2 callbacks suppressed [ 428.366654][T11563] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1539'. [ 428.421708][T11563] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1539'. [ 428.721789][T11570] openvswitch: netlink: Key 6 has unexpected len 39 expected 2 [ 428.997259][T11577] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1542'. [ 429.012495][T11577] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1542'. [ 429.105343][ T24] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 429.126471][T11584] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1544'. [ 429.140104][T11584] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1544'. [ 429.456975][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 429.494541][ T24] usb 2-1: too many configurations: 21, using maximum allowed: 8 [ 429.522746][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 429.562465][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 429.585550][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 429.597665][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 429.617965][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 429.635966][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 429.729947][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 429.755449][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 429.793376][ T24] usb 2-1: New USB device found, idVendor=0421, idProduct=0223, bcdDevice=b1.bd [ 429.803080][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.816126][ T24] usb 2-1: Product: syz [ 429.840188][T11596] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1548'. [ 429.867039][ T24] usb 2-1: Manufacturer: syz [ 429.881873][ T24] usb 2-1: SerialNumber: syz [ 429.903448][ T24] usb 2-1: config 0 descriptor?? [ 429.937398][ T5932] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 430.140587][T11601] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1550'. [ 430.165993][T11604] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1551'. [ 430.175423][ T5932] usb 3-1: Using ep0 maxpacket: 16 [ 430.200047][T11601] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1550'. [ 430.217810][ T5932] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 430.237847][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 430.260778][ T5932] usb 3-1: Product: syz [ 430.268377][ T5932] usb 3-1: Manufacturer: syz [ 430.299509][ T24] usb 2-1: bad CDC descriptors [ 430.305021][ T24] cdc_acm 2-1:0.0: Zero length descriptor references [ 430.313481][ T5932] usb 3-1: SerialNumber: syz [ 430.343223][ T5932] usb 3-1: config 0 descriptor?? [ 430.356961][ T24] cdc_acm 2-1:0.0: probe with driver cdc_acm failed with error -22 [ 430.402032][ T24] usb 2-1: USB disconnect, device number 51 [ 430.447019][ T5912] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 430.544705][T11610] loop5: detected capacity change from 0 to 7 [ 430.553192][T11610] Dev loop5: unable to read RDB block 7 [ 430.559856][T11610] loop5: unable to read partition table [ 430.565902][T11610] loop5: partition table beyond EOD, truncated [ 430.576118][T11610] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 430.621409][ T5912] usb 4-1: device descriptor read/64, error -71 [ 430.908013][ T5912] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 431.057111][ T5912] usb 4-1: device descriptor read/64, error -71 [ 431.177348][ T5912] usb usb4-port1: attempt power cycle [ 431.567039][ T5912] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 431.587921][ T5912] usb 4-1: device descriptor read/8, error -71 [ 431.847061][ T5912] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 431.867870][ T5912] usb 4-1: device descriptor read/8, error -71 [ 431.977335][ T5912] usb usb4-port1: unable to enumerate USB device [ 432.576092][ T5911] usb 3-1: USB disconnect, device number 50 [ 432.967060][ T5911] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 433.134870][T11638] vlan5: entered promiscuous mode [ 433.153391][ T5911] usb 3-1: unable to get BOS descriptor or descriptor too short [ 433.180021][ T5911] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 433.199734][ T5911] usb 3-1: can't read configurations, error -71 [ 433.298458][T11647] loop5: detected capacity change from 0 to 7 [ 433.306444][T10147] Dev loop5: unable to read RDB block 7 [ 433.312234][T10147] loop5: unable to read partition table [ 433.318699][T10147] loop5: partition table beyond EOD, truncated [ 433.328026][T11647] Dev loop5: unable to read RDB block 7 [ 433.392364][T11647] loop5: unable to read partition table [ 433.412628][T11647] loop5: partition