last executing test programs: 1m42.333536045s ago: executing program 4 (id=1036): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f00000a2000)={0x2, &(0x7f00000005c0)=[{0x6, 0x0, 0x4}, {0xf0c, 0x0, 0x6, 0x8}]}, 0x10) r1 = syz_usb_connect(0x5, 0x36, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000080e372208c106801b284010203110902240001000010000904020002f8fd00000905060200020d00060905820200", @ANYBLOB="1081ca321132ad5b903017da789d578b04066b48a306620644db0bfc5fe24695d4496a84afee430be8997cff021f9a9207f94f06a771abd5c5043644712bebd0073843820546235a6373dac38f8ef696c049d67cbb06fd2261ca046d4de37adbe88e473d2b6369bd46fe99253f62edea3e0c90fdd282dc28eb8322c92d55c78f1ded42b5ea04e9425c809291097b9d46c8fb092840dfb2f551317fc1a1d6f92c0a1d1fb648cbabf3ff13d3792c21590edf255e71368f2539372577cf2d9676fa0856323f96371f640a16", @ANYRESOCT=r0], 0x0) syz_usb_connect$uac3(0x6, 0x11a, &(0x7f0000000240)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x4252, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x108, 0x3, 0x1, 0x4, 0x70, 0x6, {0x8, 0xb, 0x1, 0x0, 0x1, 0x26}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x8, 0x61, 0x5}, [@output_terminal={0x13, 0x24, 0x3, 0x2, 0x101, 0x3, 0x3, 0x0, 0x1, 0x4, 0x1000}, @source_unit={0xc, 0x24, 0xb, 0x3, 0x2, 0x100, 0x5, 0x8}, @extension_unit={0x1d, 0x24, 0xa, 0x3, 0x3, [0x1, 0x2, 0x0, 0x3, 0x2, 0x0]}, @selector_unit={0x7, 0x24, 0xc, 0x8, 0x2, "05de"}, @power_domain={0xb, 0x24, 0x10, 0x8, 0x6, 0x8, 0x4, "5d8e"}, @extension_unit={0x9, 0x24, 0xa, 0x2, 0x1, [0x1]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x2, 0x8001, 0x2, "586fbc7ca1a4da"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0xb, 0x69, 0x1, {0xa, 0x25, 0x25, 0x101, 0x1, 0x401}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x0, 0x3, 0xe6, "a513"}, @format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x6, 0x1, 0xff, 0x6f, "108d448c"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x7}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x3, 0x3, 0xc, 0x4, "fa9e"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x4}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x40, 0x7f, 0x2, {0xa, 0x25, 0x25, 0x6, 0x8, 0x6f}}}}}}}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x110, 0x1, 0x9c, 0x2, 0xff, 0x2}, 0x30, &(0x7f00000003c0)={0x5, 0xf, 0x30, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "bff04ce8fe8fd54d3b1792bde3fd491f"}, @ptm_cap={0x3}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x0, 0xf, 0x5}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0xb, 0x2, 0x3}]}, 0x5, [{0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x458}}, {0x50, &(0x7f0000000440)=@string={0x50, 0x3, "9beedf955b5c7c5f482beb610502791283955df12f90ac55d8b89b26e9e64a003741ffa857371ed517046b37c0b2c9717dcb08455c3ca142a7a11913e724a343116acce8ad22cfba5dad608bfa4b"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x437}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x3409}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x445}}]}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000040000000800000014"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000200)={r2, 0x0, 0x0}, 0x20) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000140)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 1m38.940822581s ago: executing program 4 (id=1048): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x161283, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x40000073, 0x0, 0xfff}]}) r1 = socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x800) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x0, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x12}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x1, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0xb7}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) r7 = accept4(r6, 0x0, 0x0, 0x80800) sendmmsg$alg(r7, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x1cba8c72}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x177ffb498171ed1, 0x8040010) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x10, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0xf5000000}, 0x0) 1m37.576411551s ago: executing program 4 (id=1051): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c000b"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) mknod$loop(&(0x7f00000190c0)='./file0\x00', 0xfff, 0x0) execve(&(0x7f0000019100)='./file0\x00', 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002f00)='fdinfo\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0x3, 0x0, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x859, 0x5, 0x32c}, &(0x7f00000002c0), &(0x7f00000000c0), &(0x7f0000000000)) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x6, 0x0, 0x0, "5debca561a5fbf61048955f6f876b2ff"}) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x40, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x80000000, 0x2}}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x404d3, 0x2b}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x40000000}}, 0xe8) getsockname$packet(r4, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000480)=0x14) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f0000000680)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x58, 0x0, 0x2, 0x70bd2a, 0x25dfdbfb, {}, [@ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x7}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x9}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x5}, @ETHTOOL_A_RINGS_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0xc}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x7}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x20011) r7 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[], 0x10}}, 0x0) sendmsg$key(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 1m34.648895278s ago: executing program 4 (id=1061): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="5801000040000701feffffff00000000017c0000040042800c00018006000600800a0000340102802e011480080007"], 0x158}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="51640646eae0aaaaaaaaaa0086dd6000000000140600fe8000000000000000000000000000bb0000000000000000000000000000000100004e"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80701, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000440), 0xf, 0x183043) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000005c0)={r5, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, 0x1d, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09d0200fb0a010000000000f5ffff0200", "2809e8dbe10859892d0000b420a9c81f40f05f819e0117020000f20020000000e903001000", "90be8b1c5512406c7f00", [0x4, 0x5]}}) r6 = syz_open_dev$loop(&(0x7f0000000300), 0x8f, 0x0) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f0000001280)={r4, 0x200, {0x2a12, 0x80010000, 0x0, 0x3, 0x20000000000006, 0x0, 0x0, 0x3, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7ca64c6a4b4e00d9683dda1af1ea80000000000000000000000deff1200100000000000000000000000000800", "2809a9000000038948224ad54afac11d875375bdb2420000b420a1a93c7540f4767f9e01177d3dd40600000061ac000000800800", "90be8b1c55f96400", [0x5, 0x4]}}) creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) mount$fuseblk(&(0x7f00000001c0), &(0x7f0000000200)='./file0\x00', 0x0, 0x1004, 0x0) statx(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x800, 0x80, &(0x7f0000000580)) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000080)="0f01390ff2f63e0fa10f01c966b80a00000066ba000000000f300f79d80f232d0f01c966b9024d564b0f32350280660f38dfec", 0xfffffe3d}], 0x1, 0x4, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0, 0x4b}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000002c0)="f7790065baa08dab460f07b991030000b8d9c50000ba000000000f3066ba4200c4a1d75edb66ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07090189655348b8eb6e0000000000000f23c80f21f835000080000f23f8c4033921820f47a753fd", 0x6e}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) 1m33.65685198s ago: executing program 4 (id=1063): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) arch_prctl$ARCH_SHSTK_UNLOCK(0x5004, 0x3) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xffffff0000000005, 0xfa11, 0xffffffff}, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/tcp6\x00') read$FUSE(r2, &(0x7f0000004100)={0x2020}, 0x2020) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_pidfd_open(0x0, 0x0) open_by_handle_at(r5, &(0x7f0000000180)=@OVL_FILEID_V0={0x15, 0xfe, {0x0, 0xfb, 0x15, 0x2, 0x44, "b464e15688d32a5c55332899da424cb5"}}, 0x1) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="19429c7810000906000000a434c6a700000000004e9714d67633b06ef97d05ec8f19eaf61c2f81ec20ee4340b1ee48e1e289cfd56a7e5021775aa4f7326355c6c689e6df2cc4f8ff9b238345d179de62d8562519ecab0a6af97ff3fb93d0f315890cba6908d38b892c60297be4325634a18c2c0cf09790f7b3c21eca80453860eb2bf05f546e51161b94a99a7bf5cc8108c2deb079692669915e164377406152ce3d2d9985932c5c2c50d024def9d88efaa06064315d5208a0209bfe44f6b0d29ab8ebc899", @ANYRESHEX=r5, @ANYRES8=r1], 0x40}, 0x1, 0x0, 0x0, 0x8885}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) read$FUSE(r2, &(0x7f0000002640)={0x2020}, 0x10f) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r7, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 1m33.308020542s ago: executing program 4 (id=1065): socket(0x2a, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unlink(0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r2, 0x0, 0x2d, 0x0, @void}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000080)='cgroup.clone_children\x00', 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000700)=ANY=[@ANYBLOB='1-'], 0x31) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000740)={"373ab6e870bf64ef25ad87deef94c3b7350df627ea76a6efbd6c33a19e5dde0b3718dac0c2b8e833beb9e0347000fc7332c43a3128856f23df4628fb1e54b1745094c19bc88c190192f58dda884b3296f7cd6373842bff61047e0697c9af6e9f62b88fd21621b527902efdae6efd3516c7e5a36f4aaa12cd1b3ac0686db46783f45fe6aa2515ab6996b4807b0d9575a9061a775ef515a40b97c34035e8e412b9200000001000000062a07ab97f50ff5deb8a5978611317016887694245b363252230bbe17ed0f591f935d8e4ae7563103b2fdfad8a775f0a4b15f63f5c4851df9aef747ace240cec55ce1659c08d38714245835e15291c4973ade3b2006d8870a1d739eb8e7a284e23f660b2061e31a70627be4acb16ecbe8a4edde1c5397c761a2fe0690f5d580ebf35b8640441ddf47d1f67a5e2d892f14a4f88412ce3cc8ec4d058ffffc8638502410837253d6ac316ee9c6a24eb5d83463ff9bdf81f31c12b04adec97fe1377d2f29067e5f6f48cc123f2c4c02afe60d224c7d974a63c1aa9b110d2187f18de3753b57c630eab26238e8201501a007da99f1d07f76c4da113859ab55792049a15c5d83051f41ae951912eb81154f2398a729b6d6c51d6850b00000000b24996e4ec707d1a744dff58ea5030fcd6b46a468ac029f86be30c7c3d5708e3871fed2e63b9c3ad265350e87e9fc44696eadeecc1ff67e30b64be27f480180d26218d031380149bcc31bd712063e9c09ed5329a530800000025d79eb9d4491d82d2b7a3d7d0cf9286396fcb8c2ccf1655b3ba420c36c3fb88d788308e947cc15e0957a98a843911c954c2a2feccd60d0000da8330cd1de951bcd767cf211a241c882b8d5e608fc0e796afead2a7b05018b4ae6c034c4c4997868343a5d064838dd0aca0d21b429665a0a1b4fd17cd34e711cee01d2348dc5871cca7ab4e4924f6f4bc29e7dbfae6788549e600000000271cd7ddfabd45803a6d1145734a82b2b9a6a87c8e118629840a027fd3f8e5a6a5dccee1a480d6cd0402a64db2263b1a9de61848b1eb31b51189f4caa2fdf0c3a38275386522137fe573ec27693a337c324952480c9ae476a694010aa22095c6d8bfceb5e024cbc21d6c1d1b17fae63dc627a948c4eca7dfa3f8a4e628531472e00ed28f2d2b7fcf03b5ba1975fcc010482a08c7800b3c87587a9fea37402ffafcc9cabc16a123164765d10dafe323ce33f197af8a3cf57332dbbee3f263a16cb565b61690b5804341630437ad2277be4ff82d1aa32c15b0cf99c88c7bca0ecf47a3be490bf6079f19acdf9a71f636fff612167c849b5c149cb32d8dd98d2aa8bb0606a1214fc1f0da04476cd8c3c056ec88eefca4d331ecbd5416c356466202cb97ddfc320b7594d5ab2e9102d549ffa72300"}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB], 0x2c}}, 0x0) r6 = socket$kcm(0x21, 0x2, 0xa) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_ifreq(r7, 0x8994, 0x0) sendmsg$kcm(r6, 0x0, 0xfc40) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x1) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000d40)=ANY=[@ANYBLOB="44000000020605000000000008000000000000000c000300686173683a69700005000400000000000900020073797a310000000005000500020000000500010006000000"], 0x44}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1=0xe0004001}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) sendmsg$IPSET_CMD_SAVE(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)={0x38, 0x8, 0x6, 0x201, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x200484d}, 0x8000) 1m32.728141033s ago: executing program 32 (id=1065): socket(0x2a, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unlink(0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r2, 0x0, 0x2d, 0x0, @void}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000080)='cgroup.clone_children\x00', 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000700)=ANY=[@ANYBLOB='1-'], 0x31) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000740)={"373ab6e870bf64ef25ad87deef94c3b7350df627ea76a6efbd6c33a19e5dde0b3718dac0c2b8e833beb9e0347000fc7332c43a3128856f23df4628fb1e54b1745094c19bc88c190192f58dda884b3296f7cd6373842bff61047e0697c9af6e9f62b88fd21621b527902efdae6efd3516c7e5a36f4aaa12cd1b3ac0686db46783f45fe6aa2515ab6996b4807b0d9575a9061a775ef515a40b97c34035e8e412b9200000001000000062a07ab97f50ff5deb8a5978611317016887694245b363252230bbe17ed0f591f935d8e4ae7563103b2fdfad8a775f0a4b15f63f5c4851df9aef747ace240cec55ce1659c08d38714245835e15291c4973ade3b2006d8870a1d739eb8e7a284e23f660b2061e31a70627be4acb16ecbe8a4edde1c5397c761a2fe0690f5d580ebf35b8640441ddf47d1f67a5e2d892f14a4f88412ce3cc8ec4d058ffffc8638502410837253d6ac316ee9c6a24eb5d83463ff9bdf81f31c12b04adec97fe1377d2f29067e5f6f48cc123f2c4c02afe60d224c7d974a63c1aa9b110d2187f18de3753b57c630eab26238e8201501a007da99f1d07f76c4da113859ab55792049a15c5d83051f41ae951912eb81154f2398a729b6d6c51d6850b00000000b24996e4ec707d1a744dff58ea5030fcd6b46a468ac029f86be30c7c3d5708e3871fed2e63b9c3ad265350e87e9fc44696eadeecc1ff67e30b64be27f480180d26218d031380149bcc31bd712063e9c09ed5329a530800000025d79eb9d4491d82d2b7a3d7d0cf9286396fcb8c2ccf1655b3ba420c36c3fb88d788308e947cc15e0957a98a843911c954c2a2feccd60d0000da8330cd1de951bcd767cf211a241c882b8d5e608fc0e796afead2a7b05018b4ae6c034c4c4997868343a5d064838dd0aca0d21b429665a0a1b4fd17cd34e711cee01d2348dc5871cca7ab4e4924f6f4bc29e7dbfae6788549e600000000271cd7ddfabd45803a6d1145734a82b2b9a6a87c8e118629840a027fd3f8e5a6a5dccee1a480d6cd0402a64db2263b1a9de61848b1eb31b51189f4caa2fdf0c3a38275386522137fe573ec27693a337c324952480c9ae476a694010aa22095c6d8bfceb5e024cbc21d6c1d1b17fae63dc627a948c4eca7dfa3f8a4e628531472e00ed28f2d2b7fcf03b5ba1975fcc010482a08c7800b3c87587a9fea37402ffafcc9cabc16a123164765d10dafe323ce33f197af8a3cf57332dbbee3f263a16cb565b61690b5804341630437ad2277be4ff82d1aa32c15b0cf99c88c7bca0ecf47a3be490bf6079f19acdf9a71f636fff612167c849b5c149cb32d8dd98d2aa8bb0606a1214fc1f0da04476cd8c3c056ec88eefca4d331ecbd5416c356466202cb97ddfc320b7594d5ab2e9102d549ffa72300"}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB], 0x2c}}, 0x0) r6 = socket$kcm(0x21, 0x2, 0xa) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_ifreq(r7, 0x8994, 0x0) sendmsg$kcm(r6, 0x0, 0xfc40) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x1) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000d40)=ANY=[@ANYBLOB="44000000020605000000000008000000000000000c000300686173683a69700005000400000000000900020073797a310000000005000500020000000500010006000000"], 0x44}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1=0xe0004001}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) sendmsg$IPSET_CMD_SAVE(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)={0x38, 0x8, 0x6, 0x201, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x200484d}, 0x8000) 15.151231491s ago: executing program 5 (id=1364): r0 = socket$key(0xf, 0x3, 0x2) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd2(0xe5c, 0x80000) eventfd2(0x4, 0x0) r7 = eventfd(0x0) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000140)={r7, 0x6, 0x2, r6}) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r9 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000000)={r9, 0x7, 0x2, r6}) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x9, 0xc0, 0x5, 0x7, 0x7f, 0x0, 0x1, 0x9, 0x1, 0x41, 0x3, 0x58, 0x7, 0x5, 0xb, 0x7f}}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000002c0)={[0xcb, 0xd, 0x2000000000002, 0x6d, 0x2, 0x4000000001002, 0x80000ef, 0x3, 0x7fffffffffffb, 0x8d, 0xfffffffffffffffe, 0x3, 0x1, 0x5, 0x3, 0xbdf], 0x2000, 0x67a64fa265da9e51}) r10 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000002c0)={'bond_slave_1\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001100010026bd70000000000007000000", @ANYRES32=r12, @ANYBLOB="85c39c4d3bfd2f27"], 0x20}, 0x1, 0x0, 0x0, 0x60}, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000380)={0x10000000, 0x8, 0x20000020000}) sendmsg$key(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x2, 0xa, 0x8, 0x3, 0x2, 0x0, 0x70bd2c, 0x25dfdbfe}, 0x10}}, 0x4) socket$inet_udp(0x2, 0x2, 0x0) 11.92985604s ago: executing program 5 (id=1375): openat$audio(0xffffff9c, 0x0, 0x101100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c41, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x2) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup=r4, 0x6, 0x0, 0x50d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0xe6c11ffe4afd7b0e, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r6, r5, 0x15, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0}}, 0x30) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x23, &(0x7f0000000040), &(0x7f0000000200)=0x38) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3c) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r7, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x2000400}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176}}], 0x400000000000172, 0x4000000) 10.580614969s ago: executing program 0 (id=1381): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000001900000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000300000006"], 0x34c}}, 0x0) 10.088588127s ago: executing program 0 (id=1383): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a40000000060a010400000000000000000a0004050900010073797a310000000014000480100001800900010068617368000000000900020073797a32000000de00140000001100010000000000000000000100000a33a78f9076db7adc2235a5490b73e4bb73b64158b82245ad89f269e4cf45dd644b4bc2673a1418272f83938f5cb04f4f6c826d044e99d7d8e2581b0db5e3d595ec5fa77176adec2a66b5f23e91156bd60aceff379f1fda1087f8af78166a56fe77ceb85e35a2d25e767a64a08bd7c141c144821074a0504a1a3b2e7601bfb31199d4708606fdf8e4a1e58452e1d139035b2b2ffe1650161d3ac7e0beb2685c16fe79ca428317ef09de3d0e92fe34"], 0x68}, 0x1, 0x0, 0x0, 0x48890}, 0x24000000) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000f40)=[@rdmsr={0x66, 0x15, {0x40000090}}], 0x18}) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000140)={0x1, 0x0, [{0x40000001, 0x7fff, 0x4, 0x31237648, 0x6, 0x2, 0x80}]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x40}, 0x81) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x4, 0xe0, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x3}, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000180)) r7 = syz_open_dev$vim2m(&(0x7f0000002c80), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f0000000140)={0x7, 0x3, 0x2}) io_setup(0x6, &(0x7f0000001380)=0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0), 0x105004, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000200)='net/raw\x00') io_submit(r8, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x1000000, 0x0, 0x0, 0x5, 0x0, r9, 0x0, 0x0, 0x101, 0x0, 0x2, r9}]) ioctl$vim2m_VIDIOC_PREPARE_BUF(r7, 0xc058565d, &(0x7f0000002dc0)=@userptr={0x2, 0x1, 0x4, 0x0, 0x1, {0x77359400}, {0x1, 0xc, 0x9, 0xc, 0x3, 0x8, "c12400"}, 0x3, 0x2, {&(0x7f00000002c0)}, 0x96000}) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000100)=@v3={0x3000000, [{0x8}, {0x0, 0x4}]}, 0x18, 0x1) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], &(0x7f00000002c0)=""/203, 0xfffffffffffffe5f) 9.743999155s ago: executing program 5 (id=1385): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740"], 0x64}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c0002800500010000000000080007"], 0x138}}, 0x4) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000180)=@ethtool_perm_addr={0x20, 0x6, "2bdafcad38f6"}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="d4000000000101040000000000000000020000002400018014000180080001007f00000108000200ac1414000c0002800500010000000000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000030000080008400000000a0400164008001540000000030400170058000d"], 0xd4}}, 0x0) 9.516927364s ago: executing program 1 (id=1386): r0 = syz_open_dev$sndpcmc(0x0, 0x0, 0x80080) ioctl$SNDRV_PCM_IOCTL_STATUS64(r0, 0x80984120, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x8001, 0x0, 0x98, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$fb0(0xffffffffffffff9c, 0x0, 0x121800, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000cae02, 0x0) dup(r3) ptrace$ARCH_SET_GS(0x1e, 0x0, &(0x7f00000000c0), 0x1001) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x850}, 0x4040080) unshare(0x40400) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r5, &(0x7f0000002780)=[{{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f0000000740)="ab24d443059991344bcf718f98515c1a28a39a5580654ef922a9669590ca191e54285e618efba7fad45297a641414cf199c66e8af3ee7ec823c254c191192b7f15c75df066578f0346f47423e3d1796bce784f060f094a8f1150f2b7fcfa2296bbeb29da983bcb51c53f83222c5ce5433244c2b79b5d4acb24039d65c0bccea8c380a0888ce651f033503cee4ce8dc464f4083d0d2f3e7e57fd1d807797e94de53927756b10bacd92dea57d1dfa4fa18fad3e7e3a557d8dbec5cde0329c0179ec7386928f795d02436e55a463471e3870cfb55e7d1c5969aa66ee9b991cacfb68e8b0dec5c3fcc646d92ef9ed8b3e8e2be0f81b9a78c29b3e9cb79c3b1daa2c7a8fcd3d9a3b1fcfff41782c80e20c2be287cf82f4718dfd2f88bfb3b0af22bc38e74cf997c9b47293e4b383c38676b087441599d07c8f618072f1440b0f745dbc33330d1b0e2915a07b605f2001aed20f8dffa977d0fdd2a2c13bb608839aed516c094d86bba88be6eba206b0aaa420e60c313542bed7292bc74971312941256f71a0fd0acadd68f7d0ba527c0374d0f77bfef9909b4be7ef71d387c65c5e1095cd7af7846e3b84f87bbd4f0005a99452c697e80881769f431db0856c5df27605e17f46250ec711e2406c4db20a776b521dafbf32ece25a562bd4d377ef8eb6da4850e5f4e0ea607ffdd8bf421c30e63b3d58425267265e54d0e324fa53e5b1bf897ad7b922553879c7961d77c045d2866a066374677142b5e3b0fd8330a2421489cc3ab362da94afafd613dcdab3e05bec3d9898e5445096b16b38349827ad8f3660ec7a640eb4241ac0ded7d04404e0a3ec940010138d9cdcc1101d976579944cd23ff310f4429fa9da353b2e554d778b016143db9b4ab68d450b13623c89737be25a24fd3e847e5541bd9555e85ab1c65a502bf2b76fa51d2cd3640ecb662d7d4b055f198b704736c401c4ede30b081acddbf829173c99f7973d0eb22f05530554417bb53682e34b5fd34b3aa2259a521cf8fc09ab89522c16b8597ef503935c26388d97fbe59f59eab991f5b3e3bae2855e15235f326d9d8e40573b5a262f52a2b3631d24c92d0a4df11f49f5656efe07a53d26a013fe37b7c8a9793a22461d0c95ecc179c4b11b98243491791311d9e849471cdc74fb8e3b6f2089d62cc91ccb036c95bb8b29c5bb58c36326439e87520b653d0f4d50ebb70bfc71fcbe94bde186df2fe012cf0509420229b3480163cfc6b1810e13cb4f5d9ad45dda8e24b474993b085e2f2f7a1118818a22c3dd9915c2d6a46ecef76fa95cbd09b3a48df4c3755e450857eb057c4cd512e0cae42d16c2d65cfc2e3182eccc956fcb346711684497a0b4fe184c0e57d7b2d31511944aa70042de624a2cbc90fc8c5011974b4f17b3d972936a1c7e82cbce5ffc8f9255c6c3c97feb6762e1b115f01649b125ea09cc40a857be2aec8e55f0dfacecb74aab44d9ac77e6dd9fba4f01c00b56ee343ca3f44892545a8569d320d49c4ff5cc3f72df2bcfe085ef1013b358436b62bfdd2a218d5c72d43d8d7b6170015a115f2d6a82e4105c0cfab5bcb924d5dd095f0b2dba657914e6f92ecc325483289b2165fe5062960680028c82b47bc7d1dd9e83398c25adc391632a75983e367a525d1d8e7f58e4e08ab245b0a937b1fa3e758036d56892e9c84e812d011e94587a88d38571c29524ac2589d43a9c8517c65d19d3ca9f8bd81bb817faeaad32cf7872bc2032eb6b7b6d4711ba144c569103ee6f944ec74cb79bda51e6e4e701d7f19b7b1a6b4917b086efe29187247d79ca97a4d04f39b7123b74a69ef8fb1e647f01d232d38d424f4557fb4084f632b24108b6507b5c9fb336b0dae4f1375a5d73d730364f8daabe7b12dee8d83477e8662e49c77eb4cb19db4f8115c7a70335e0b0d5007963fae9f12484c8c5879f640cd4b24a8f4c112aaa0e09ffb21e93d3d4ae8c21ddde63b0ccafa2a80654aa9025210e27681523a19eb4371dfbc78da1ca16e5a00601213c0f0083a44bb507434555b9a33a0a72baabe375b8d6fcc6395c49dacd3622b97e90c43af329bfb35239f16803759491aa2dfe37b397829df8e79d0eaad1ee6adb25b69c75c568c1f73401adb47e620ae59c85c8abecd819efa6c6b504030dcebc60e8975b9a896506ab66f9b012c3241d3cc3c4f57252189a808d6e01cc7d7b4a0f080a065a3d622fdcc39972e7c1958e5dad3fae23aa07c6fce808f93edda6bc7fc7ad674502cea59c9b9b19b8e2e7b73d0ddead38d4b40a3e3ce203475a2c3e0b8c55712c1158291ffa7d25b8c12215c68f8a8598727446aea8198be70722feba544d1bbfbd7572180152807a6022ce362682c37c92a4905c64a3dd532805a990bec7fa764f32f061a741173d5283f5798c7be5145d1f18a262b03c975a567fa551902eddbcd9df9857679532bf379067cf807d57ace84e739fefb8760b9b21acba80ec2f6f547b876ac69ac08fb20c3e502c24b3fbd3144451801d0d53429597d23671d39ed2585536fd9a7c95e7870ae215987a3ed1ef9f8efc7b82b7f7d042c6a80f81f769eef7aa5138a1584596f226f2e4a39cfcdaa288e3cc5e534d02c57f6743fa7a4b0ba55c8c47c08b953296c1ae824e56eab04117a60652c0a36ea71f9f65d1b64e8e91e30d313d0e7c57a2a22b5e7c4a75c72af22d40a2fb10777db1d01f7bcb24b55f550884d876ba59af95494e431a0ae9595847a21e152e9dd1151f6b07f48b1ace963c12922e41d0e911c48f91797513a136a7ba7b283c8529fe55417ca3c", 0x7bf}], 0x1}}], 0x1, 0x4002090) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000580)='r', 0xff8e, 0x400c845, 0x0, 0x0) semop(0x0, &(0x7f0000000080)=[{0x1, 0x8001, 0x1000}, {0x1, 0x5b7a, 0x800}], 0x2) semop(0x0, &(0x7f0000000380)=[{0x1, 0xbbdd, 0x1000}, {0x1, 0x2, 0x1000}], 0x2) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000240)=[0x6, 0x7fff]) socket$inet_tcp(0x2, 0x1, 0x0) 9.41519153s ago: executing program 5 (id=1387): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000bdf7130870270c936a8d010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x20, 0xd}, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x20, 0x82, 0x1, "88"}, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000080)={0x40, 0x90d19e26b9747888, 0x64, {0x64, 0x10, "8b019f9fb7d9fe180111fba71b023d24db3bc31ca397402c032d1e1644d4c005c84a00b6b31705728782a112e710f5e3ca8b4b67c65ccfa9ff02751d2d9bb7dea5e318574f81336a5a1744d6fa7791f1ba7ce2bbfa47099ec16e4ee030260345236e"}}, &(0x7f0000000100)={0x0, 0x3, 0x73, @string={0x73, 0x3, "8ff0b9e00028c7a2b96ec6cb82cb23e9b2c1710334debde414b3723e00c4798aa739170641b832ca09d3f954ba0589a236676753dca20442a6949569fa3bc67390aeea2594304d47379ddcdcf27920c08b270c417c5be86127b6bf7935da64ce75d14a586bf75ff5f2d324d8f71aa2fe35"}}, &(0x7f00000001c0)={0x0, 0xf, 0xb8, {0x5, 0xf, 0xb8, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "d866158de3f95a3bfd6d5a5ca6630d78"}, @generic={0x7c, 0x10, 0x2, "4c47aab7e4a236a8457839be3914f364fb76b2525ebc6a528162c83e354a6d1bd60e54cc55c5e43ce325c07e6dcad07fdd7ec9d7f6b4c3122b70bc4a34f8fde2fba46f07c78edd8e37eeef9297feef20bcac72ac0934ecd543e57b0d59dee49205dfc2f788c46c7dd97a7199fb08e78f8fb6594e7e39267d87"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0x8, 0x8}, @wireless={0xb, 0x10, 0x1, 0x8, 0x42, 0xd, 0x1, 0x101, 0x7}, @ext_cap={0x7, 0x10, 0x2, 0x1a, 0x7, 0x0, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x3, 0x4, 0xf}]}}, &(0x7f00000002c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x20, 0x18, 0x4, 0x3, "8d5c206b", "d25619b4"}}, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x46, 0x10, 0xf, 0x3, 0x9, 0xfd, 0x6}}}, &(0x7f0000000980)={0x84, &(0x7f00000004c0)={0x0, 0x7, 0xc0, "6d6b9678a194925b519a91fd9687c435416b5664052c287be671a981ca668c757297b8ad0ec8502252250794368c75fabf7a265aefe03920e1ff1c63ff309a7c12b2c5ff3606a6d48a1954478427333bb7f366a687410a8647e2272efdfdacaf02c59a2161cf4ec297ea9a2c75301948bf32b4e241358b9ba921a0fc05fccfebb9656f8030b5a381dff90f7bd79682c76517f9157dbf50c23f1085646959f578fbb825882c1c249a4419ed593077dda5f61e859e491504a362a7e4873b629123"}, &(0x7f00000005c0)={0x0, 0xa, 0x1, 0x67}, &(0x7f0000000600)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0x1}}, &(0x7f0000000680)={0x20, 0x0, 0x4, {0x80, 0x40}}, &(0x7f00000006c0)={0x40, 0x7, 0x2, 0x8001}, &(0x7f0000000700)={0x40, 0x9, 0x1, 0xfb}, &(0x7f0000000740)={0x40, 0xb, 0x2, "1da8"}, &(0x7f0000000780)={0x40, 0xf, 0x2, 0x9}, &(0x7f00000007c0)={0x40, 0x13, 0x6, @local}, &(0x7f0000000800)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000840)={0x40, 0x19, 0x2, "c5d2"}, &(0x7f0000000880)={0x40, 0x1a, 0x2, 0xd}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x3}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x15}}) 8.674169081s ago: executing program 0 (id=1390): timer_delete(0x0) eventfd2(0x8, 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) syz_pidfd_open(0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) bind$netlink(r4, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) syz_usb_connect(0x4, 0x145, &(0x7f0000000900)={{0x12, 0x1, 0x200, 0x7f, 0xb4, 0xdb, 0xff, 0x4da, 0x3904, 0x8ace, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x133, 0x1, 0x2, 0xcf, 0x10, 0xf2, "", [{{0x9, 0x4, 0x52, 0x2, 0x3, 0x18, 0x7f, 0x3d, 0x4, [@cdc_ncm={{0xa, 0x24, 0x6, 0x0, 0x1, "0e0c7aaa2a"}, {0x5, 0x24, 0x0, 0x74b4}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x81, 0x6, 0xa7}, {0x6, 0x24, 0x1a, 0x8, 0x2a}, [@country_functional={0xe, 0x24, 0x7, 0x3, 0x9, [0xf1, 0x7, 0xfffe, 0xf800]}, @acm={0x4, 0x24, 0x2, 0x9}, @acm={0x4, 0x24, 0x2, 0x3}, @country_functional={0xc, 0x24, 0x7, 0xe, 0x2, [0x3, 0x1, 0x4]}, @mbim={0xc, 0x24, 0x1b, 0x4, 0x4, 0xa, 0x3, 0x733b, 0x2}, @country_functional={0x10, 0x24, 0x7, 0x4, 0x2, [0x4, 0xfffa, 0x9, 0x5b, 0x0]}]}], [{{0x9, 0x5, 0x1, 0x2, 0x200, 0x3, 0x6, 0xb, [@uac_iso={0x7, 0x25, 0x1, 0xc}, @generic={0x9f, 0x10, "6ee8c6c3db2b4a953234221e6beefc2d981c071bc438c1c0cda7aa3ce40da2cfa52ab39ab1783b286f3b76a0b5e26071a98b195241767351a41136e400478a575f7e3383147cd4d43d0d42b068ccaafcae4dd7c2309f8a38216ee4d61ed732d03085a982608d82afab9193dc94aeec6136f5adea8ff5f85022f02eecab68a4f683bc339435a2a2fd98c1f4f89c222565b4eb3571ff68e8866bec32323c"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x3ff, 0xe0, 0x81, 0x2}}, {{0x9, 0x5, 0xc, 0x10, 0x8, 0x8, 0x6, 0x1}}]}}]}}]}}, &(0x7f0000000b40)={0xa, &(0x7f0000000a80)={0xa, 0x6, 0x200, 0x6, 0x1, 0x8, 0xff, 0x57}, 0x1d, &(0x7f0000000ac0)={0x5, 0xf, 0x1d, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x6, 0xc, 0x4}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x7, 0x9, 0x100}, @ext_cap={0x7, 0x10, 0x2, 0x10, 0x6, 0xe, 0x4}, @ptm_cap={0x3}]}, 0x1, [{0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0x385d}}]}) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r5, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x7, 0x2, 0x7fffffffffffffff, 0x7, 0x7fffffffffffffff, 0x2, 0x2, 0x6dd, 0xfffffffffffffff9, 0xb482, 0x9, 0xfffffffffffffffc, 0x7ff, 0xa, 0x0, 0x9], 0x80a0000, 0x148800}) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x67) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x44}}, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340), 0x10}, 0x94) ioctl$VIDIOC_SUBDEV_G_CROP(0xffffffffffffffff, 0xc038563b, &(0x7f0000000140)={0x1, 0x0, {0xffffffff, 0xb37, 0x4, 0x40}}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000008c0)=r10, 0x4) r11 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=@mpls_getroute={0x14, 0x1a, 0x1, 0x0, 0x0, {0x1c, 0x14}, [@RTA_NEWDST={0x84}]}, 0xa0}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 7.477354498s ago: executing program 1 (id=1395): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000300000006"], 0x34c}}, 0x0) 7.22467112s ago: executing program 1 (id=1397): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x24000840}, 0x40) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4050000000000006910a40000000000bf001000000000f19500000000000000ef4f7c81f5427c16bd2aacf32cdbb47063fd9a7bb1f3ad622c3261f324e081c0ea39bd16d9869302cc08fbd94867708cb208e22cc0ad536525e3b39869285c126353f6a49bc5abc6b9a4eab313655286ee33a56f03b665dd5f1739bda6accc3b9b0d26450d3161263aed01194269a5fba4553bb18fa1f37e2f68a8ef81f090829d0ee04b52611a41642b31a6fe2653171379cc327fc11e38418b589777f8c8ddcbf88df947a05937ea"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) r3 = fsopen(&(0x7f00000000c0)='ramfs\x00', 0x0) openat$nvram(0xffffff9c, 0x0, 0x101000, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fchdir(r4) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 7.188800627s ago: executing program 0 (id=1398): socket$xdp(0x2c, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8001, 0x0, 0x9, 0x0, 0x3, 0xfa11, 0xffffffff}, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e23, 0xffffffb9, @private0, 0x2}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000140)=[{&(0x7f00000000c0)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050c100000000000224e0000", 0x58}], 0x1) r4 = memfd_create(&(0x7f00000008c0)='[\v\xdbA\xae[5\xa9\x90\xffc\x1f\x1a\xa9\x16\xfa\xadR\x10\xf3\xb6\xffT\x02\xd1\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9e,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xef\xa2\x82\x1e\x03\x00(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89c\xda\xa9\x83r\xd8\x98\x00\xff\xf5\x95\xd2q#\xc6\xca\x97\x9dM\xe2[\xd0YF\xf8\xb2\xa5\x1c\x00\x89\xeb]\xa3\xfd\xd8\xec\xbd\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xe3\x00\x00\x80\xb5\xa8{K\xfd\xeb\x16:\xfe\xafk\xb4\xd04(\xae\x0e\xd1a\xacV\xdd\xd5\x86\x82\xb0X2\x85j4g\xa5~\xe9\xdd=\\w\x91b\x87#\xdesgF\x86\xa8d\xec\xa1\xe8\x1cL\x8a\x03\x84+\x92\x88]s\b1\xa7( )?2\x11|\xce\x06c\xeb`\x8b\xdb\xa1<\x11\xbdq\b1\f\xbcd\xf3E\xd0\xc1g\x96\x16\xd2t\xce\x00\x00\x00\x00\x00\x00', 0x2) write$binfmt_script(r4, &(0x7f00000009c0)={'#! ', './file0', [{0x20, '0|\xee\xdcCh\x1e\x88\nk\xa8\xdf\x89{\xaf\x12B\xfa\x1a:/Fi\x83\xb2\x95\xbb\x02&x!\xf0q\xaa\x02\xaf\x8c\xb4\x90\xf5\xd4\x9b\xfa\x83\x9f\xd5\xe66\xdc\xbb\n'}, {0x20, 'x#L;\xf6\xbf\xba'}, {0x20, '\xcb}`\xc8l)P\x8f\xacq\x9b\xd9\xad\xf3u[\x8c\x13}\xfd#\xda\x927\xe5Q\xb6\xfa\xceg\xab\xf7v\x01\xe0m\xa3\x86%\x02bo\x12\xcd\x7f\a\xd2\xa0\xe4\xa3\xbb\xc15l\xc7\xb9\xdbg\x94\xf8\x18\"q\x97\xf4\xca\x12<\x8c\xa0\xcc\xc5%\xf7\x86\xfc\xdd\xc2\x11\xf8s\xe1?\x8c\xd7\xa1\x10\xcd\xaba.\xab\xe0z\xc9\xff\xff\xff\xff\xd0\xed\xfc\xa45 \xf4<\xbay:\xf5\x00\x02\x82\xdd,\xcf\x7f7\xce\x17\xab\xdf\xe0+\\\xe4y\x9bzB\xd4\xb3\x11X\xc8\x96\xe5Q5\x90_\xf6\x80\xc4\xca\x8aw;\xaa\xd0\xaa\xc9\xbd\x7f\xe0yY\x85\xf0\x86\xb0\xd7\n\xbd\x18\b\xa5\xe7\x01\xd1\xa7\xeb~\x94\xa6\x12)9<\xf4\xd1\xcci\xd9\xac\xb71)\xd8z\a\b\x8e(\xb1\xe0XN\x00\x00\xbfo\x85\xa9\xc4\xf0Pb\xef\x1b\x9a\xae\x86\xc8\x1f\xc4;5o\xaf 5~\xa9\xb1i7\x90\xc1\x89\xb8\x8638\x80\t\\\xd9\x9c\x05\xb7)\xf7Q8\xe6i\x16S7\xbbl7\xf2=\xe7\x1ar\xa9\x81\x0e\x1d\xb4\xbaA\xe4\xaa\x16\'\x1av\f8\xda\xda\xbc\xa7\x19`\x86\xc4\xb4y\xec\xfb\xa6\xbe\x9ai\xa5\xfa\x96\xd0\xd2'}, {0x20, '\x00'}]}, 0x171) execveat(r4, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file7\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000id=\x00'/41, @ANYRESDEC=0x0, @ANYRES8, @ANYRESDEC=0x0], 0x3e, 0x0, 0x0) 6.594066318s ago: executing program 5 (id=1401): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000100001000090455070103490200090582030004"], 0x0) io_submit(0x0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x85, &(0x7f0000000740)={0x0, 0x88, "0200000000000000703fe6153c598ae93aa83725cdcff2eae49f89843a5318d5ba093aa761132b512e8c4eb4eb76aa3f3069d1d5a64a2c75a2d59986feff48dc58041310b18d364b87808f8a7494c5de7f7ba36ec3b597fae6ac116b5bc6c564f98676e592103c268225b716a73e48c8c8f8ec21e15e725d000000000000007b2858f76d3c773b57"}, &(0x7f0000000040)=0x90) bind$tipc(r1, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x0, 0x8}}, 0x10) bind$tipc(r1, &(0x7f0000000080)=@name={0x1e, 0x2, 0x1, {{0x41, 0x3}}}, 0x10) bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x9d3354bba4295a8d, {{0x43, 0x300}}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, &(0x7f0000000680)='syzkaller\x00', 0xc, 0x4b, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc}) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x0, 0x0}) r6 = shmget$private(0x0, 0x4000, 0x6, &(0x7f0000755000/0x4000)=nil) r7 = shmat(r6, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmdt(r7) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f00000001c0)={0x1, 0x1, [0xf74, 0x4e0, 0xe4b, 0xa20]}) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) dup(r4) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) 6.468980804s ago: executing program 3 (id=1402): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="b8000000190001000000000000000100e00000020000000000000000000000000000000000000004000000000000000000000000000000000a"], 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a"], 0xb8}, 0x1, 0x2000000, 0x0, 0x4000015}, 0x2c000010) 5.973630014s ago: executing program 2 (id=1403): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e000000200ff800000000000000000000000000000000000000006000000000000000000000000000a"], 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 5.816062886s ago: executing program 3 (id=1404): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000180)={{0x10, 0x8}, {0x4, 0x9}, 0x200, 0x2, 0x10}) write$dsp(0xffffffffffffffff, &(0x7f0000000400)="e3571b9ac1d372d0d15928bd4c575c868bcb1bb43db1e04c33bc9009486301e229008460915efa87a5521d9352f4c6a1cbc7d633ff53755cae0727a11fde5fd25825cae5c492b00eeef35f480c8d55626661a3c6cff9053dfc55840c38b5654a1b81d11f0a4699c9de019bf86a7f3f4e64be143c18cd6879e39ea69734729d11e35d5c2e2a84f54ebe83e695c831aac9ea1e0a05b2ecb3c1ea28f31cdb48769fbbd9301632471b736bd4d6fc3bdb5c9852d98246decfa985dbcb1334eb8b2b579f7a8e5758f9c648ff4baaad5063effe63f5f7126eeacad8ce55bae622efe5bc22f3f208fd79a1f9da0c494af56120d1e07b07e0878d4851f0b201db7ed44ddc0158671a905e38635165f99089519700d837f593599de32565ed19ab9fe8acd3891da424", 0x124) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020200090d0000000000000000000000030006000000000002000000ac1414bb000000000000000002000100000000000000000200000000030005000000000002000000ac1414aa0000000000000000010015200000000001001400000000000100"], 0x68}, 0x1, 0x7}, 0x0) 5.698769329s ago: executing program 2 (id=1405): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket(0x2, 0x5, 0x0) sendmmsg$inet(r3, &(0x7f0000004940)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000140)="9a", 0x1}], 0x1}}], 0x1, 0x4000000) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000180)=0x6b) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000240)={0x6, 0x101, 0x206, 0x2, 0x754d, 0x6, 0x9, 0xf, r5}, 0x20) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000100)=@req3={0xad7f, 0x3, 0x2, 0x0, 0x43, 0x1ff, 0x7ffffffd}, 0x1c) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x80000000000040, 0x7, &(0x7f0000006680)) setuid(0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000100)=@assoc_value={r5, 0x2}, &(0x7f0000000140)=0x8) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040) sendmsg$NFT_BATCH(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000001780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x5c}, 0x1, 0x0, 0x0, 0x24000800}, 0x20000880) 5.350766984s ago: executing program 1 (id=1406): sendmsg$RDMA_NLDEV_CMD_RES_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x9f9ec54af98ce9ae}, 0x40840) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, &(0x7f00000000c0)={0x0, 0x115000}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000080), 0x2, 0x0) sendfile(r3, r3, &(0x7f0000000040)=0x8, 0xc) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x1f, 0x2, 0x2}, 0x51) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r7 = syz_open_procfs$namespace(0x0, &(0x7f00000002c0)='ns/net\x00') sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="ed4d00000000000000003100000008000300", @ANYRES32=r6, @ANYBLOB="0800db00", @ANYRES32=r7, @ANYBLOB="37d4a11df563710ce8b5d6122d90ef484550f1657eb33eae5b755637503bafcdd0f5f9b2efe1b7d74435b0aa9c19602ed8a53212204ab65597dcb7"], 0x24}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r8 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0xb, 0xc4}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0208000004"], 0x48) io_uring_enter(r8, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c000201000000090400000102060000052406000105240000000d240f0100000000000000000006241a0000000905810300000000000904019d080a"], 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009056461ff030000000905ba3e"], 0x0) 5.275185195s ago: executing program 3 (id=1407): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="b801000016000100000000000000000020010000000000000000000000000000fe8800000000000000000000000000010000000200000000000080a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffac141420000000003300000000000000000200000000000000000000000000000000000000000000000000000000000000000000fcfffffffffffffffffffffffffffffff1ffffffffffffff03000000000000000000000000000000000000000000000000000000000000000200000000000000feffffffffffffff00000000000000009607000000000000ffffffff00000000be0000000000000000000000b1"], 0x1b8}, 0x1, 0x0, 0x0, 0x4005}, 0x0) 4.808782992s ago: executing program 3 (id=1408): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) unshare(0x4000400) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000480)=ANY=[@ANYRES32=0x0], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0x58, &(0x7f0000000500)}, 0x10) r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x80000006, 0x0, 0x4, 0x5}]}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa2c09000000f8080045"], 0x0) r1 = socket$inet(0x2, 0x5, 0x5) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f00000003c0)={@broadcast, @initdev}, &(0x7f0000000400)=0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000040000100feffffffffdb5f25017c0000040042800c5cc65f83008008001780d2f669bc2816792bdd"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0x800c000) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000040)={0x28, 0x3, 0x0, 0x0, &(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1004}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000100), 0x202c00, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000300)={0x48, 0x7, r4, 0x0, 0x10001, 0x0, 0x4, 0x3445eb, 0x167a77}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r6, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r5, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r7, 0x0, r6}) socketpair$unix(0x1, 0x3, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) close(r8) socket$l2tp6(0xa, 0x2, 0x73) r9 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000680)=ANY=[], 0x0) syz_usb_control_io$hid(r9, &(0x7f00000002c0)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="c60009"], 0x0, 0x0, 0x0}, 0x0) 4.710225846s ago: executing program 0 (id=1409): r0 = syz_usb_connect(0x5, 0xf4, &(0x7f0000000700)=ANY=[@ANYBLOB="120110014c306f10da0b38011230010203010902e20002a60000000904b10403d7b5d25b09210400020122c705090500100004f40804072501832f08000905000040008103ff0905091b08000c078009042201040e010003090509000000030004090502020002f7810671300c458e9532438d4aae3ef0c9bf5c520b1aaab11a8cae9a60c3160adc1dfedebf5a6ead8834c7780c2eb777ef0caf96cd8b3b77f357f4aa1b662ab40651e6ae8cc63dd9f6e2d24afaed81a927ca2e0354281cfeffffffffffffffbf09aac591308e5c0c3c419bb288a21890e1af4af409050303ff030840040705a6c6415a9f09058503"], 0x0) syz_usb_control_io(r0, &(0x7f00000009c0)={0x2c, 0x0, &(0x7f0000000800)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000540)={0x14, 0x0, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x10, 0x0, 0x8000000000000005}, {0x10, 0x0, 0x1}]}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)={0x20, 0x16, 0x1, '.'}, 0x0, 0x0, 0x0, 0x0}) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000401e04012800000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) r6 = socket(0x10, 0x3, 0x0) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}}, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000005e0001002bbd7000ffdbdf2500000000", @ANYRES32=r7], 0x1c}, 0x1, 0x0, 0x0, 0x831e368c771a0719}, 0x400c080) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r8, &(0x7f0000000000)="1c0000001a005f0214f9f407000904ff81000000ff11000200000000", 0x1c) syz_usb_control_io$hid(r4, 0x0, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r9, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00'}) sendmmsg$sock(r9, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0), 0x30}}], 0x2, 0x20004874) syz_usb_control_io$cdc_ecm(r4, &(0x7f0000000000)={0x14, &(0x7f0000000500)={0x0, 0x23, 0x8, {0x8, 0xc, "47a468c1fb56"}}, 0x0}, 0x0) 4.695580054s ago: executing program 2 (id=1410): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000bfe000/0x400000)=nil) syz_kvm_add_vcpu$x86(r1, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@out_dx={0x6a, 0x28, {0x6769, 0x1, 0x2000000}}], 0x28}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)=[@code={0x1, 0x87, {"0f22e5c744240060420000c744240233d8cecbc7442406000000000f011c24660f38816810c4027958b20000000064449966baf80cb83284af80ef66bafc0c66ed66baf80cb8cc07ff8aef66bafc0cb8d4000000ef48b8f8000000000000000f23c00f21f835030009000f23f8450f2244c4417c50cc"}}], 0x87}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x36900, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0xaaa, &(0x7f0000000240), 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0xfff1, &(0x7f0000004640)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000040000000160a01020000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000648000000160a01010000000000000000010000000900020010000000000000000900010073797a30000000001c0003"], 0xd0}}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x9, 0x0, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0xa], 0x10000, 0x202}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x378, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x36, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x200400, 0x0) fchdir(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) 2.380740532s ago: executing program 5 (id=1411): r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) readv(r0, &(0x7f0000001f40)=[{0x0}, {&(0x7f00000004c0)=""/36, 0x24}, {&(0x7f0000000540)=""/35, 0x23}, {0x0, 0x2400}, {0x0}], 0x5) syz_usb_connect(0x5, 0x35, &(0x7f0000000b00)=ANY=[@ANYRES8=r0], 0x0) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f00000000c0)={[0xf, 0x8, 0x9, 0x7, 0x20200, 0x5, 0x0, 0x40, 0xfffffffffffffffb, 0x1, 0x9, 0x6, 0xfffffffffffffff8, 0x0, 0x7, 0x9], 0x26000, 0x4000}) 1.515091536s ago: executing program 1 (id=1412): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000180), 0x2, 0x0) write$cgroup_type(r2, &(0x7f00000001c0), 0x9) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000010000100ab5a0000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4024}, 0x4000010) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) r4 = dup(r1) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060"], 0xffe) 1.490170774s ago: executing program 3 (id=1413): ioctl$DRM_IOCTL_SET_UNIQUE(0xffffffffffffffff, 0x40106410, &(0x7f0000000040)={0x34, &(0x7f0000000000)="672c998ae2a5a4d08a7ecbd6e027bdd0b59faa20300066e80764d77e8c8169ce3206e1a6f715aa45a499a46d44a6b956825fade4"}) r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$NILFS_IOCTL_GET_BDESCS(r0, 0xc0186e87, &(0x7f0000000180)={&(0x7f0000000080)=[{0x9, 0x2, 0xfffffffffffffffb, 0x8, 0xa0e}, {0x7, 0x9, 0x0, 0x10001, 0x7f}, {0xff, 0x80, 0x1, 0x1, 0x4}, {0x7, 0x9, 0x8, 0x8, 0x5}, {0xb, 0x7ff, 0x0, 0x0, 0x2}], 0x5, 0x28, 0x40}) r1 = socket$inet6(0xa, 0x6, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x39, &(0x7f00000001c0)=""/211, &(0x7f00000002c0)=0xd3) r2 = open(&(0x7f0000000300)='./file0\x00', 0x800, 0x80) ioctl$VHOST_VDPA_SET_STATUS(r2, 0x4001af72, &(0x7f0000000340)=0x5) ioctl$XFS_IOC_ERROR_CLEARALL(r2, 0x40085875) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000380), 0x40000, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$XFS_IOC_FSCOUNTS(r3, 0x80205871, &(0x7f0000000440)) readahead(r1, 0x5, 0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000480)={0x0, 0x0, {0x0, @usage, 0x0}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000880)={r4, 0x80000000, 0x3}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000e00)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000cc0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELFLOWTABLE={0x1c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELOBJ={0xa0, 0x14, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x5}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_USERDATA={0x49, 0x8, "3946f23976c4a20a5e97d144baf76b289a4a741d9cf4cbd07c6e5651674f505d506fd788a50fc57f49b71bc8fdb599366681bc96d029ae6210d8e66ca2cd44d94c9f44d9ad"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xe4}, 0x1, 0x0, 0x0, 0x840}, 0x4040090) ioctl$VHOST_SET_LOG_BASE(r2, 0x4008af04, &(0x7f0000000e80)=&(0x7f0000000e40)) getpeername$inet6(r2, &(0x7f0000000ec0)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000f00)=0x1c) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r2, 0xc06c4124, &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000fc0)={{0x8, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e24, 0x3, 'wrr\x00', 0x17, 0x4, 0x2e}, {@private=0xa010101, 0x4e22, 0x4, 0xfffffff7, 0x8, 0x7}}, 0x44) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001080), r2) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f0000001280)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001240)={&(0x7f00000010c0)={0x14c, r5, 0x10, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x65}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x68b}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x10000}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6}]}, @IPVS_CMD_ATTR_SERVICE={0x60, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x8}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x2}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x67}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2b}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffeffff}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x100}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}]}, 0x14c}, 0x1, 0x0, 0x0, 0x4010}, 0x4000001) r6 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r6, &(0x7f0000001700)={&(0x7f00000012c0)=@llc={0x1a, 0x303, 0x80, 0x5, 0xd, 0x6, @broadcast}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001340)="f5ad4230e90f136e60edf8390fdbbcbe2ccd71177999c33e8f5839d7d63f217488c3888322", 0x25}, {&(0x7f0000001380)="53890b3e1a9eb07aafc6a323a3e903c7e63a221efa32a5a666cea25fd254df6af47cb73014bac8cdf7fb04232ae96a911f8dc3e5314219c5753530549f786290e7b3d255ab045aa05df1764b7b22725175d99e2b3b5874d1548b2c34898a4314b147d03e5b246424df7d2aa5aca7b8cf8e2684ad68de6f96b6a6a1cc8691e59f30dabfe3ede39364aaca", 0x8a}, {&(0x7f0000001440)="22462435b862b99e94902f3c67fd498a77d3e174f217d7fc3c657f1b1b062bf1138d13b90af4cd08e30b4c642b6c4d636b0531f0924093ea3252133e4b79a6198d922c762c56d272e6336193889689985fb43bd4afcfab0af8126ebdef2a4a12f682e0d5048f6a4e4bf44bb06e0eb3147abda0c26bd064c5b34354522ba4237b22295c57f3fb69a9feb40e875febd0", 0x8f}, {&(0x7f0000001500)="2de16c1b921e7c03464394c2aff04e59fa8e8eff99982b956b5d2b29", 0x1c}, {&(0x7f0000001540)="2c65b574aa5736670e6b55dac1c70d078ce4427a8d624e2eee1260ff45d724f2a2506e5e0ab51fece336216e379de7afe552cbe9dca736b021877e0fb9397fc3d3c602cc2b50b8fc82ccb42e30bb36f0bb21c7862bebf406fd5100e038d972f1662b48b66ada718e6fa1b740ca2253457fc116d11bb790c3fbde0ac72d86d4fd4e49019588f2e1d728bc7064be1105d3b624c698d9c2", 0x96}], 0x5, &(0x7f0000001680)=[{0x30, 0x107, 0x9, "1b3a2a50ab16b5cc95a6891ec2a714218df5638f02a917f82512"}, {0x38, 0x84, 0x400, "52b34fc1c56af77e00c8654a69b2ee66260abbce94130c5b962e0a7d20f227362e76fb18bb40"}], 0x68}, 0x8800) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000001740)={0x0, 0xc0, "28ba898a907c05e7c5934904c4cd09f1c619d9ce8319f062ff7e19828233e423e955f354c5b15d92d2c1f802e583cf349980a2d59adcd7f04ea75a43762bb4fce542dc05e7e2a633e65fc32de37553ad975a3108e71076dbf4e7da5c346dda2e8cccdc6f8542f0d1516ede63113144a2eb72e7ff857bc6a640f6c095f34d372afa31cf447cd4d8bfe1db521dcade3001f1a31c063964f1a0f481c433fe510469421896e60dac7f5ac2fb8a7d1f9c25316f286e9308f8359b0501a4728361e821"}, &(0x7f0000001840)=0xc8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000001880)={r7, 0x6}, &(0x7f00000018c0)=0x8) ioctl$KVM_RUN(r2, 0xae80, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000001900), &(0x7f0000001940)=0x30) writev(r6, &(0x7f0000002d80)=[{&(0x7f0000001980)="278e531134dbac2ec2d301d807b0a4ead369b862a6b50e2ffdc4d5a702dc569bf5a6239b81eb0cd6dec773be574bc0a768ce1cb21cf76adc44ac0b547b504f0a67fe1de8c4a13d16d2c4ac90d7c17dc31d62fd2b05de60075a884e50a69e35b13a0f9c0192161c813264815d0393e9261ae48f4627fd7b66ea156eec9d0252cfa99bd5fbed541d230d93cd68345e0c396e2b716fcda391", 0x97}, {&(0x7f0000001a40)="ccbf2990257a85ae5746672e829293e7ec327680b2baed22f0f5b59bd28c8c61852501b78c192b6e008e56827f6cef3c31a1f8e794ee076ccba4c6b1d01d0c1a8b15f5bb3053ecfeae2d9b1dda555f5d95a273c3090093e1341af285850184fb7584dc7f1cfd7036eea8c680ba54e9f20ded4e9be04dfc71f806ff9a02b6ea916714e46247d2f45189aa89dce4852a167f154a3418587bdb8a7e3523e5005ca27332c31405a82e30de910706b9a4ab87502e38500b0dfab37eb540a1376df42fa833d86aa1ea11d609fe2aae7d39", 0xce}, {&(0x7f0000001b40)="0e786028c041b71484c626602145006d72231c6cb8a934d5f145a516fee81efa92d5f2f5a6955af868cdaf4c1f0890630201b501e1d44a0261bd74fed46dcc82c9a46c6d2b6167548a2cc6f2af76083b9acad1b1bba2fd98cbe99c762ec1f93bb4b1ce94fb9e6e5fd2dfc560e27d2180d48d", 0x72}, {&(0x7f0000001bc0)="74823272e4bc7266105952b50f278a75d0c1d66d0e7670f7203e8e979417df0f39f8d2d40f744ab800d500dec7f416030a1db5486bc20b387485173e5d770a7355f5a7940b013f743a4b7989b91e340a56d24190cf13a69b91afc79b0a293a042907cb66ec3e83ce202c791673a7a5c520204639f9a7a1eaeb2fde6d0dbde7339c4ec4b390eccffa40f507afe37c547554ca38", 0x93}, {&(0x7f0000001c80)="dd7afde12575ebcefc1d676452966fd2fc3ee8b9bfc5bee4c4d586c5e7f1e9b0815babf47275e224fd5ca4b242bd0a0bc61ee3b4203ac37e781e44d17508401e7c585dbc1d2867da1da83afe69e7a149482413f8653e2db3f7cca03144bfc9650361442fe5d9b6039e3d9774694d26fde86d764b89b5329aa53cbfe6f2001676b31234dd197b4635a1102327073d9c910903df0d70041746d1cc3129ed8870e200d61986fa0296530d41710bab0ccaea2efa75a5271025f16611df21996d46db1e4b8fc5606f45ea7121080500ddadaa6905f927513b5e1329cde55d21bdec724008ca95b055968fa416fb0ec80dbab4fb8addf81c2d09ee0ae4a59554c44d92a3b98ba709ec122a4f49c6de74c28c97be08917df76fa9042678f8f2e388ba54d258e15ceb82d9c38df3056556eef8a3552de2fb23abc6ee32f7102368825e4178ba4e8ce7f9a564698af54dcfa0b6bd5788d6cfca95898f9b5e604f822f0d016b8e25816a895b9a6ca00075238a65df64ec7f3fc2bbcbacaa339890dd36fc731cf0fed94e8a6a337b7986c248b074144b21dfb6a6bee7b360037878b233048e40800c1aa73ad6c90274cacaf5d725e711c2cf553aacd12b4facafd1dd8bd12acdac1cf57ab57bf484db9412937e2ab8412fa5e27b7096cf5f41e2df730f541da2894387bee5523d2362c5b8323131362b40ddca74784aac93af34b15734cfc5ed7010f4367aa4146160d94c295fc58c07dd050531c30a4635a61b086e44d5333350b759180298e309507fc459d0c63d23f2845b735e297f89ae134c9e5096998e405cc1693168ad21cf45d5d6f86f2e3cb8b0563ccb75f9dabd542dfe82d994385569fb44b66486ad03c3b2e5f1010a405347e446286e206ff366e7670c3be73b10e1f2b4a4e0c9094fe6da4ee741c29200a51e141109e252bf4afcca89cef06da8ddfcdf0e99055c9b01e260537d4db354787259d4eecd95a2a50f8abe3d284856f2b52ef1b06f69e720191e0488ba9843f7a5aaad4f203044c18612a9f4decb760cbe5dc1a638e08369e91d0fa05e218197b48bd62c240a558cb341a314320c44c7d8cd0bcc57ee05bbe0bd211efdc0621538055c6b0b25408173b96f3be4d896a3667476ad7c673dac1be51cef3e382c7709947616c2b0efaea18145430745ed8835b10aeece9584bddc59580592246b3879ee721f7292c6649a99248b12e8c760b9424ef5c542a19bc9f08a1a979dc9d2616aeebb8bfea6f5a73ba046d46321b0326720ecfc147558bdd660b090141d0b049d7a9212c019734e5dac29b97de08d8c17b976726d470d199c814626784378a892699e3463bceb83116d55e8dbd8d5e3fcb56e5b6e9518c899f09ea114c895b470fa9d5aa20177fe501b77a5aa961d463015e1cb99b706093687bd4000aa2cb37d4575073b59fb1c1c229ee1de2d9c3eef629f2f98d420828a668a25f4dc9a01859e361b049ed6986b8f4cecaadc5890ed8050f0e6ba5314f2e4287c137d781fd60b460dbe491d1f2a3a3991c87cb336efe7b3392576a8e0d2b37b6e4723b8fdaefbb7817ec9351410291df20234606ff3938680d26b128ef95eb193f0edcd917c4d942a6c5ea90a0dc5be4de85423ea6303d1c5db7d6a4e7802dd69c7e87d2490909f75aa27c2f60d6cf93ed071de75350528b3e106ee4946cddb65722d36c9578db25030c2750b9c76167f7be23ebd5ff6ef4c37276fd1751378953c23bd1c0c6ad5de4ed57d7fd5d4d7d9b2f5ba4a5850c3a6aa88dcc5e691dd09a64fb5315739f8338be4b3d09205782be9dda70cc2164ad1a23c3b5b6f9a6f513557a0f613dd2f34d23ee4ab41c88ed37ce691c8f3350da00225b8f59cf449e530a281033d3ca18134a74166bee6c2f3f2203cd6e17c43279027323a2fcb985b135f303f0c1c0cbd8fb12ae983e6e588b30efc85087a53a58639a9f3362f26dd55186c65cb5f9facc153dfccfe34428929945341072ac9fc68187a8f26fc04f67a5f5eb86079c582b4891fec94bb092357501e2e2e7e5f35fa68041b4e13fe1daa09ebcde85478ba7a46a0876ed2e0c42dd2e679174d53f5f1cc8b6596b70db3494d44a9ac1b82eef22dcfaa71bce8dcb7ec55243cf966ea53a69253e08665ecf7bef958c4eb6384c01dd63a720f4b5bea33dccdeacdac657a99fe5052d92bf16e61863975604bae8e8dc04dc9c4824b2a0b3b9cab82389ecaea077d9be069a29b119a02c39190b0a17a2308101499f47c4de8b2181e073b383ab178ed7c27c29d1fd4ba1c57847e808c434f5dceac7789af9e1fa1ac4ba492af34b44f0e0cd9654d1082243f9657445dd21583831bd0baada859e61b4f85671568d1b026b15607a2b42a4d4e3787458637a5c9608ecc722d964d9f14b3eaf95c6af19f102951470f4dcc29e500deff307d15446b0501510b78df616fd54b268cd49ae61f65d1b2fa6363c6ac78bf549bd6992b5405f6076c38a7ac7de05e6c5d7c47ac4e26afc43411e6b5db6f1112159ca0c0d9c5355ed6332f5ded9f448baf671d074e75be8820fc345b9d1edd27f0a49ac66859a7d3ad1fe63064ac82d6fd5f3660425abe6ee727470781618773486adc5272b91c98555bf35286383b387d400a99ee1e3f44317e3fec1052931fec0b447d65a710a0442b96