table beyond EOD, truncated [ 433.438593][T11647] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 433.853965][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 433.853983][ T30] audit: type=1326 audit(1770556340.518:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11664 comm="syz.2.1568" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf73dd539 code=0x0 [ 434.757167][ T5911] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 434.851636][T11688] xt_CT: No such helper "netbios-ns" [ 434.917403][ T5911] usb 4-1: Using ep0 maxpacket: 16 [ 434.944964][ T5911] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 434.978169][ T5911] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 434.987163][ T5911] usb 4-1: Product: syz [ 434.991519][ T5911] usb 4-1: Manufacturer: syz [ 434.999966][ T5911] usb 4-1: SerialNumber: syz [ 435.094402][ T5911] usb 4-1: config 0 descriptor?? [ 435.372621][ T30] audit: type=1326 audit(1770556341.968:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11694 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf740d539 code=0x7ffc0000 [ 435.431108][ T30] audit: type=1326 audit(1770556341.968:550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11694 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=138 compat=1 ip=0xf740d539 code=0x7ffc0000 [ 435.557190][ T30] audit: type=1326 audit(1770556341.968:551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11694 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf740d539 code=0x7ffc0000 [ 435.660531][ T30] audit: type=1326 audit(1770556341.968:552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11694 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=120 compat=1 ip=0xf740d539 code=0x7ffc0000 [ 435.802465][ T30] audit: type=1326 audit(1770556342.038:553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11694 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf740d539 code=0x7ffc0000 [ 435.918249][ T30] audit: type=1326 audit(1770556342.038:554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11694 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf740d539 code=0x7ffc0000 [ 436.272901][ T30] audit: type=1326 audit(1770556342.068:555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11698 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf717572b code=0x7ffc0000 [ 436.304386][ T30] audit: type=1326 audit(1770556342.298:556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11698 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=1 compat=1 ip=0xf740d539 code=0x7ffc0000 [ 436.512564][ T30] audit: type=1326 audit(1770556342.378:557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11694 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf740d539 code=0x7ffc0000 [ 437.617464][ T5911] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 437.812053][ T5912] usb 4-1: USB disconnect, device number 55 [ 437.829216][T11715] __nla_validate_parse: 3 callbacks suppressed [ 437.829230][T11715] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1578'. [ 437.980756][T11715] vlan5: entered promiscuous mode [ 438.029195][T11719] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1581'. [ 438.040513][T11719] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1581'. [ 438.053143][ T5911] usb 2-1: unable to get BOS descriptor or descriptor too short [ 438.063671][ T5911] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 438.092222][ T5911] usb 2-1: can't read configurations, error -71 [ 438.528681][T11735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1583'. [ 438.919172][T11738] xt_CT: No such helper "netbios-ns" [ 439.972175][T11759] loop5: detected capacity change from 0 to 7 [ 439.980008][T11759] Dev loop5: unable to read RDB block 7 [ 439.985622][T11759] loop5: unable to read partition table [ 439.991424][ T5912] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 440.019699][T11759] loop5: partition table beyond EOD, truncated [ 440.036834][T11759] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 440.227519][ T5912] usb 2-1: Using ep0 maxpacket: 16 [ 440.308119][ T5912] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 440.320305][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 440.337356][T11764] vlan2: entered promiscuous mode [ 440.360442][ T5912] usb 2-1: Product: syz [ 440.381146][ T5912] usb 2-1: Manufacturer: syz [ 440.400395][ T5912] usb 2-1: SerialNumber: syz [ 440.427302][ T5912] usb 2-1: config 0 descriptor?? [ 440.625926][T11761] Set syz1 is full, maxelem 65536 reached [ 441.430877][T11771] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1594'. [ 