d0672927bbbce8b3e9cc20e2ce29a5b2fdd1e11de3775b757cdee188bff71604b731df987cfc536e09cd684b733cb0e696879c832da87b27b87219a476447995a79075c8af78c1677062bba12ba26da369abd2429c2346eed88499dc60439556477c8b8717a924b3446b495b19be70433e001c969f0559d2cf29a98f66063c6b8e90a8e1d7cf2afd952f4b7f5565249821720094e88b4a1003b6727d00e3623f651411697a1631ebb3bef76f3f49a31b84d6a7198b2c36d5efe812a3906f9a1382ae9310a9b3553b51d41ba2f51756cb01b2539fb0a6a7d0f2481e11abc40c63406d6bb52d059b4a63b75fb1da92ae20deb50af8580fb8b21ae549087221ff690d9976cc2c1d3c5d1ea9561671277ea1f61b16b7b47c0ab2786c184aed0ac651353670ac08eaf4f655e6817c9a5af9d99548e28113a0046483a3c2e4995beec9059dc2d5bddf2168a3df35b7c44afe95ec2b0ff655f3c81e351dd94551c9c20f50b55065f2d0d896fce55efe2a71c5b996ddd4cfe4e9bea736603c0409c217575f8d8583ac07d609f8817fb0311a3089b9c618ee670f74f45d24fbbdadecb3c4add45cf9f1527ce9202c07b98d4eb08c2565f2109af72b7657b9c0497ab728058a5921cea65fc61df555b9c49df4d361bffa6ee8ab804c809057ca230f2dbf0249e111bffd2cee541f19f8e246bcaac13fb07f7dcbcaa65c2428edbd870dc10c0d7dfa96a7bf2cc0008fa4d2296f555a072c769dbdd1b803c677502ac3910dae05a39eecb414b26af4d22a86321451cdd396bde3f472c747690f0219d2f54d4c60ce831aff53aa9e53a2e20616189adad95731e2c1c8239ece4aefd6fbefe0cffd1552cab33da7b2eb5500a86ff67cbfe131d333dc4e465474dd6e1ef540757deb767650cc3858c8759facaf40b9a8aedefb10b32c272e8f7c1225f6f5abb0d7192f8fc8662977e55719c527601a901d707f17f91d3841556db90967fd23a4f709b0ec0ab9beab70e2a014d907ebfb6705a6f0c0d3ff3296469ee41fcad96061f167dc46b7d57ee2b0dbd6208934c5e0754a76f94a473cf10a9196f8c5a9fc0fd65019f994fcb5591b1b982d072b2845e2b59685c2de951ca812323441c382d8099a3c2050120c0ad7e2194542195d0f6159434e925ce4a5b312e4d64b3e78923b3e4bebe990bd2affc8c1dcab80162b016bc6dc29b705c4849daa55271581a8734f245d00fe264148256061fd7a90d7ea13cd0747bdf01f1e03a0edb33548b1f551dddb1ed0449b3bf55a0878ef1a0bc6cdf789f0d09cdc6b3783450b2f82ad4ba1d1ce924d90d26eb1c9ea40f4419c032825e4bc2f47ad03315f16f1222ae0d2c1e40ac9f5ce3d3bccb733d8c3dd3bd5dd80d1f37766e1d01fa51d9c1f425af48b2a9cc8aa082b17c54f1639fa631a280a5543552bcadc06ab99830d3df873b4d144674cc7305c1e114b244676362175c860b4f1bf730c13db6413e43031b39e04833de589fb8a7161d6d029142442d27883e7a19d939d61a2052973011ca7f07218407a80b003beabf52a93f5ffb842babc16b58fece153ed8649ea6d8c23a8fc016e9b56770653286fd4c47d7089d4eaede12eb802ecb8985024f20b28967b8900811bfa27e4f2498ad30204021b47b234d24ee518aeab3e0f2cfec53b7ad949e8f7dc9a6eef7e4e3e995da6095c057d839396b5eb5e1c5d88c5da21c33eb256f3d82263e1320303dace0d6de10b12a6f5c058104a421ba9eaad744e41c9b14b2e4c0a4c3fdc817ccee5d745cd2156053e56c3f739843d3dbb44c1e9d27d49b7d3bc6ccd1121f5cbd2fa9e9d5a68f2ccca619f8d1d9e1627794848eb6d3fd262d319729c2f55ad27b56cfee09736598fc4563c181f42285680a1aa8a7616aaafbe3abd1f7f437937c28f5d38e291f1676c6288b772ba9455a4bbd48f05d6085cb450136be907fdeb1a8d7513b26fd83f82c34d31721f19865db09747557924100a3ef33bc3d9ced2de923d501a89f0bed792deffa0dbf7d620d5117b963d5a939d1d620b1017776c1bbaad14f13de5a02512aee25ef38c28a365afdf4e7dab29da8391bdf734847dbf853f6af9ae51805d3b9512820036a3f18d03551ed75cef8213919cab863875b2629d8e5a0796a9d51e1da628aa1304c2d9145af319c327d3d0a354c9a8360627fc380286d6a56f9c8febb47a145254e1c41dc87e2d29d7d694566ecb586bce5b520c2526421d5334c791d97e00745245518c413a8cc2832b8d0145433607786cba9c0da49e21fff3146687fb85ef13bbcfcc56ab976335ceb929b91390ccdf7aeb310ab17a9f6910a5108777fce262feffbda6c651735b7c674c48bbe481f05686c5bc8928f1a7f7acdb87d8247cd4fb51945af70bfc08ff52138e035e86ed01b3cb1133d9f817aa53ad4eed6304fdb505283a389a39e60fc16826e9b21bfcfd68e31f682367990a083c94a9b0ccd4a1b2916801743751017935bdf77449c176f3910571658991c2d0f8aa4a57c447a2b128d90934507fa0b2b98c96a6f8519e20801eb7f89647ba6a868fb2e606becc011efc41392c9947bef2cde77d182c22ef31ffd490d31f982ea4a1b0e602557cd0a04deed88e4b9f3e13d1b5ff7d43381d965963919100daef853bc98073c3bc2ea46e8aee56f4bc5fe177a9f150c20e596d27be9e632e976e47475829b84528c2d69f4983dc7283834240dc252497cefddf54dd20e038b2b9806b8be43b019101113bd333d7b0e1b5cb5acb525c3e64598a76ebe872696b8809864997b42ba8d542d0e73c35ad67bebe9656ea4e1f8a2a19daa911d9bbaa5cf2db46023978ac95af38988d3372d7fe44ff6e7882ab67df02acf2f1330ee4df79d598ee4b6997886f2843cbf927ae24dc09c1c2c3e0024fc61916eed576914f95187f23cf9cb74d00ce9c632170ca4c277dc33764c5440b6c17aa92b989d5dcd175cd1d2009b926454fd63080553229ca5027e85cb5b7195ffb548581636abde43c7cc904401d4d78897326b865d17d434fe300879bc0f5312a44305df283a8145b8cfb4632862b22eb54e87539c3eddd129fc3f7139734e7fde167d61039155dc041517869e95b", 0x1000}, {&(0x7f0000002c80)="9fa30cc6b4fec3a2925ca7bc2d0eb5daf433cac4473cc7dfbb65180e30af360d4f1e412295411c1615772e16dae0f34a86a5465378453592384c4c1e48d0df2c1c6d5623f6a5adc0c7f290ff725139618a342b1eb2851d24ea4d7efdfb3af9b7eefa3260f86e7c341fdc4d1c6299a3013ce2a37a5c73c96cc6bf79e62a89ffb350d5e437fa767eca9a1fcc059a6c69f104fc2b7907e0d12d900b0677d6736e8ce1e4bb030b9ac8e917de97fd4b2cb6b560c142262bd315a8eb30fe67dff26830a504221623497be2751aa2609d6c2f810a6d73d0570df635e9bf539cdef1726471", 0xe1}], 0x6) eventfd(0x3) 1.388686674s ago: executing program 0 (id=1414): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8001, 0x0, 0x9, 0x4f, 0x8, 0xfa11, 0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYRES32=r2], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) mknod$loop(&(0x7f00000190c0)='./file0\x00', 0xfff, 0x0) execve(&(0x7f0000019100)='./file0\x00', 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002f00)='fdinfo\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') r5 = socket$packet(0x11, 0x3, 0x300) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000004c0)={r5, r4, 0x9, 0x0, @val=@netkit={@void, @value=r4}}, 0x1c) setsockopt$packet_int(r5, 0x107, 0x3, 0x0, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) getpid() syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x859, 0x5, 0x32c}, 0x0, &(0x7f00000000c0), &(0x7f0000000000)) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x6, 0x0, 0x0, "5debca561a5fbf61048955f6f876b2ff"}) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000800)={r6, r6, r6}, 0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={'sha384\x00'}}) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7b13000000000000200012800b00010067656e657665000010000280060005004e2000000400060008000a00b5"], 0x48}}, 0x4000) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)={0x14, 0x0, 0x1, 0x170bd25, 0x25dfdbfc, {0x39}}, 0x14}, 0x1, 0x0, 0x0, 0x448c9}, 0x4004810) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x138, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x2}, [@CTA_EXPECT_NAT={0xa0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x7c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x84, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @private1}}}]}, @CTA_EXPECT_NAT_TUPLE={0x40, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) 471.171113ms ago: executing program 2 (id=1415): unshare(0x20000400) capset(&(0x7f0000000c00)={0x20080522}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x101, 0xffffffff}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, 0x0, 0x0) 333.942686ms ago: executing program 1 (id=1416): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fee000/0x3000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0xd9d, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x17, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8001}, 0x94) clock_adjtime(0x17, &(0x7f0000000000)={0xea30, 0x9, 0x4000379ee6, 0x0, 0x9, 0x7ff, 0x8a, 0x3, 0x100000000000006, 0x82, 0x3, 0x40000000000004, 0x9, 0x80000000000005, 0x8001, 0xffffffffffffffff, 0x800002, 0x2, 0x9, 0x7, 0x200, 0x3, 0x11cb, 0x4, 0xd, 0x9}) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000400)=[@in={0x2, 0x4e24, @local}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f00000003c0)=0x10) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x89f1, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000140)=@ethtool_cmd={0x9, 0x0, 0x25f9, 0x0, 0x0, 0x0, 0x7, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45}}) openat$vimc0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) clock_gettime(0x7, &(0x7f0000000100)) preadv2(0xffffffffffffffff, 0x0, 0x0, 0xfffffff9, 0x1000, 0x6) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000ac0)='numa_maps\x00') bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b80)={{0x1}, &(0x7f0000000b00), &(0x7f0000000700)=r3}, 0x20) r7 = syz_open_procfs(0x0, &(0x7f00000005c0)='net/vlan/config\x00') ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r7, 0x541b, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c00)={0x6, 0x19, &(0x7f0000000780)=ANY=[], &(0x7f00000006c0)='syzkaller\x00', 0xfffffff3, 0x0, 0x0, 0x40f00, 0x3a, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000a40)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000a80)={0x2, 0xc, 0x4, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000bc0)}, 0x89) ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000440)={0x0, 0xe, 0x4, 0x4000, 0x80000001, {0x77359400}, {0x1, 0x1, 0x9, 0x1, 0x1, 0x34, "21db7776"}, 0x5, 0x4, {}, 0xb, 0x0, r7}) r8 = openat$cgroup_ro(r6, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r8, 0x0) preadv(r8, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0xbd, 0x0, 0x8, 0x2, 0x2, '\x00', 0x657}) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) 186.142051ms ago: executing program 2 (id=1417): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000180)={{0x10, 0x8}, {0x4, 0x9}, 0x200, 0x2, 0x10}) write$dsp(0xffffffffffffffff, &(0x7f0000000400)="e3571b9ac1d372d0d15928bd4c575c868bcb1bb43db1e04c33bc9009486301e229008460915efa87a5521d9352f4c6a1cbc7d633ff53755cae0727a11fde5fd25825cae5c492b00eeef35f480c8d55626661a3c6cff9053dfc55840c38b5654a1b81d11f0a4699c9de019bf86a7f3f4e64be143c18cd6879e39ea69734729d11e35d5c2e2a84f54ebe83e695c831aac9ea1e0a05b2ecb3c1ea28f31cdb48769fbbd9301632471b736bd4d6fc3bdb5c9852d98246decfa985dbcb1334eb8b2b579f7a8e5758f9c648ff4baaad5063effe63f5f7126eeacad8ce55bae622efe5bc22f3f208fd79a1f9da0c494af56120d1e07b07e0878d4851f0b201db7ed44ddc0158671a905e38635165f99089519700d837f593599de32565ed19ab9fe8acd3891da424", 0x124) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020200090d0000000000000000000000030006000000000002000000ac1414bb000000000000000002000100000000000000000200000000030005000000000002000000ac1414aa0000000000000000010015fb0000000001001400000000000100"], 0x68}, 0x1, 0x7}, 0x0) 117.026773ms ago: executing program 3 (id=1418): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000140)={0x2, @win={{0x7, 0x1, 0x7, 0x7}, 0x0, 0xfffffffc, &(0x7f00000003c0)={{0x4, 0x9, 0x5, 0x80000001}, &(0x7f0000000380)={{0x3, 0x0, 0x7, 0x6}, &(0x7f0000000340)={{0x7fff, 0x7f, 0xa22b, 0xfff}, &(0x7f0000000300)={{0x5, 0xbb6e, 0xffffffff, 0x80000001}}}}}, 0x2, &(0x7f0000000480)="6dc2ef8997028d2523d4b5df62671aa7272252bb6869547d3acf9b48d3ccb783197bde58be0e59df116375751d8a7324ccde4b7e9372cc7d37b74b3e166270fb15d97d0bf86930467352b642c409bf9dde775028b26a59f7250ea2c6a37a96a6a9faac473882609a07a7f8e2c5a31abf1e4031608643d6215be3bf327a2be32a9dd710f5fbd72b", 0xff}}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="2e010000ed454210cd0c99009bf4000203010902120001000000000904"], 0x0) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = gettid() kcmp$KCMP_EPOLL_TFD(0x0, r4, 0x7, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[]) r5 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="79000000000000000000edffffff000000"], 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f7", 0x1}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0x40800) 0s ago: executing program 2 (id=1419): socket$xdp(0x2c, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8001, 0x0, 0x9, 0x0, 0x3, 0xfa11, 0xffffffff}, 0x0) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e23, 0xffffffb9, @private0, 0x2}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000140)=[{&(0x7f00000000c0)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050c100000000000224e0000", 0x58}], 0x1) r4 = memfd_create(&(0x7f00000008c0)='[\v\xdbA\xae[5\xa9\x90\xffc\x1f\x1a\xa9\x16\xfa\xadR\x10\xf3\xb6\xffT\x02\xd1\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9e,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xef\xa2\x82\x1e\x03\x00(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89c\xda\xa9\x83r\xd8\x98\x00\xff\xf5\x95\xd2q#\xc6\xca\x97\x9dM\xe2[\xd0YF\xf8\xb2\xa5\x1c\x00\x89\xeb]\xa3\xfd\xd8\xec\xbd\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xe3\x00\x00\x80\xb5\xa8{K\xfd\xeb\x16:\xfe\xafk\xb4\xd04(\xae\x0e\xd1a\xacV\xdd\xd5\x86\x82\xb0X2\x85j4g\xa5~\xe9\xdd=\\w\x91b\x87#\xdesgF\x86\xa8d\xec\xa1\xe8\x1cL\x8a\x03\x84+\x92\x88]s\b1\xa7( )?2\x11|\xce\x06c\xeb`\x8b\xdb\xa1<\x11\xbdq\b1\f\xbcd\xf3E\xd0\xc1g\x96\x16\xd2t\xce\x00\x00\x00\x00\x00\x00', 0x2) write$binfmt_script(r4, &(0x7f00000009c0)={'#! ', './file0', [{0x20, '0|\xee\xdcCh\x1e\x88\nk\xa8\xdf\x89{\xaf\x12B\xfa\x1a:/Fi\x83\xb2\x95\xbb\x02&x!\xf0q\xaa\x02\xaf\x8c\xb4\x90\xf5\xd4\x9b\xfa\x83\x9f\xd5\xe66\xdc\xbb\n'}, {0x20, 'x#L;\xf6\xbf\xba'}, {0x20, '\xcb}`\xc8l)P\x8f\xacq\x9b\xd9\xad\xf3u[\x8c\x13}\xfd#\xda\x927\xe5Q\xb6\xfa\xceg\xab\xf7v\x01\xe0m\xa3\x86%\x02bo\x12\xcd\x7f\a\xd2\xa0\xe4\xa3\xbb\xc15l\xc7\xb9\xdbg\x94\xf8\x18\"q\x97\xf4\xca\x12<\x8c\xa0\xcc\xc5%\xf7\x86\xfc\xdd\xc2\x11\xf8s\xe1?\x8c\xd7\xa1\x10\xcd\xaba.\xab\xe0z\xc9\xff\xff\xff\xff\xd0\xed\xfc\xa45 \xf4<\xbay:\xf5\x00\x02\x82\xdd,\xcf\x7f7\xce\x17\xab\xdf\xe0+\\\xe4y\x9bzB\xd4\xb3\x11X\xc8\x96\xe5Q5\x90_\xf6\x80\xc4\xca\x8aw;\xaa\xd0\xaa\xc9\xbd\x7f\xe0yY\x85\xf0\x86\xb0\xd7\n\xbd\x18\b\xa5\xe7\x01\xd1\xa7\xeb~\x94\xa6\x12)9<\xf4\xd1\xcci\xd9\xac\xb71)\xd8z\a\b\x8e(\xb1\xe0XN\x00\x00\xbfo\x85\xa9\xc4\xf0Pb\xef\x1b\x9a\xae\x86\xc8\x1f\xc4;5o\xaf 5~\xa9\xb1i7\x90\xc1\x89\xb8\x8638\x80\t\\\xd9\x9c\x05\xb7)\xf7Q8\xe6i\x16S7\xbbl7\xf2=\xe7\x1ar\xa9\x81\x0e\x1d\xb4\xbaA\xe4\xaa\x16\'\x1av\f8\xda\xda\xbc\xa7\x19`\x86\xc4\xb4y\xec\xfb\xa6\xbe\x9ai\xa5\xfa\x96\xd0\xd2'}, {0x20, '\x00'}]}, 0x171) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file7\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000id=\x00'/41, @ANYRESDEC=0x0, @ANYRES8, @ANYRESDEC=0x0], 0x3e, 0x0, 0x0) kernel console output (not intermixed with test programs): usb 4-1: Service connection timeout for: 256 [ 424.748020][ T5937] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 424.770035][ T5937] ath9k_htc: Failed to initialize the device [ 424.804786][ T5224] usb 4-1: ath9k_htc: USB layer deinitialized [ 425.059870][ T24] mcp2221 0003:04D8:00DD.0011: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 425.251313][ T5937] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 425.273241][ T9652] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1030'. [ 425.328573][ T9652] ip6gre3: entered promiscuous mode [ 425.353137][ T9652] ip6gre3: entered allmulticast mode [ 425.421289][ T5937] usb 4-1: Using ep0 maxpacket: 32 [ 425.443722][ T5937] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 425.480272][ T5937] usb 4-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 425.502478][ T5937] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.526317][ T5937] usb 4-1: Product: syz [ 425.534845][ T5937] usb 4-1: Manufacturer: syz [ 425.539620][ T5937] usb 4-1: SerialNumber: syz [ 425.559994][ T5937] snd-ua101 4-1:1.1: sample format descriptor not found [ 425.567920][ T5937] snd-ua101 4-1:1.0: invalid num_altsetting [ 425.645562][ T9655] openvswitch: netlink: IPv4 tun info is not correct [ 426.312209][ T24] usb 2-1: reset high-speed USB device number 47 using dummy_hcd [ 427.294902][ T9668] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 427.761557][ T797] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 427.887452][ T29] usb 2-1: USB disconnect, device number 47 [ 427.940633][ T797] usb 1-1: Using ep0 maxpacket: 8 [ 427.950514][ T797] usb 1-1: config 2 has an invalid interface number: 144 but max is 0 [ 427.972924][ T797] usb 1-1: config 2 has no interface number 0 [ 427.979446][ T797] usb 1-1: config 2 interface 144 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 427.996790][ T797] usb 1-1: config 2 interface 144 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 428.075957][ T797] usb 1-1: config 2 interface 144 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 428.104606][ T797] usb 1-1: config 2 interface 144 altsetting 255 endpoint 0x5 has invalid maxpacket 1023, setting to 64 [ 428.131701][ T797] usb 1-1: config 2 interface 144 altsetting 255 has a duplicate endpoint with address 0x7, skipping [ 428.145239][ T24] usb 4-1: USB disconnect, device number 50 [ 428.208681][ T797] usb 1-1: config 2 interface 144 altsetting 255 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 428.261978][ T5915] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 428.269638][ T797] usb 1-1: config 2 interface 144 has no altsetting 0 [ 428.300271][ T797] usb 1-1: New USB device found, idVendor=0b95, idProduct=2791, bcdDevice=83.2e [ 428.309627][ T797] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.340058][ T797] usb 1-1: Product: syz [ 428.351454][ T797] usb 1-1: Manufacturer: syz [ 428.356478][ T797] usb 1-1: SerialNumber: syz [ 428.419080][ T9670] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 428.451237][ T5915] usb 5-1: Using ep0 maxpacket: 32 [ 428.463517][ T5915] usb 5-1: too many configurations: 17, using maximum allowed: 8 [ 428.518745][ T5915] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 428.537236][ T5915] usb 5-1: config 0 has no interface number 0 [ 428.553654][ T5915] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 1024 [ 428.608562][ T5915] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 428.634202][ T5915] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 428.648857][ T5915] usb 5-1: config 0 has no interface number 0 [ 428.659085][ T5915] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 1024 [ 428.683509][ T5915] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 428.698942][ T30] audit: type=1326 audit(1775675115.312:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9669 comm="syz.0.1035" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4e2ad9c819 code=0x0 [ 429.000052][ T5915] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 429.040494][ T5915] usb 5-1: config 0 has no interface number 0 [ 429.058049][ T5915] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 1024 [ 429.102421][ T5915] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 429.150344][ T5915] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 429.167623][ T797] usb 1-1: USB disconnect, device number 43 [ 429.175856][ T5915] usb 5-1: config 0 has no interface number 0 [ 429.204271][ T5915] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 1024 [ 429.251213][ T29] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 429.266390][ T5915] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 429.296599][ T5915] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 429.316709][ T9687] ip6tnl3: entered allmulticast mode [ 429.331891][ T5915] usb 5-1: config 0 has no interface number 0 [ 429.338418][ T5915] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 1024 [ 429.366974][ T1013] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 429.401208][ T5915] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 429.414146][ T1013] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 429.422238][ T5224] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 429.441279][ T29] usb 3-1: Using ep0 maxpacket: 8 [ 429.454354][ T29] usb 3-1: config 6 has an invalid interface number: 2 but max is 0 [ 429.463684][ T29] usb 3-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 429.475920][ T5915] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 429.492667][ T5915] usb 5-1: config 0 has no interface number 0 [ 429.500572][ T5915] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 1024 [ 429.521223][ T29] usb 3-1: config 6 has no interface number 0 [ 429.527515][ T29] usb 3-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 429.551546][ T5915] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 429.565770][ T5915] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 429.599388][ T29] usb 3-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 429.610454][ T5915] usb 5-1: config 0 has no interface number 0 [ 429.626228][ T29] usb 3-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 429.635044][ T5915] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 1024 [ 429.650077][ T29] usb 3-1: Product: syz [ 429.661237][ T5915] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 429.671523][ T29] usb 3-1: Manufacturer: syz [ 429.676277][ T29] usb 3-1: SerialNumber: syz [ 429.694661][ T5915] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 429.722021][ T29] hso 3-1:6.2: Failed to find INT IN ep [ 429.728379][ T5915] usb 5-1: config 0 has no interface number 0 [ 429.735765][ T9693] program syz.1.1041 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 429.745850][ T5915] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x82 has invalid maxpacket 4096, setting to 1024 [ 429.767552][ T5915] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 429.812556][ T5915] usb 5-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2 [ 429.853545][ T5915] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.871788][ T5915] usb 5-1: Product: syz [ 429.879041][ T5915] usb 5-1: Manufacturer: syz [ 429.891923][ T5915] usb 5-1: SerialNumber: syz [ 429.918252][ T5915] usb 5-1: config 0 descriptor?? [ 429.936246][ T9685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.954967][ T5915] etas_es58x 5-1:0.2: Starting syz syz (Serial Number syz) [ 429.964096][ T9685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.036078][ T797] usb 3-1: USB disconnect, device number 36 [ 430.109754][ T9704] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 430.122553][ T5224] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 430.161334][ T5937] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 430.175046][ T5915] etas_es58x 5-1:0.2: could not parse product info: '424242424242' [ 430.322567][ T5224] usb 4-1: Using ep0 maxpacket: 32 [ 430.333815][ T5937] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 430.346211][ T5937] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.356124][ T797] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 430.364760][ T5937] usb 1-1: Product: syz [ 430.372213][ T5224] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 430.391572][ T10] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 430.400811][ T797] usb 5-1: USB disconnect, device number 49 [ 430.408145][ T5937] usb 1-1: Manufacturer: syz [ 430.414160][ T5224] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 430.437408][ T5937] usb 1-1: SerialNumber: syz [ 430.445663][ T797] etas_es58x 5-1:0.2: Disconnecting syz syz [ 430.517747][ T5224] usb 4-1: string descriptor 0 read error: -22 [ 430.529318][ T5224] usb 4-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 430.559252][ T5224] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.580667][ T9696] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 430.621883][ T5224] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 430.629052][ T5224] usb 4-1: MIDIStreaming interface descriptor not found [ 430.884231][ T5937] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 430.937500][ T5937] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 430.965486][ T9698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.974971][ T9698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.983059][ T5937] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 431.031874][ T5937] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 431.096440][ T5937] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 431.102616][ T5915] usb 4-1: USB disconnect, device number 51 [ 431.167604][ T5937] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -32 [ 431.252819][ T9699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 431.287746][ T9719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 431.292422][ T9699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.394768][ T9719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.403220][ T5894] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 431.571229][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 431.582993][ T5894] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 431.614271][ T5894] usb 3-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 431.643666][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.689918][ T5894] usb 3-1: Product: syz [ 431.704181][ T5894] usb 3-1: Manufacturer: syz [ 431.727494][ T5894] usb 3-1: SerialNumber: syz [ 431.782423][ T5894] snd-ua101 3-1:1.1: sample format descriptor not found [ 431.813603][ T5894] snd-ua101 3-1:1.0: invalid num_altsetting [ 432.212894][ T5894] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 432.459157][ T797] usb 1-1: USB disconnect, device number 44 [ 432.463668][ T5894] usb 4-1: Using ep0 maxpacket: 16 [ 432.494441][ T5894] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.558985][ T5894] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 432.614827][ T9778] ip6tnl2: entered allmulticast mode [ 432.672452][ T5894] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 432.735001][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.807843][ T5894] usb 4-1: config 0 descriptor?? [ 433.001489][ T9794] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 433.095899][ T9734] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1049'. [ 433.373934][ T5894] usbhid 4-1:0.0: can't add hid device: -71 [ 433.393236][ T5894] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 433.461987][ T9762] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 433.472436][ T9762] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 433.541411][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 433.685267][ T29] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 433.726642][ T5894] usb 4-1: USB disconnect, device number 52 [ 434.053528][ T5894] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 434.113123][ T5894] usb 3-1: USB disconnect, device number 37 [ 434.581741][ T5894] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 435.091232][ T5224] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 435.291502][ T5224] usb 3-1: Using ep0 maxpacket: 8 [ 435.313091][ T5224] usb 3-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 435.331329][ T5224] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.376503][ T5224] usb 3-1: Product: syz [ 435.380768][ T5224] usb 3-1: Manufacturer: syz [ 435.391151][ T5224] usb 3-1: SerialNumber: syz [ 435.405426][ T5224] usb 3-1: config 0 descriptor?? [ 435.436476][ T5224] gspca_main: sq930x-2.14.0 probing 2770:930c [ 435.476228][ T9829] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 435.641449][ T797] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 435.801200][ T797] usb 1-1: Using ep0 maxpacket: 8 [ 435.812556][ T797] usb 1-1: config 2 has an invalid interface number: 180 but max is 0 [ 435.836729][ T797] usb 1-1: config 2 has an invalid interface number: 175 but max is 0 [ 435.854872][ T797] usb 1-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 435.864653][ T5937] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 435.883024][ T797] usb 1-1: config 2 has 2 interfaces, different from the descriptor's value: 1 [ 435.901167][ T797] usb 1-1: config 2 has no interface number 0 [ 435.926712][ T797] usb 1-1: config 2 has no interface number 1 [ 435.957992][ T797] usb 1-1: config 2 interface 180 altsetting 2 endpoint 0x5 has invalid maxpacket 1023, setting to 64 [ 436.008756][ T797] usb 1-1: config 2 interface 180 altsetting 2 bulk endpoint 0x3 has invalid maxpacket 64 [ 436.023233][ T797] usb 1-1: config 2 interface 180 altsetting 2 endpoint 0x8 has invalid maxpacket 1552, setting to 64 [ 436.055105][ T5937] usb 2-1: Using ep0 maxpacket: 8 [ 436.070333][ T797] usb 1-1: config 2 interface 180 altsetting 2 endpoint 0xB has invalid maxpacket 1064, setting to 64 [ 436.081534][ T5224] gspca_sq930x: reg_w 0305 fd00 failed -71 [ 436.093643][ T5937] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 436.111618][ T797] usb 1-1: config 2 interface 180 altsetting 2 has 4 endpoint descriptors, different from the interface descriptor's value: 12 [ 436.125819][ T5937] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 436.136419][ T5937] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 436.147132][ T797] usb 1-1: too many endpoints for config 2 interface 175 altsetting 248: 74, using maximum allowed: 30 [ 436.159011][ T5937] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 436.182464][ T5937] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 436.182491][ T5937] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.184786][ T797] usb 1-1: config 2 interface 175 altsetting 248 has a duplicate endpoint with address 0x8, skipping [ 436.184811][ T797] usb 1-1: config 2 interface 175 altsetting 248 has a duplicate endpoint with address 0x5, skipping [ 436.184830][ T797] usb 1-1: config 2 interface 175 altsetting 248 has a duplicate endpoint with address 0xA, skipping [ 436.184847][ T797] usb 1-1: config 2 interface 175 altsetting 248 has a duplicate endpoint with address 0x8, skipping [ 436.185484][ T797] usb 1-1: config 2 interface 175 altsetting 248 has a duplicate endpoint with address 0x6, skipping [ 436.186982][ T797] usb 1-1: config 2 interface 175 altsetting 248 has 8 endpoint descriptors, different from the interface descriptor's value: 74 [ 436.187007][ T797] usb 1-1: config 2 interface 180 has no altsetting 0 [ 436.187022][ T797] usb 1-1: config 2 interface 175 has no altsetting 0 [ 436.194422][ T797] usb 1-1: New USB device found, idVendor=1199, idProduct=0112, bcdDevice=d5.77 [ 436.194463][ T797] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.194486][ T797] usb 1-1: Product: syz [ 436.194503][ T797] usb 1-1: Manufacturer: syz [ 436.194520][ T797] usb 1-1: SerialNumber: syz [ 436.199149][ T9826] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 436.387644][ T5937] usb 2-1: GET_CAPABILITIES returned 0 [ 436.387726][ T5937] usbtmc 2-1:16.0: can't read capabilities [ 436.413786][ T797] sierra 1-1:2.180: Sierra USB modem converter detected [ 436.432930][ T797] usb 1-1: Sierra USB modem converter now attached to ttyUSB0 [ 436.443305][ T797] sierra 1-1:2.175: Sierra USB modem converter detected [ 436.446446][ T797] usb 1-1: Sierra USB modem converter now attached to ttyUSB1 [ 436.451232][ T797] usb 1-1: USB disconnect, device number 45 [ 436.456766][ T797] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 436.457370][ T797] sierra 1-1:2.180: device disconnected [ 436.473194][ T797] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 436.473817][ T797] sierra 1-1:2.175: device disconnected [ 436.591061][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 436.633676][ T9835] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1062'. [ 436.741431][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 436.947337][ T9835] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1062'. [ 437.002072][ T5224] gspca_sq930x: Unknown sensor [ 437.098013][ T3493] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.148231][ T5224] sq930x 3-1:0.0: probe with driver sq930x failed with error -22 [ 437.162182][ T5224] usb 3-1: USB disconnect, device number 38 [ 437.429633][ T3493] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.526791][ T9847] fuse: Bad value for 'fd' [ 437.786803][ T5843] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 437.798269][ T5843] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 437.809382][ T5843] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 437.822210][ T5843] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 437.844860][ T5843] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 437.861410][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 437.940982][ T3493] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 438.082724][ T9860] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.428772][ T5915] usb 2-1: USB disconnect, device number 48 [ 438.483969][ T3493] netdevsim netdevsim4 netdevsim0 (unregistering): left allmulticast mode [ 438.801601][ T3493] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.198950][ T9866] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1073'. [ 439.732106][ T3493] bridge_slave_1: left allmulticast mode [ 439.738684][ T3493] bridge_slave_1: left promiscuous mode [ 439.752215][ T5915] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 439.789319][ T3493] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.815936][ T9879] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1076'. [ 439.863128][ T3493] bridge_slave_0: left allmulticast mode [ 439.863176][ T3493] bridge_slave_0: left promiscuous mode [ 439.863356][ T3493] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.912923][ T5915] usb 2-1: Using ep0 maxpacket: 16 [ 439.915019][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 439.915090][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 439.915117][ T5915] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 439.915163][ T5915] usb 2-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 439.915190][ T5915] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.921656][ T5915] usb 2-1: config 0 descriptor?? [ 439.941600][ T5843] Bluetooth: hci2: command tx timeout [ 440.243294][ T5915] usbhid 2-1:0.0: can't add hid device: -71 [ 440.249720][ T5915] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 440.301059][ T5915] usb 2-1: USB disconnect, device number 49 [ 440.801761][ T3493] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 440.831886][ T3493] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 440.862175][ T3493] bond0 (unregistering): Released all slaves [ 440.892908][ T3493] bond1 (unregistering): (slave veth3): Releasing backup interface [ 440.927698][ T3493] bond1 (unregistering): Released all slaves [ 440.977503][ T3493] bond2 (unregistering): (slave veth5): Releasing backup interface [ 441.109588][ T3493] bond2 (unregistering): Released all slaves [ 441.129320][ T3493] bond3 (unregistering): Released all slaves [ 441.151306][ T10] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 441.237230][ T9879] ip6gre5: entered promiscuous mode [ 441.248765][ T9879] ip6gre5: entered allmulticast mode [ 441.401196][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 441.414218][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 441.437017][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 441.452375][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 441.466882][ T10] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 441.512389][ T10] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 441.556461][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.803529][ T10] usb 3-1: GET_CAPABILITIES returned 0 [ 441.809135][ T10] usbtmc 3-1:16.0: can't read capabilities [ 441.861319][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 442.026479][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 442.050076][ T5843] Bluetooth: hci2: command tx timeout [ 442.113375][ T3493] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 442.147388][ T3493] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 442.155425][ T29] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 442.202459][ T3493] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 442.242269][ T3493] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 442.275241][ T3493] veth1_macvtap: left promiscuous mode [ 442.282668][ T3493] veth0_macvtap: left promiscuous mode [ 442.337159][ T29] usb 2-1: Using ep0 maxpacket: 16 [ 442.363782][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 442.421048][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 442.477422][ T29] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 442.708595][ T29] usb 2-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 442.740905][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.824889][ T29] usb 2-1: config 0 descriptor?? [ 443.295022][ T29] hid_parser_main: 34 callbacks suppressed [ 443.295056][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.329000][ T3493] team0 (unregistering): Port device team_slave_1 removed [ 443.346082][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.375856][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.402877][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.419751][ T3493] team0 (unregistering): Port device team_slave_0 removed [ 443.434200][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.468286][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.501650][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.528816][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.568698][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.579652][ T29] waterforce 0003:1044:7A4D.0012: unknown main item tag 0x0 [ 443.600797][ T9955] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 443.658056][ T29] waterforce 0003:1044:7A4D.0012: hidraw0: USB HID v1.00 Device [HID 1044:7a4d] on usb-dummy_hcd.1-1/input0 [ 443.743889][ T29] waterforce 0003:1044:7A4D.0012: fw version request failed with -38 [ 443.790339][ T5224] usb 3-1: USB disconnect, device number 39 [ 443.876868][ T29] usb 2-1: USB disconnect, device number 50 [ 443.992375][ T9956] fido_id[9956]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 444.101684][ T5843] Bluetooth: hci2: command tx timeout [ 444.181469][ T9960] fuse: Unknown parameter 'roo|mode' [ 444.212988][ T9856] chnl_net:caif_netlink_parms(): no params data found [ 445.093668][ T9856] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.120926][ T9856] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.131788][ T9856] bridge_slave_0: entered allmulticast mode [ 445.156100][ T9856] bridge_slave_0: entered promiscuous mode [ 445.184558][ T9975] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1091'. [ 445.242787][ T9856] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.272746][ T9856] bridge0: port 2(bridge_slave_1) entered disabled state [ 445.315923][ T9856] bridge_slave_1: entered allmulticast mode [ 445.390295][ T9856] bridge_slave_1: entered promiscuous mode [ 445.420567][ T9975] ip6gre6: entered promiscuous mode [ 445.427077][ T9975] ip6gre6: entered allmulticast mode [ 445.653853][ T9856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 445.698152][ T9856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 445.961251][ T5915] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 445.989810][ T9856] team0: Port device team_slave_0 added [ 446.042532][ T9856] team0: Port device team_slave_1 added [ 446.093694][ T5915] usb 1-1: device descriptor read/64, error -71 [ 446.181301][ T5843] Bluetooth: hci2: command tx timeout [ 446.214331][ T9856] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 446.256035][ T9856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 446.326776][ T9856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 446.351373][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 446.377930][ T9856] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 446.431326][ T5915] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 446.441429][ T9856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 446.541233][ T9856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 446.612316][ T5915] usb 1-1: device descriptor read/64, error -71 [ 446.721733][ T5915] usb usb1-port1: attempt power cycle [ 446.863535][ T9856] hsr_slave_0: entered promiscuous mode [ 446.904753][ T9856] hsr_slave_1: entered promiscuous mode [ 446.966460][ T9856] debugfs: 'hsr0' already exists in 'hsr' [ 446.983919][ T9856] Cannot create hsr debugfs directory [ 446.990370][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 446.996944][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 447.092424][ T5915] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 447.141982][ T5915] usb 1-1: device descriptor read/8, error -71 [ 447.190580][T10004] loop5: detected capacity change from 0 to 7 [ 447.243391][T10008] input: syz1 as /devices/virtual/input/input14 [ 447.254871][T10004] Dev loop5: unable to read RDB block 7 [ 447.260554][T10004] loop5: unable to read partition table [ 447.311468][T10004] loop5: partition table beyond EOD, truncated [ 447.341927][T10004] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 447.411433][ T5915] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 447.462065][ T5915] usb 1-1: device descriptor read/8, error -71 [ 447.583436][ T5915] usb usb1-port1: unable to enumerate USB device [ 447.799367][ T9856] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 447.812312][T10017] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1098'. [ 447.828182][ T9856] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 447.867065][ T9856] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 447.893814][T10020] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1098'. [ 447.894854][ T9856] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 448.081546][ T5224] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 448.211962][ T9856] 8021q: adding VLAN 0 to HW filter on device bond0 [ 448.249574][T10037] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 448.251508][ T5224] usb 4-1: Using ep0 maxpacket: 8 [ 448.267697][ T9856] 8021q: adding VLAN 0 to HW filter on device team0 [ 448.276755][ T5224] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 448.293297][ T5224] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 448.310943][ T9770] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.318406][ T9770] bridge0: port 1(bridge_slave_0) entered forwarding state [ 448.349544][ T5224] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 448.371184][ T5224] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 448.388462][ T9770] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.395933][ T9770] bridge0: port 2(bridge_slave_1) entered forwarding state [ 448.401559][ T5224] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 448.433652][ T5224] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.624341][T10046] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1101'. [ 448.660342][ T9856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 448.690479][ T5224] usb 4-1: GET_CAPABILITIES returned 0 [ 448.771281][ T5224] usbtmc 4-1:16.0: can't read capabilities [ 448.781810][T10046] ip6gre3: entered promiscuous mode [ 448.789305][T10046] ip6gre3: entered allmulticast mode [ 448.891044][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 449.016621][ T9856] veth0_vlan: entered promiscuous mode [ 449.073940][ T9856] veth1_vlan: entered promiscuous mode [ 449.141718][ T10] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 449.192440][ T9856] veth0_macvtap: entered promiscuous mode [ 449.204880][T10053] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1103'. [ 449.249829][ T9856] veth1_macvtap: entered promiscuous mode [ 449.325806][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 449.345815][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 449.364213][T10053] 8021q: adding VLAN 0 to HW filter on device bond2 [ 449.374631][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 449.423199][ T10] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 449.460202][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.509168][ T10] usb 1-1: config 0 descriptor?? [ 449.582036][T10059] veth5: entered promiscuous mode [ 449.605675][T10059] bond2: (slave veth5): Enslaving as an active interface with an up link [ 449.686245][ T9856] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 449.721411][ T9856] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 449.737214][T10049] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1102'. [ 449.777785][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 449.787896][ T9762] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.811674][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 449.819977][ T9762] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.845359][ T9762] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.859489][ T10] usb 1-1: USB disconnect, device number 51 [ 449.860563][ T9762] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.928465][T10068] ip6tnl3: entered allmulticast mode [ 450.105767][ T9770] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 450.145425][ T9770] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 450.220243][ T9766] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 450.248020][ T9766] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 450.641151][T10087] openvswitch: netlink: IPv4 tun info is not correct [ 450.886443][ T24] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 451.071960][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 451.080337][ T24] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 451.097186][ T24] usb 6-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 451.111582][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.148191][ T24] usb 6-1: Product: syz [ 451.159828][ T24] usb 6-1: Manufacturer: syz [ 451.179670][ T24] usb 6-1: SerialNumber: syz [ 451.232412][ T24] snd-ua101 6-1:1.1: sample format descriptor not found [ 451.277757][ T24] snd-ua101 6-1:1.0: invalid num_altsetting [ 451.430679][T10091] fuse: Bad value for 'fd' [ 451.510281][ T24] usb 6-1: USB disconnect, device number 2 [ 451.545105][ T5224] usb 4-1: USB disconnect, device number 53 [ 451.767485][T10094] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1112'. [ 451.918753][T10094] ip6gre7: entered promiscuous mode [ 451.961306][T10094] ip6gre7: entered allmulticast mode [ 452.038374][T10098] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 452.383428][T10107] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1116'. [ 452.416266][T10109] netlink: 512 bytes leftover after parsing attributes in process `syz.5.1117'. [ 452.470631][T10107] 8021q: adding VLAN 0 to HW filter on device bond3 [ 452.543952][T10111] veth5: entered promiscuous mode [ 452.595403][T10111] bond3: (slave veth5): Enslaving as an active interface with an up link [ 453.071415][ T24] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 453.701797][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 453.719648][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 453.810628][T10135] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.820154][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 453.830328][T10135] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.839254][ T24] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 453.874496][T10137] binder: 10131:10137 ioctl c018620b 200000000240 returned -14 [ 453.908590][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.942663][ T24] usb 4-1: config 0 descriptor?? [ 454.031206][ T5894] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 454.051266][ T10] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 454.159638][T10116] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1119'. [ 454.177488][ T24] usbhid 4-1:0.0: can't add hid device: -71 [ 454.191909][ T24] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 454.205332][T10142] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1126'. [ 454.215143][ T5894] usb 2-1: Using ep0 maxpacket: 8 [ 454.227264][ T10] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 454.243491][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.245846][ T5894] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 454.267589][ T10] usb 3-1: Product: syz [ 454.275798][ T24] usb 4-1: USB disconnect, device number 54 [ 454.293731][ T10] usb 3-1: Manufacturer: syz [ 454.299518][ T10] usb 3-1: SerialNumber: syz [ 454.308261][ T5894] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 454.322397][ T5894] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 454.332687][ T5894] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 454.348866][T10142] ip6gre1: entered promiscuous mode [ 454.354781][T10142] ip6gre1: entered allmulticast mode [ 454.406268][ T5894] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 454.425691][ T5894] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.599746][ T10] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 454.641362][ T10] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 454.662813][ T10] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 454.681400][ T10] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 454.727034][ T5894] usb 2-1: GET_CAPABILITIES returned 0 [ 454.737055][ T5894] usbtmc 2-1:16.0: can't read capabilities [ 454.761866][ T10] usb 3-1: USB disconnect, device number 40 [ 454.933831][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 454.979852][T10157] netlink: 592 bytes leftover after parsing attributes in process `syz.0.1131'. [ 455.136697][ T5224] usb 4-1: new full-speed USB device number 55 using dummy_hcd [ 455.201813][T10160] binder_alloc: 10159: binder_alloc_buf, no vma [ 455.325903][ T5224] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 455.357988][ T5224] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.384669][ T5224] usb 4-1: Product: syz [ 455.392922][ T5224] usb 4-1: Manufacturer: syz [ 455.398119][ T5224] usb 4-1: SerialNumber: syz [ 455.423537][ T5224] usb 4-1: config 0 descriptor?? [ 455.662055][ T5224] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 456.197609][ T5894] usb 2-1: USB disconnect, device number 51 [ 456.360921][T10188] xt_hashlimit: size too large, truncated to 1048576 [ 456.445371][T10191] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.477137][T10191] bridge_slave_0 (unregistering): left allmulticast mode [ 456.549861][T10191] bridge_slave_0 (unregistering): left promiscuous mode [ 456.629570][T10191] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.932144][T10154] tipc: Started in network mode [ 456.960870][T10154] tipc: Node identity 76806d57e728, cluster identity 4711 [ 457.020156][T10154] tipc: Enabled bearer , priority 0 [ 457.079341][T10197] syzkaller0: entered promiscuous mode [ 457.112758][T10197] syzkaller0: entered allmulticast mode [ 457.126617][T10200] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1138'. [ 457.194886][T10200] ip6gre7: entered promiscuous mode [ 457.220924][T10200] ip6gre7: entered allmulticast mode [ 457.302342][T10154] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1130'. [ 457.366257][T10199] tipc: Resetting bearer [ 457.445349][T10152] tipc: Resetting bearer [ 457.533731][T10152] tipc: Disabling bearer [ 457.807037][ T5224] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 457.865620][ T5224] usb 4-1: USB disconnect, device number 55 [ 457.971223][ T24] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 458.341611][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 458.368201][ T24] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 458.377076][ T24] usb 1-1: config 0 has no interface number 0 [ 458.403532][ T24] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 458.436595][ T24] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 458.452955][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.468404][ T24] usb 1-1: Product: syz [ 458.478593][ T24] usb 1-1: Manufacturer: syz [ 458.487035][ T24] usb 1-1: SerialNumber: syz [ 458.504331][ T24] usb 1-1: config 0 descriptor?? [ 458.510506][T10207] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 458.622254][T10213] netlink: 592 bytes leftover after parsing attributes in process `syz.3.1142'. [ 458.641491][ T5224] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 458.736935][T10207] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 458.811583][ T5224] usb 6-1: Using ep0 maxpacket: 16 [ 458.825480][ T5224] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 458.841338][ T5224] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 458.856473][ T5224] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 458.868227][T10215] sock: sock_timestamping_bind_phc: sock not bind to device [ 458.887809][T10215] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 458.900056][ T5224] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.920981][T10215] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 458.955969][ T5224] usb 6-1: config 0 descriptor?? [ 459.141395][ T5937] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 459.217217][T10211] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1141'. [ 459.222575][ T5894] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 459.264437][ T5224] usbhid 6-1:0.0: can't add hid device: -71 [ 459.275788][ T5224] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 459.333921][ T5224] usb 6-1: USB disconnect, device number 3 [ 459.347078][ T5937] usb 2-1: Using ep0 maxpacket: 8 [ 459.371870][ T5937] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 459.389176][ T5937] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 459.405393][ T5937] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 459.435338][ T5894] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 459.439904][ T5937] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 459.480028][ T5894] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 459.485264][ T5937] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 459.522486][ T5894] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 459.537811][ T5894] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 459.560997][ T5937] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 459.585646][ T5894] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 459.595360][ T5894] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 459.615705][ T5894] usb 4-1: Product: syz [ 459.620049][ T5894] usb 4-1: Manufacturer: syz [ 459.679608][ T5894] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 459.781923][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 459.951592][ T5894] usb 4-1: USB disconnect, device number 56 [ 460.014824][T10216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.050876][T10215] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.114829][T10216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.127611][T10215] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.150083][ T5937] usb 2-1: usb_control_msg returned -71 [ 460.239940][ T5937] usbtmc 2-1:16.0: can't read capabilities [ 460.308214][ T5937] usb 2-1: USB disconnect, device number 52 [ 460.362208][ T5923] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 460.564731][ T5923] usb 6-1: Using ep0 maxpacket: 8 [ 460.724489][ T5923] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 460.827888][ T5923] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 460.871294][ T5923] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 460.900775][ T5923] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 460.946503][ T5923] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 461.001138][ T5923] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.272906][ T5923] usb 6-1: GET_CAPABILITIES returned 0 [ 461.291240][ T5923] usbtmc 6-1:16.0: can't read capabilities [ 461.486018][ C1] usbtmc 6-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 461.702229][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 461.769134][ T24] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 461.781313][ T24] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to write Medium Mode mode to 0x0306: ffffffb9 [ 461.820239][ T24] asix 1-1:0.188: probe with driver asix failed with error -71 [ 461.875597][ T24] usb 1-1: USB disconnect, device number 52 [ 461.950519][T10257] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1150'. [ 462.016627][T10257] ip6gre4: entered promiscuous mode [ 462.030561][T10257] ip6gre4: entered allmulticast mode [ 462.239479][T10262] ip6tnl2: entered allmulticast mode [ 462.398023][T10266] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1152'. [ 462.909453][ T24] usb 6-1: USB disconnect, device number 4 [ 462.917478][T10285] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 462.932824][ T5923] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 463.111681][ T5923] usb 4-1: Using ep0 maxpacket: 16 [ 463.127389][ T5923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 463.168516][ T5923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 463.210957][ T5923] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 463.248052][ T5923] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.278490][ T5923] usb 4-1: config 0 descriptor?? [ 463.441480][ T30] audit: type=1326 audit(1775675150.052:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10297 comm="syz.1.1162" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f838859c819 code=0x7ffc0000 [ 463.510014][T10277] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1157'. [ 463.532461][ T30] audit: type=1326 audit(1775675150.052:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10297 comm="syz.1.1162" exe="/root/syz-executor" sig=0 arch=c000003e syscall=162 compat=0 ip=0x7f838859c819 code=0x7ffc0000 [ 463.556017][ T5224] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 463.595281][ T5923] usbhid 4-1:0.0: can't add hid device: -71 [ 463.605192][ T5923] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 463.643486][ T30] audit: type=1326 audit(1775675150.232:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10297 comm="syz.1.1162" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f838859c819 code=0x7ffc0000 [ 463.674218][T10308] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1163'. [ 463.706184][ T5923] usb 4-1: USB disconnect, device number 57 [ 463.748115][ T30] audit: type=1326 audit(1775675150.232:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10297 comm="syz.1.1162" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f838859c819 code=0x7ffc0000 [ 463.779715][ T5224] usb 3-1: config 227 has an invalid interface number: 20 but max is 0 [ 463.801948][T10308] ip6gre8: entered promiscuous mode [ 463.807485][ T5224] usb 3-1: config 227 has no interface number 0 [ 463.822343][ T5224] usb 3-1: config 227 interface 20 altsetting 5 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 463.836939][T10308] ip6gre8: entered allmulticast mode [ 463.844597][ T30] audit: type=1326 audit(1775675150.242:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10297 comm="syz.1.1162" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f838859c819 code=0x7ffc0000 [ 463.868443][ T5224] usb 3-1: config 227 interface 20 altsetting 5 endpoint 0x8F has invalid maxpacket 26274, setting to 1024 [ 463.884634][ T5224] usb 3-1: config 227 interface 20 altsetting 5 bulk endpoint 0x8F has invalid maxpacket 1024 [ 463.912925][T10310] ip6tnl1: entered allmulticast mode [ 463.939709][ T5224] usb 3-1: config 227 interface 20 altsetting 5 endpoint 0x7 has an invalid bInterval 128, changing to 11 [ 463.985296][ T5224] usb 3-1: config 227 interface 20 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 464.027415][ T5224] usb 3-1: config 227 interface 20 altsetting 5 bulk endpoint 0xA has invalid maxpacket 32 [ 464.062891][ T5224] usb 3-1: config 227 interface 20 altsetting 5 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 464.096618][ T5224] usb 3-1: config 227 interface 20 has no altsetting 0 [ 464.134815][ T5224] usb 3-1: New USB device found, idVendor=045e, idProduct=040a, bcdDevice=67.7b [ 464.156592][ T5224] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.185582][ T5224] usb 3-1: Product: syz [ 464.189850][ T5224] usb 3-1: Manufacturer: syz [ 464.213632][ T5224] usb 3-1: SerialNumber: syz [ 464.231962][ T5937] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 464.257258][T10292] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 464.278403][T10292] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 464.289029][T10323] netlink: 'syz.0.1168': attribute type 29 has an invalid length. [ 464.304163][T10323] netlink: 'syz.0.1168': attribute type 29 has an invalid length. [ 464.314769][T10323] netlink: 500 bytes leftover after parsing attributes in process `syz.0.1168'. [ 464.361523][ T5923] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 464.408241][ T5937] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 464.426969][ T5937] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 464.456854][ T5937] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.482136][ T5937] usb 2-1: config 0 descriptor?? [ 464.512240][ T5937] pwc: Askey VC010 type 2 USB webcam detected. [ 464.540731][T10292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.553105][ T5923] usb 6-1: config 150 has an invalid interface number: 204 but max is 2 [ 464.564702][ T5923] usb 6-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 464.577889][T10292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.590617][ T5923] usb 6-1: config 150 has no interface number 0 [ 464.614999][ T5923] usb 6-1: config 150 interface 204 has no altsetting 0 [ 464.616620][ T5224] ipaq 3-1:227.20: PocketPC PDA converter detected [ 464.651842][ T5923] usb 6-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 464.662325][ T24] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 464.675627][ T5224] usb 3-1: active config #227 != 1 ?? [ 464.686980][ T5923] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.687016][ T5923] usb 6-1: Product: syz [ 464.687035][ T5923] usb 6-1: Manufacturer: syz [ 464.687077][ T5923] usb 6-1: SerialNumber: syz [ 464.707040][ T5224] usb 3-1: USB disconnect, device number 41 [ 464.821749][ T5915] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 464.888363][T10344] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1171'. [ 464.916362][ T5937] pwc: recv_control_msg error -32 req 02 val 2b00 [ 464.923535][T10344] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1171'. [ 464.928194][ T5923] xr_serial 6-1:150.204: skipping garbage [ 464.940939][T10344] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1171'. [ 464.961483][ T5937] pwc: recv_control_msg error -32 req 02 val 2700 [ 464.968486][ T5923] xr_serial 6-1:150.204: xr_serial converter detected [ 464.982128][ T5915] usb 4-1: Using ep0 maxpacket: 8 [ 464.993387][T10314] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 465.010007][T10344] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1171'. [ 465.019535][ T9759] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 465.034021][ T5915] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 465.045562][ T9770] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 465.053360][T10344] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1171'. [ 465.071682][ T5937] pwc: recv_control_msg error -32 req 02 val 2c00 [ 465.072332][ T5915] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 465.089143][ T9770] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 465.111887][ T9770] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 465.120825][ T5915] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 465.154745][T10314] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.164664][ T5915] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 465.182873][ T5915] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 465.193677][T10314] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.214499][ T5915] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.310900][T10354] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1172'. [ 465.389233][T10354] 8021q: adding VLAN 0 to HW filter on device bond4 [ 465.412516][ T5937] pwc: recv_control_msg error -71 req 04 val 1000 [ 465.430101][ T5937] pwc: recv_control_msg error -71 req 04 val 1300 [ 465.443929][ T5937] pwc: recv_control_msg error -71 req 04 val 1400 [ 465.454161][ T5937] pwc: recv_control_msg error -71 req 02 val 2000 [ 465.464539][ T5937] pwc: recv_control_msg error -71 req 02 val 2100 [ 465.479020][ T5937] pwc: recv_control_msg error -71 req 04 val 1500 [ 465.487677][ T5915] usb 4-1: GET_CAPABILITIES returned 0 [ 465.487978][ T5937] pwc: recv_control_msg error -71 req 02 val 2500 [ 465.500747][ T5937] pwc: recv_control_msg error -71 req 02 val 2400 [ 465.508391][ T5937] pwc: recv_control_msg error -71 req 02 val 2600 [ 465.510917][ T5915] usbtmc 4-1:16.0: can't read capabilities [ 465.522323][ T5937] pwc: recv_control_msg error -71 req 02 val 2900 [ 465.529724][ T5937] pwc: recv_control_msg error -71 req 02 val 2800 [ 465.538352][ T5937] pwc: recv_control_msg error -71 req 04 val 1100 [ 465.547193][ T5937] pwc: recv_control_msg error -71 req 04 val 1200 [ 465.582986][ T5937] pwc: Registered as video103. [ 465.595041][T10357] veth3: entered promiscuous mode [ 465.633030][ T5937] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input15 [ 465.658043][T10357] bond4: (slave veth3): Enslaving as an active interface with an up link [ 465.683813][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 465.748100][ T5937] usb 2-1: USB disconnect, device number 53 [ 465.763157][ T5923] usb 6-1: xr_serial converter now attached to ttyUSB0 [ 466.171293][ T5923] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 466.270010][T10377] ip6gre9: entered promiscuous mode [ 466.289982][T10377] ip6gre9: entered allmulticast mode [ 466.351799][ T5937] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 466.463684][ T30] audit: type=1326 audit(1775675153.082:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10381 comm="syz.0.1177" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4e2ad9c819 code=0x0 [ 466.526932][ T5915] usb 6-1: USB disconnect, device number 5 [ 466.540079][ T5915] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 466.542992][ T5937] usb 2-1: Using ep0 maxpacket: 8 [ 466.557362][ T5937] usb 2-1: unable to get BOS descriptor or descriptor too short [ 466.570970][ T5937] usb 2-1: config 250 has an invalid interface number: 49 but max is 0 [ 466.583646][ T5937] usb 2-1: config 250 has no interface number 0 [ 466.590124][ T5937] usb 2-1: config 250 interface 49 has no altsetting 0 [ 466.622640][ T5915] xr_serial 6-1:150.204: device disconnected [ 466.625656][ T5937] usb 2-1: New USB device found, idVendor=06e0, idProduct=0319, bcdDevice=60.3d [ 466.657385][ T5937] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.707453][ T5937] usb 2-1: Product: syz [ 466.729445][ T5937] usb 2-1: Manufacturer: syz [ 466.749516][ T5937] usb 2-1: SerialNumber: syz [ 466.993222][ T5937] ti_usb_3410_5052 2-1:250.49: required endpoints missing [ 467.050656][ T5937] usb 2-1: USB disconnect, device number 54 [ 467.353896][ T797] usb 4-1: USB disconnect, device number 58 [ 467.941304][ T24] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 468.091702][T10411] __nla_validate_parse: 2 callbacks suppressed [ 468.091726][T10411] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1185'. [ 468.124377][T10415] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1186'. [ 468.154420][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 468.255733][ T24] usb 6-1: config 0 has no interfaces? [ 468.311431][ T24] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 468.333893][ T24] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 468.353702][T10418] veth5: entered promiscuous mode [ 468.370784][ T24] usb 6-1: Manufacturer: syz [ 468.494569][ T24] usb 6-1: config 0 descriptor?? [ 468.621871][T10411] 8021q: adding VLAN 0 to HW filter on device bond5 [ 469.012564][T10401] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 469.327825][T10430] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.386507][T10430] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.710930][ T5894] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 469.861412][ T5894] usb 3-1: device descriptor read/64, error -71 [ 470.111283][ T5894] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 470.341758][ T5894] usb 3-1: device descriptor read/64, error -71 [ 470.462343][ T5894] usb usb3-port1: attempt power cycle [ 470.496020][ T24] usb 6-1: USB disconnect, device number 6 [ 470.812402][T10444] netlink: 'syz.3.1191': attribute type 5 has an invalid length. [ 470.861229][ T5894] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 470.892846][ T5894] usb 3-1: device descriptor read/8, error -71 [ 471.069925][T10450] netlink: 192 bytes leftover after parsing attributes in process `syz.0.1194'. [ 471.130533][T10452] netlink: 'syz.3.1195': attribute type 29 has an invalid length. [ 471.151208][ T797] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 471.161444][ T5894] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 471.166351][T10452] netlink: 'syz.3.1195': attribute type 29 has an invalid length. [ 471.201937][ T5894] usb 3-1: device descriptor read/8, error -71 [ 471.210667][T10452] netlink: 500 bytes leftover after parsing attributes in process `syz.3.1195'. [ 471.289558][T10454] netlink: 'syz.0.1196': attribute type 1 has an invalid length. [ 471.331222][ T797] usb 2-1: Using ep0 maxpacket: 8 [ 471.348464][ T5894] usb usb3-port1: unable to enumerate USB device [ 471.391962][ T797] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 471.473662][ T797] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 471.495842][ T797] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 471.507461][ T797] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 471.527197][T10454] veth9: entered promiscuous mode [ 471.535881][T10458] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1197'. [ 471.554497][T10454] bond5: (slave veth9): Enslaving as an active interface with a down link [ 471.568176][ T797] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 471.588625][ T797] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.602292][T10456] bond5: (slave veth11): Enslaving as an active interface with a down link [ 471.635610][T10459] bond5: entered promiscuous mode [ 471.641399][T10459] bond5: entered allmulticast mode [ 471.647688][T10459] 8021q: adding VLAN 0 to HW filter on device bond5 [ 471.834377][T10464] FAULT_INJECTION: forcing a failure. [ 471.834377][T10464] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 471.853781][T10464] CPU: 0 UID: 0 PID: 10464 Comm: syz.3.1198 Tainted: G L syzkaller #0 PREEMPT(full) [ 471.853820][T10464] Tainted: [L]=SOFTLOCKUP [ 471.853829][T10464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 471.853851][T10464] Call Trace: [ 471.853860][T10464] [ 471.853871][T10464] dump_stack_lvl+0xe8/0x150 [ 471.853912][T10464] should_fail_ex+0x412/0x560 [ 471.853953][T10464] _copy_to_user+0x31/0xb0 [ 471.853981][T10464] simple_read_from_buffer+0xe1/0x170 [ 471.854019][T10464] proc_fail_nth_read+0x1bb/0x230 [ 471.854054][T10464] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 471.854086][T10464] ? rw_verify_area+0x2a6/0x4d0 [ 471.854108][T10464] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 471.854139][T10464] vfs_read+0x20c/0xa70 [ 471.854159][T10464] ? fdget_pos+0x246/0x320 [ 471.854183][T10464] ? __pfx___mutex_lock+0x10/0x10 [ 471.854212][T10464] ? __pfx_vfs_read+0x10/0x10 [ 471.854235][T10464] ? __fget_files+0x2a/0x420 [ 471.854265][T10464] ? __fget_files+0x3a0/0x420 [ 471.854283][T10464] ? __fget_files+0x2a/0x420 [ 471.854309][T10464] ksys_read+0x150/0x270 [ 471.854335][T10464] ? __pfx_ksys_read+0x10/0x10 [ 471.854357][T10464] ? __pfx_v4l2_ioctl+0x10/0x10 [ 471.854400][T10464] do_syscall_64+0x14d/0xf80 [ 471.854428][T10464] ? trace_irq_disable+0x3b/0x150 [ 471.854446][T10464] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.854468][T10464] ? clear_bhb_loop+0x40/0x90 [ 471.854495][T10464] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.854522][T10464] RIP: 0033:0x7f4103d5d04e [ 471.854545][T10464] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 471.854563][T10464] RSP: 002b:00007f4104d22fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 471.854585][T10464] RAX: ffffffffffffffda RBX: 00007f4104d236c0 RCX: 00007f4103d5d04e [ 471.854600][T10464] RDX: 000000000000000f RSI: 00007f4104d230a0 RDI: 0000000000000004 [ 471.854612][T10464] RBP: 00007f4104d23090 R08: 0000000000000000 R09: 0000000000000000 [ 471.854623][T10464] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 471.854635][T10464] R13: 00007f4104016038 R14: 00007f4104015fa0 R15: 00007f410413fa48 [ 471.854666][T10464] [ 472.134814][ T797] usb 2-1: GET_CAPABILITIES returned 0 [ 472.140479][ T797] usbtmc 2-1:16.0: can't read capabilities [ 472.315150][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 472.584802][T10469] kvm: emulating exchange as write [ 473.385682][ T24] IPVS: starting estimator thread 0... [ 473.541824][T10489] IPVS: using max 33 ests per chain, 79200 per kthread [ 473.779933][T10491] netlink: 192 bytes leftover after parsing attributes in process `syz.0.1206'. [ 473.827800][ T5224] usb 2-1: USB disconnect, device number 55 [ 474.100958][T10498] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1208'. [ 474.612321][ T24] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 474.851200][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 474.882742][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 474.894352][ T24] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 474.914544][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.002684][ T24] usb 1-1: config 0 descriptor?? [ 475.237224][ T24] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 475.889094][T10502] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.901058][T10502] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.998984][T10517] QAT: failed to copy from user. [ 477.186717][T10538] binder: 10532:10538 ioctl 4018620d 0 returned -22 [ 477.388878][ T24] usb 1-1: USB disconnect, device number 55 [ 477.594188][T10540] netlink: 192 bytes leftover after parsing attributes in process `syz.0.1218'. [ 478.403742][T10559] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1221'. [ 479.680126][T10578] netlink: 192 bytes leftover after parsing attributes in process `syz.1.1229'. [ 480.081281][ T5894] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 480.251334][ T5894] usb 2-1: Using ep0 maxpacket: 16 [ 480.262082][ T5894] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 480.291466][ T5894] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 480.327803][ T5894] usb 2-1: config 0 has no interface number 0 [ 480.395489][ T5894] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 480.467366][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.499470][ T5894] usb 2-1: Product: syz [ 480.517272][ T5894] usb 2-1: Manufacturer: syz [ 480.533008][ T5894] usb 2-1: SerialNumber: syz [ 480.549091][ T5894] usb 2-1: config 0 descriptor?? [ 480.575625][ T5894] uvcvideo 2-1:0.105: Found Unit with invalid ID 0 [ 480.714972][T10611] binder: 10609:10611 ioctl c0306201 2000000007c0 returned -14 [ 480.725333][T10613] netlink: 'syz.5.1240': attribute type 12 has an invalid length. [ 480.734185][T10613] netlink: 'syz.5.1240': attribute type 29 has an invalid length. [ 480.772935][T10583] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1231'. [ 480.784860][T10613] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1240'. [ 480.814671][ T5894] uvcvideo 2-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 480.838697][ T5894] uvcvideo 2-1:0.105: No valid video chain found. [ 480.861447][ T5894] usb 2-1: USB disconnect, device number 56 [ 480.926126][T10619] netlink: 192 bytes leftover after parsing attributes in process `syz.5.1242'. [ 480.971454][ T5224] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 481.119943][T10623] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1243'. [ 481.151544][ T5224] usb 4-1: Using ep0 maxpacket: 16 [ 481.193074][ T5224] usb 4-1: no configurations [ 481.197866][ T5224] usb 4-1: can't read configurations, error -22 [ 481.391501][ T5224] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 481.511320][T10627] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1244'. [ 481.521328][T10627] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 481.597842][T10628] input: syz0 as /devices/virtual/input/input16 [ 481.636931][ T5224] usb 4-1: Using ep0 maxpacket: 16 [ 481.684988][ T5224] usb 4-1: no configurations [ 481.696153][T10627] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 481.706875][ T5224] usb 4-1: can't read configurations, error -22 [ 481.730560][ T5224] usb usb4-port1: attempt power cycle [ 481.931248][ T5894] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 482.081251][ T5224] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 482.091168][ T5894] usb 2-1: Using ep0 maxpacket: 8 [ 482.101895][ T5224] usb 4-1: Using