441.442590][T11771] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1594'. [ 441.733895][T11782] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1597'. [ 441.986981][ T5911] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 442.147380][ T5911] usb 5-1: Using ep0 maxpacket: 8 [ 442.168755][ T5911] usb 5-1: unable to get BOS descriptor or descriptor too short [ 442.190468][ T5911] usb 5-1: config 6 has an invalid interface number: 70 but max is 0 [ 442.212851][ T5911] usb 5-1: config 6 has an invalid descriptor of length 71, skipping remainder of the config [ 442.231315][ T5911] usb 5-1: config 6 has no interface number 0 [ 442.244005][ T5911] usb 5-1: config 6 interface 70 altsetting 118 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 442.267678][ T5911] usb 5-1: config 6 interface 70 has no altsetting 0 [ 442.321404][ T5911] usb 5-1: New USB device found, idVendor=1ae7, idProduct=0525, bcdDevice=63.7b [ 442.331743][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.340947][ T5911] usb 5-1: Product: syz [ 442.346306][ T5911] usb 5-1: Manufacturer: syz [ 442.390838][ T5911] usb 5-1: SerialNumber: syz [ 442.654121][T11784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 442.663315][T11784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 442.697736][ T5911] HFC-S_USB 5-1:6.70: probe with driver HFC-S_USB failed with error -5 [ 442.714753][ T5911] usb 5-1: USB disconnect, device number 48 [ 442.897075][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 442.903477][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 443.145257][ T5912] usb 2-1: USB disconnect, device number 54 [ 443.637825][T11817] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1603'. [ 443.653235][T11817] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1603'. [ 444.535646][T11809] Set syz1 is full, maxelem 65536 reached [ 444.788490][T11827] xt_bpf: check failed: parse error [ 444.861308][T11830] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1609'. [ 444.862472][T11831] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1610'. [ 444.870690][T11830] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1609'. [ 444.899372][T11831] ip6tnl14: entered promiscuous mode [ 445.000196][T11833] xt_CT: No such helper "netbios-ns" [ 445.053839][T11836] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1612'. [ 445.419506][ T5911] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 445.697012][ T5911] usb 3-1: Using ep0 maxpacket: 16 [ 445.723974][ T5911] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 445.735323][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 445.749586][ T5911] usb 3-1: Product: syz [ 445.759535][ T5911] usb 3-1: Manufacturer: syz [ 445.769550][ T5911] usb 3-1: SerialNumber: syz [ 445.785276][ T5911] usb 3-1: config 0 descriptor?? [ 446.098240][T11854] xt_hashlimit: max too large, truncated to 1048576 [ 446.196749][T11854] xt_CT: No such helper "netbios-ns" [ 446.691291][T11871] xt_bpf: check failed: parse error [ 447.605177][T11873] Set syz1 is full, maxelem 65536 reached [ 447.626754][T11875] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1621'. [ 448.171311][ T5911] usb 3-1: USB disconnect, device number 53 [ 448.353682][T11893] xt_bpf: check failed: parse error [ 448.753002][T11908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1630'. [ 448.781436][T11908] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1630'. [ 449.121147][T11911] loop5: detected capacity change from 0 to 7 [ 449.144074][T10147] Dev loop5: unable to read RDB block 7 [ 449.157361][T10147] loop5: unable to read partition table [ 449.167253][T10147] loop5: partition table beyond EOD, truncated [ 449.178637][T11911] Dev loop5: unable to read RDB block 7 [ 449.186832][T11911] loop5: unable to read partition table [ 449.195983][T11911] loop5: partition table beyond EOD, truncated [ 449.209465][T11911] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 449.308488][T11916] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1634'. [ 449.351985][T11913] Set syz1 is full, maxelem 65536 reached [ 449.717090][ T24] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 449.876961][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 449.888468][ T24] usb 3-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 449.899545][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.924319][ T24] usb 3-1: Product: syz [ 449.933999][ T24] usb 3-1: Manufacturer: syz [ 449.943443][ T24] usb 3-1: SerialNumber: syz [ 449.957764][ T24] usb 3-1: config 0 descriptor?? [ 449.979375][ T24] safe_serial 3-1:0.0: safe_serial converter detected [ 450.002639][ T24] usb 3-1: safe_serial converter now attached to ttyUSB0 [ 451.026981][ T24] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 451.147054][ T5911] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 451.196985][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 451.217404][ T24] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 451.227264][ T24] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 451.236330][ T24] usb 5-1: Product: syz [ 451.240903][ T24] usb 5-1: Manufacturer: syz [ 451.246411][ T24] usb 5-1: SerialNumber: syz [ 451.268733][ T24] usb 5-1: config 0 descriptor?? [ 451.306971][ T5911] usb 4-1: Using ep0 maxpacket: 32 [ 451.324001][ T5911] usb 4-1: config 0 interface 0 has no altsetting 0 [ 451.361650][ T5911] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 451.394740][ T5911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.413742][ T5911] usb 4-1: Product: syz [ 451.423993][ T5911] usb 4-1: Manufacturer: syz [ 451.436963][ T5911] usb 4-1: SerialNumber: syz [ 451.455181][ T5911] usb 4-1: config 0 descriptor?? [ 451.735093][T11938] sg_write: data in/out 41084/1 bytes for SCSI command 0x1c-- guessing data in; [ 451.735093][T11938] program syz.3.1639 not setting count and/or reply_len properly [ 451.882237][T11940] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1640'. [ 451.892586][T11940] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1640'. [ 452.059834][ T5911] gs_usb 4-1:0.0: Couldn't get device config: (err=-71) [ 452.067102][ T5911] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -71 [ 452.135760][ T5911] usb 4-1: USB disconnect, device number 56 [ 452.792975][T11951] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1642'. [ 452.824362][T11951] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1642'. [ 453.160037][ T5911] usb 3-1: USB disconnect, device number 54 [ 453.189185][ T5911] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 453.289960][ T5911] safe_serial 3-1:0.0: device disconnected [ 453.687105][ T5911] usb 5-1: USB disconnect, device number 49 [ 453.821371][T11963] Set syz1 is full, maxelem 65536 reached [ 454.026320][T11971] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1648'. [ 454.057872][T11971] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1648'. [ 454.197009][ T5911] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 454.239310][T11975] xt_bpf: check failed: parse error [ 454.258695][T11977] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1651'. [ 454.269433][T11977] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1651'. [ 454.305583][T11979] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1650'. [ 454.342582][T11979] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1650'. [ 454.364546][ T5911] usb 5-1: too many configurations: 110, using maximum allowed: 8 [ 454.425227][ T5911] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 454.435628][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.488269][ T5911] usb 5-1: Product: syz [ 454.506128][T11982] xt_hashlimit: max too large, truncated to 1048576 [ 454.513033][ T5911] usb 5-1: Manufacturer: syz [ 454.513055][ T5911] usb 5-1: SerialNumber: syz [ 454.528751][ T5911] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 454.672022][ T797] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 454.779535][T11982] xt_CT: No such helper "netbios-ns" [ 454.898485][ C0] usb 5-1: ath: unknown panic pattern! [ 454.947031][ T5911] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 455.109511][ T5831] usb 5-1: USB disconnect, device number 50 [ 455.136152][T11984] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1654'. [ 455.151952][ T5911] usb 3-1: unable to get BOS descriptor or descriptor too short [ 455.160473][ T5911] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 455.325028][ T5911] usb 3-1: can't read configurations, error -71 [ 455.687056][ T797] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 455.696166][ T797] ath9k_htc: Failed to initialize the device [ 455.702443][ T9] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 455.738295][ T5831] usb 5-1: ath9k_htc: USB layer deinitialized [ 455.871125][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 455.887751][ T9] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 455.896141][ T9] usb 2-1: config 0 has no interface number 0 [ 455.917491][ T9] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 455.929915][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.938714][ T9] usb 2-1: Product: syz [ 455.942902][ T9] usb 2-1: Manufacturer: syz [ 455.948179][ T9] usb 2-1: SerialNumber: syz [ 455.956686][ T9] usb 2-1: config 0 descriptor?? [ 455.994206][ T9] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 456.005129][ T9] usb 2-1: selecting invalid altsetting 1 [ 456.011707][ T9] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 456.039880][ T9] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 456.055306][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 456.085664][ T9] usb 2-1: media controller created [ 456.125650][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 456.257322][T12008] xt_bpf: check failed: parse error [ 456.377026][ T5911] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 456.543195][T11995] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1657'. [ 456.560407][ T5911] usb 3-1: unable to get BOS descriptor or descriptor too short [ 456.569598][ T5911] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 456.578190][ T5911] usb 3-1: can't read configurations, error -71 [ 456.676504][ T5911] usb usb3-port1: attempt power cycle [ 457.207254][ T9] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 457.217763][ T9] zl10353_read_register: readreg error (reg=127, ret==-110) [ 457.238974][T11993] ------------[ cut here ]------------ [ 457.244672][T11993] usb 2-1: BOGUS control dir, pipe 80003780 doesn't match bRequestType c0 [ 457.253369][T11993] WARNING: drivers/usb/core/urb.c:414 at usb_submit_urb+0x1052/0x18b0, CPU#0: syz.1.1656/11993 [ 457.264018][T11993] Modules linked in: [ 457.268265][T11993] CPU: 0 UID: 0 PID: 11993 Comm: syz.1.1656 Tainted: G L syzkaller #0 PREEMPT(full) [ 457.279381][T11993] Tainted: [L]=SOFTLOCKUP [ 457.283686][T11993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 457.293790][T11993] RIP: 0010:usb_submit_urb+0x1114/0x18b0 [ 457.299459][T11993] Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c2 f2 ff ff 89 e9 [ 457.319868][T11993] RSP: 0000:ffffc90003ce76a8 EFLAGS: 00010246 [ 457.326027][T11993] RAX: 0000000000000000 RBX: ffff88814cfe0200 RCX: 0000000080003780 [ 457.334273][T11993] RDX: ffff88805659e2c0 RSI: ffffffff8c5dd300 RDI: ffffffff8ffc34a0 [ 457.342326][T11993] RBP: 1ffff1100aa0e184 R08: 00000000000000c0 R09: 0000000000000000 [ 457.350346][T11993] R10: ffffc90003ce77a0 R11: fffff5200079cf00 R12: ffff888022712100 [ 457.358721][T11993] R13: ffff888055070c20 R14: 0000000080003780 R15: ffff88805659e2c0 [ 457.366731][T11993] FS: 0000000000000000(0000) GS:ffff8881256f3000(0063) knlGS:00000000f5456b40 [ 457.375833][T11993] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 457.382486][T11993] CR2: 0000000080101018 CR3: 000000002728c000 CR4: 00000000003526f0 [ 457.390628][T11993] Call Trace: [ 457.393971][T11993] [ 457.397017][T11993] ? __init_swait_queue_head+0xa9/0x150 [ 457.402676][T11993] usb_start_wait_urb+0x12b/0x510 [ 457.407821][T11993] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 457.413396][T11993] usb_control_msg+0x232/0x3e0 [ 457.418354][T11993] ce6230_ctrl_msg+0x2b1/0x660 [ 457.423156][T11993] ce6230_i2c_master_xfer+0x4d9/0x6e0 [ 457.428638][T11993] ? __pfx_ce6230_i2c_master_xfer+0x10/0x10 [ 457.434652][T11993] __i2c_transfer+0x79a/0x1ee0 [ 457.439487][T11993] ? i2c_transfer+0xc8/0x2d0 [ 457.444075][T11993] i2c_transfer+0x1cc/0x2d0 [ 457.448734][T11993] i2cdev_ioctl_rdwr+0x460/0x740 [ 457.453687][T11993] compat_i2cdev_ioctl+0x59f/0x5c0 [ 457.458857][T11993] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 457.464487][T11993] ? __fget_files+0x3a0/0x420 [ 457.469192][T11993] ? __fget_files+0x2a/0x420 [ 457.473774][T11993] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 457.479401][T11993] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 457.484946][T11993] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 457.490971][T11993] ? kmem_cache_free+0x195/0x610 [ 457.495907][T11993] ? __se_sys_futex_time32+0x3ab/0x440 [ 457.501500][T11993] ? rcu_is_watching+0x15/0xb0 [ 457.506274][T11993] __do_fast_syscall_32+0x1d2/0x540 [ 457.511533][T11993] ? lockdep_hardirqs_on+0x7a/0x110 [ 457.516821][T11993] ? do_fast_syscall_32+0x33/0x70 [ 457.521951][T11993] ? asm_int80_emulation+0x1a/0x20 [ 457.527128][T11993] ? do_int80_emulation+0x20e/0x400 [ 457.532323][T11993] do_fast_syscall_32+0x33/0x70 [ 457.537333][T11993] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 457.543658][T11993] RIP: 0023:0xf742d539 [ 457.547771][T11993] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 457.567482][T11993] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 457.575902][T11993] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000707 [ 457.583914][T11993] RDX: 0000000080000a40 RSI: 0000000000000000 RDI: 0000000000000000 [ 457.591941][T11993] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 457.600040][T11993] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 457.608074][T11993] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 457.616046][T11993] [ 457.619105][T11993] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 457.626379][T11993] CPU: 0 UID: 0 PID: 11993 Comm: syz.1.1656 Tainted: G L syzkaller #0 PREEMPT(full) [ 457.637299][T11993] Tainted: [L]=SOFTLOCKUP [ 457.641620][T11993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 457.651677][T11993] Call Trace: [ 457.654950][T11993] [ 457.657876][T11993] vpanic+0x1e0/0x670 [ 457.661848][T11993] panic+0xc5/0xd0 [ 457.665557][T11993] ? __pfx_panic+0x10/0x10 [ 457.669966][T11993] __warn+0x315/0x4a0 [ 457.673933][T11993] ? usb_submit_urb+0x1052/0x18b0 [ 457.678943][T11993] ? usb_submit_urb+0x1052/0x18b0 [ 457.683953][T11993] __report_bug+0x29a/0x540 [ 457.688474][T11993] ? usb_submit_urb+0x1052/0x18b0 [ 457.693491][T11993] ? __pfx___report_bug+0x10/0x10 [ 457.698595][T11993] ? lockdep_hardirqs_on+0x7a/0x110 [ 457.703780][T11993] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 457.709575][T11993] report_bug_entry+0x19a/0x290 [ 457.714411][T11993] ? usb_submit_urb+0x1114/0x18b0 [ 457.719419][T11993] ? usb_submit_urb+0x1119/0x18b0 [ 457.724430][T11993] handle_bug+0xca/0x200 [ 457.728671][T11993] exc_invalid_op+0x1a/0x50 [ 457.733186][T11993] asm_exc_invalid_op+0x1a/0x20 [ 457.738317][T11993] RIP: 0010:usb_submit_urb+0x1114/0x18b0 [ 457.743938][T11993] Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c2 f2 ff ff 89 e9 [ 457.763528][T11993] RSP: 0000:ffffc90003ce76a8 EFLAGS: 00010246 [ 457.769584][T11993] RAX: 0000000000000000 RBX: ffff88814cfe0200 RCX: 0000000080003780 [ 457.777630][T11993] RDX: ffff88805659e2c0 RSI: ffffffff8c5dd300 RDI: ffffffff8ffc34a0 [ 457.785592][T11993] RBP: 1ffff1100aa0e184 R08: 00000000000000c0 R09: 0000000000000000 [ 457.793552][T11993] R10: ffffc90003ce77a0 R11: fffff5200079cf00 R12: ffff888022712100 [ 457.801527][T11993] R13: ffff888055070c20 R14: 0000000080003780 R15: ffff88805659e2c0 [ 457.809503][T11993] ? usb_submit_urb+0x10a3/0x18b0 [ 457.814600][T11993] ? __init_swait_queue_head+0xa9/0x150 [ 457.820140][T11993] usb_start_wait_urb+0x12b/0x510 [ 457.825167][T11993] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 457.830731][T11993] usb_control_msg+0x232/0x3e0 [ 457.835527][T11993] ce6230_ctrl_msg+0x2b1/0x660 [ 457.840300][T11993] ce6230_i2c_master_xfer+0x4d9/0x6e0 [ 457.845754][T11993] ? __pfx_ce6230_i2c_master_xfer+0x10/0x10 [ 457.851647][T11993] __i2c_transfer+0x79a/0x1ee0 [ 457.856414][T11993] ? i2c_transfer+0xc8/0x2d0 [ 457.861002][T11993] i2c_transfer+0x1cc/0x2d0 [ 457.865505][T11993] i2cdev_ioctl_rdwr+0x460/0x740 [ 457.870438][T11993] compat_i2cdev_ioctl+0x59f/0x5c0 [ 457.875550][T11993] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 457.881179][T11993] ? __fget_files+0x3a0/0x420 [ 457.886301][T11993] ? __fget_files+0x2a/0x420 [ 457.890892][T11993] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 457.896442][T11993] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 457.901886][T11993] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 457.907846][T11993] ? kmem_cache_free+0x195/0x610 [ 457.912767][T11993] ? __se_sys_futex_time32+0x3ab/0x440 [ 457.918212][T11993] ? rcu_is_watching+0x15/0xb0 [ 457.922958][T11993] __do_fast_syscall_32+0x1d2/0x540 [ 457.928161][T11993] ? lockdep_hardirqs_on+0x7a/0x110 [ 457.933352][T11993] ? do_fast_syscall_32+0x33/0x70 [ 457.938365][T11993] ? asm_int80_emulation+0x1a/0x20 [ 457.943462][T11993] ? do_int80_emulation+0x20e/0x400 [ 457.948649][T11993] do_fast_syscall_32+0x33/0x70 [ 457.953488][T11993] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 457.959798][T11993] RIP: 0023:0xf742d539 [ 457.963847][T11993] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 457.983437][T11993] RSP: 002b:00000000f545650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 457.992084][T11993] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000707 [ 458.000808][T11993] RDX: 0000000080000a40 RSI: 0000000000000000 RDI: 0000000000000000 [ 458.008777][T11993] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 458.016736][T11993] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 458.024699][T11993] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 458.032664][T11993] [ 458.035854][T11993] Kernel Offset: disabled [ 458.040163][T11993] Rebooting in 86400 seconds..