ep0 maxpacket: 16 [ 482.110399][ T5224] usb 4-1: no configurations [ 482.116079][ T5894] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 482.151201][ T5894] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 482.195569][ T797] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 482.214253][ T5224] usb 4-1: can't read configurations, error -22 [ 482.249393][ T5894] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.283878][ T5894] usb 2-1: config 0 descriptor?? [ 482.375425][ T5224] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 482.436695][ T5224] usb 4-1: Using ep0 maxpacket: 16 [ 482.452638][ T797] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 482.465522][ T797] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 482.493999][ T5224] usb 4-1: no configurations [ 482.499906][ T5224] usb 4-1: can't read configurations, error -22 [ 482.507662][ T797] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 482.528195][ T5224] usb usb4-port1: unable to enumerate USB device [ 482.539406][ T797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.676932][T10634] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 482.711664][ T5894] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 482.816549][ T797] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 483.071895][ T5224] usb 2-1: USB disconnect, device number 57 [ 483.100942][T10637] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1245'. [ 483.232918][ T797] usb 1-1: USB disconnect, device number 56 [ 483.527002][T10639] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 483.841624][ T797] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 484.036173][ T797] usb 1-1: Using ep0 maxpacket: 16 [ 484.053860][ T797] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 484.065550][ T797] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 484.085907][ T797] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 484.110748][ T797] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 484.135124][T10653] openvswitch: netlink: IPv4 tun info is not correct [ 484.142067][ T797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.163957][ T797] usb 1-1: config 0 descriptor?? [ 484.579903][T10643] netlink: 'syz.0.1247': attribute type 8 has an invalid length. [ 484.612674][ T797] usbhid 1-1:0.0: can't add hid device: -71 [ 484.739789][ T797] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 484.759225][ T797] usb 1-1: USB disconnect, device number 57 [ 485.761268][ T24] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 485.855848][T10679] openvswitch: netlink: IPv4 tun info is not correct [ 485.958490][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 485.991508][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 486.021037][ T24] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 486.175034][ T24] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 486.194384][ T24] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 486.244520][ T24] usb 4-1: config 0 interface 0 has no altsetting 0 [ 486.269094][ T24] usb 4-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 486.301381][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.381972][T10686] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 486.472144][ T24] usb 4-1: config 0 descriptor?? [ 486.811200][ T797] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 486.936893][ T24] hid_parser_main: 28 callbacks suppressed [ 486.936915][ T24] hid-thrustmaster 0003:044F:B65D.0013: unknown main item tag 0x0 [ 486.960115][ T24] hid-thrustmaster 0003:044F:B65D.0013: unknown main item tag 0x0 [ 486.967721][ T797] usb 6-1: unable to get BOS descriptor or descriptor too short [ 486.977892][ T797] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 486.988283][ T24] hid-thrustmaster 0003:044F:B65D.0013: unknown main item tag 0x0 [ 486.999104][ T24] hid-thrustmaster 0003:044F:B65D.0013: unknown main item tag 0x0 [ 487.015717][ T797] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 487.045955][ T797] usb 6-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 487.072085][ T797] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.073040][ T24] hid-thrustmaster 0003:044F:B65D.0013: unknown main item tag 0x0 [ 487.111303][ T797] usb 6-1: Product: syz [ 487.134767][ T797] usb 6-1: Manufacturer: syz [ 487.139546][ T797] usb 6-1: SerialNumber: syz [ 487.304697][ T24] hid-thrustmaster 0003:044F:B65D.0013: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.3-1/input0 [ 487.376408][ T24] hid-thrustmaster 0003:044F:B65D.0013: Wrong number of endpoints? [ 487.412887][ C1] hid-thrustmaster 0003:044F:B65D.0013: Unknown packet type 0x0, unable to proceed further with wheel init [ 487.523357][ T797] usb 6-1: unit 32 not found! [ 487.630789][ T24] usb 4-1: USB disconnect, device number 63 [ 487.780666][ T797] usb 6-1: USB disconnect, device number 7 [ 487.844707][ T5986] udevd[5986]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 488.077532][T10699] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1264'. [ 488.118128][T10699] ip6gre10: entered promiscuous mode [ 488.139731][T10699] ip6gre10: entered allmulticast mode [ 488.161854][ T24] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 488.185850][T10702] netdevsim netdevsim5: Firmware load for './file0/file0/..' refused, path contains '..' component [ 488.351317][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 488.379127][ T24] usb 2-1: config 0 has no interfaces? [ 488.391167][ T24] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 488.415024][T10710] netlink: 'syz.0.1267': attribute type 29 has an invalid length. [ 488.421567][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.434051][T10710] netlink: 'syz.0.1267': attribute type 29 has an invalid length. [ 488.453734][T10710] netlink: 500 bytes leftover after parsing attributes in process `syz.0.1267'. [ 488.483348][ T24] usb 2-1: config 0 descriptor?? [ 488.551428][ T797] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 488.717874][T10695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.722938][ T797] usb 4-1: Using ep0 maxpacket: 16 [ 488.746892][ T797] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 488.757679][T10695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.775116][T10717] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1269'. [ 488.778352][ T797] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 488.794519][ T24] usb 2-1: USB disconnect, device number 58 [ 488.830602][ T797] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 488.852923][ T797] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.875895][ T797] usb 4-1: Product: syz [ 488.880154][ T797] usb 4-1: Manufacturer: syz [ 488.891664][ T797] usb 4-1: SerialNumber: syz [ 489.082104][ T5923] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 489.137239][ T797] usb 4-1: 0:2 : does not exist [ 489.172301][ T797] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 489.241312][ T5923] usb 1-1: Using ep0 maxpacket: 16 [ 489.248684][ T5923] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 489.261743][ T24] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 489.270695][ T797] usb 4-1: USB disconnect, device number 64 [ 489.279737][ T5923] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 489.303812][ T5923] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 489.354098][ T5923] usb 1-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 489.368622][ T6164] udevd[6164]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 489.385328][ T5923] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.404996][ T5923] usb 1-1: config 0 descriptor?? [ 489.421386][ T5224] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 489.483803][ T24] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 489.501610][ T24] usb 2-1: config 0 has no interface number 0 [ 489.507899][ T24] usb 2-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 489.532366][ T24] usb 2-1: config 0 interface 251 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 489.560174][ T24] usb 2-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=f7.f4 [ 489.580729][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.599384][ T24] usb 2-1: Product: syz [ 489.601984][ T5224] usb 3-1: Using ep0 maxpacket: 8 [ 489.605820][ T24] usb 2-1: Manufacturer: syz [ 489.633998][ T24] usb 2-1: SerialNumber: syz [ 489.637577][ T5224] usb 3-1: config 0 has an invalid interface number: 30 but max is 0 [ 489.660361][ T24] usb 2-1: config 0 descriptor?? [ 489.693991][ T5224] usb 3-1: config 0 has no interface number 0 [ 489.700279][ T5224] usb 3-1: too many endpoints for config 0 interface 30 altsetting 222: 254, using maximum allowed: 30 [ 489.713622][ T24] ttusbir 2-1:0.251: cannot find expected altsetting [ 489.748705][ T5923] usbhid 1-1:0.0: can't add hid device: -71 [ 489.768239][ T5923] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 489.789216][ T5224] usb 3-1: config 0 interface 30 altsetting 222 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 489.844694][ T5224] usb 3-1: config 0 interface 30 altsetting 222 endpoint 0x81 has invalid wMaxPacketSize 0 [ 489.857029][ T5923] usb 1-1: USB disconnect, device number 58 [ 489.900764][ T5224] usb 3-1: config 0 interface 30 altsetting 222 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 489.922369][ T5224] usb 3-1: config 0 interface 30 has no altsetting 0 [ 489.940923][ T5224] usb 3-1: New USB device found, idVendor=256c, idProduct=006e, bcdDevice= 0.00 [ 489.952982][ T5224] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.967310][ T5224] usb 3-1: config 0 descriptor?? [ 490.397799][T10757] No such timeout policy "syz1" [ 490.807025][T10754] openvswitch: netlink: IPv4 tun info is not correct [ 491.704015][T10765] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1275'. [ 491.723115][T10766] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1275'. [ 492.415894][ T5923] usb 2-1: USB disconnect, device number 59 [ 492.431370][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 492.481425][T10783] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1277'. [ 492.645863][T10783] ip6gre2: entered promiscuous mode [ 492.657851][ T5224] usbhid 3-1:0.30: can't add hid device: -71 [ 492.677055][ T5224] usbhid 3-1:0.30: probe with driver usbhid failed with error -71 [ 492.701317][T10783] ip6gre2: entered allmulticast mode [ 492.746140][ T5224] usb 3-1: USB disconnect, device number 46 [ 493.621430][ T5915] hid-generic 0000:0000:0000.0014: unknown main item tag 0x0 [ 493.630270][ T5915] hid-generic 0000:0000:0000.0014: unknown main item tag 0x0 [ 493.674959][ T5915] hid-generic 0000:0000:0000.0014: hidraw0: HID v0.00 Device [syz0] on syz0 [ 493.701838][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 494.084300][T10803] netlink: 512 bytes leftover after parsing attributes in process `syz.1.1282'. [ 494.308120][T10800] fido_id[10800]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 494.855982][T10816] netlink: 'syz.1.1287': attribute type 29 has an invalid length. [ 494.912898][T10816] netlink: 'syz.1.1287': attribute type 29 has an invalid length. [ 494.955317][T10816] netlink: 500 bytes leftover after parsing attributes in process `syz.1.1287'. [ 495.546090][T10825] netlink: 192 bytes leftover after parsing attributes in process `syz.2.1290'. [ 496.106009][T10841] netlink: 'syz.0.1293': attribute type 13 has an invalid length. [ 496.352818][ T5915] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 496.530069][ T5915] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 576, setting to 64 [ 496.541595][ T5894] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 496.567203][ T5915] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 496.584932][ T5915] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.593773][ T5915] usb 6-1: Product: syz [ 496.598376][ T5915] usb 6-1: Manufacturer: syz [ 496.615113][ T797] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 496.637355][ T5915] usb 6-1: SerialNumber: syz [ 496.900919][T10840] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 496.935744][ T5894] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 496.949734][ T5894] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 496.965816][ T5894] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 496.975477][ T5894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 496.985135][ T5894] usb 3-1: SerialNumber: syz [ 497.029281][T10845] FAULT_INJECTION: forcing a failure. [ 497.029281][T10845] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 497.063223][T10845] CPU: 0 UID: 0 PID: 10845 Comm: syz.1.1295 Tainted: G L syzkaller #0 PREEMPT(full) [ 497.063264][T10845] Tainted: [L]=SOFTLOCKUP [ 497.063273][T10845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 497.063287][T10845] Call Trace: [ 497.063296][T10845] [ 497.063307][T10845] dump_stack_lvl+0xe8/0x150 [ 497.063346][T10845] should_fail_ex+0x412/0x560 [ 497.063390][T10845] _copy_from_user+0x2d/0xb0 [ 497.063418][T10845] ___sys_sendmsg+0x1c6/0x360 [ 497.063455][T10845] ? __pfx____sys_sendmsg+0x10/0x10 [ 497.063489][T10845] ? kstrtouint+0x6e/0xe0 [ 497.063547][T10845] ? __fget_files+0x2a/0x420 [ 497.063567][T10845] ? __fget_files+0x3a0/0x420 [ 497.063597][T10845] __sys_sendmmsg+0x27c/0x4e0 [ 497.063637][T10845] ? __pfx___sys_sendmmsg+0x10/0x10 [ 497.063663][T10845] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 497.063717][T10845] ? ksys_write+0x242/0x270 [ 497.063745][T10845] ? __pfx_ksys_write+0x10/0x10 [ 497.063776][T10845] __x64_sys_sendmmsg+0xa0/0xc0 [ 497.063807][T10845] do_syscall_64+0x14d/0xf80 [ 497.063835][T10845] ? trace_irq_disable+0x3b/0x150 [ 497.063855][T10845] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.063878][T10845] ? clear_bhb_loop+0x40/0x90 [ 497.063904][T10845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.063926][T10845] RIP: 0033:0x7f838859c819 [ 497.063946][T10845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 497.063965][T10845] RSP: 002b:00007f83893f8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 497.063990][T10845] RAX: ffffffffffffffda RBX: 00007f8388815fa0 RCX: 00007f838859c819 [ 497.064006][T10845] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000006 [ 497.064021][T10845] RBP: 00007f83893f8090 R08: 0000000000000000 R09: 0000000000000000 [ 497.064034][T10845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.064047][T10845] R13: 00007f8388816038 R14: 00007f8388815fa0 R15: 00007f838893fa48 [ 497.064078][T10845] [ 497.278354][ T797] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 497.292998][T10834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 497.304041][T10834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.323448][T10834] xt_hashlimit: size too large, truncated to 1048576 [ 498.616416][ T5915] usblp 6-1:1.0: usblp0: USB Bidirectional printer dev 8 if 0 alt 0 proto 2 vid 0x0525 pid 0xA4A8 [ 498.675587][ T5915] usb 6-1: USB disconnect, device number 8 [ 498.714451][ T5915] usblp0: removed [ 498.890954][ T5894] usb 3-1: 0:2 : does not exist [ 498.907713][ T5894] usb 3-1: unit 5: unexpected type 0x0b [ 499.014776][T10856] xt_hashlimit: size too large, truncated to 1048576 [ 499.028190][ T5894] usb 3-1: USB disconnect, device number 47 [ 499.165401][ T6164] udevd[6164]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 499.481296][ T5224] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 499.697590][T10866] netlink: 192 bytes leftover after parsing attributes in process `syz.5.1302'. [ 499.702622][ T5224] usb 1-1: Using ep0 maxpacket: 16 [ 499.742536][ T5224] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.770461][ T5224] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 499.771583][ T5894] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 499.820924][ T5224] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 499.842176][ T5224] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 499.852313][ T5224] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 499.884493][ T5224] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 499.895109][ T5224] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 499.921188][ T5224] usb 1-1: Manufacturer: syz [ 499.929066][ T5224] usb 1-1: config 0 descriptor?? [ 499.952962][ T5894] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.972749][ T5894] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 499.986945][ T5894] usb 4-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 499.996804][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.028107][ T5894] usb 4-1: config 0 descriptor?? [ 500.578279][T10878] fuse: Bad value for 'fd' [ 500.655891][T10874] openvswitch: netlink: IPv4 tun info is not correct [ 500.842952][ T5224] rc_core: IR keymap rc-hauppauge not found [ 500.854386][ T5224] Registered IR keymap rc-empty [ 500.875155][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 500.907746][ T5894] Bluetooth: Can't get state to change to load configuration err [ 500.918613][ T5894] Bluetooth: Loading sysconfig file failed [ 500.941234][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 500.971529][ T5894] ath3k 4-1:0.0: probe with driver ath3k failed with error -16 [ 500.993158][ T5224] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 501.026002][ T5894] usb 4-1: USB disconnect, device number 65 [ 501.227077][ T5224] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input18 [ 501.271791][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.311592][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.348821][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.431286][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.472195][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.526305][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.581409][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.660379][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.711767][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.754233][ T5224] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.804902][ T5224] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 501.824326][ T5224] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 501.873299][ T5224] usb 1-1: USB disconnect, device number 59 [ 502.018181][T10898] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1309'. [ 502.219473][T10902] netlink: 'syz.3.1311': attribute type 29 has an invalid length. [ 502.278618][T10902] netlink: 'syz.3.1311': attribute type 29 has an invalid length. [ 502.289875][T10902] netlink: 500 bytes leftover after parsing attributes in process `syz.3.1311'. [ 502.569065][ T5224] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 502.637413][T10906] fuse: root generation should be zero [ 502.747311][ T5224] usb 1-1: Using ep0 maxpacket: 32 [ 502.769559][ T5224] usb 1-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 502.788137][ T5224] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.818723][ T5224] usb 1-1: Product: syz [ 502.834471][ T5224] usb 1-1: Manufacturer: syz [ 502.856524][ T5224] usb 1-1: SerialNumber: syz [ 502.870309][T10921] netlink: 'syz.3.1317': attribute type 12 has an invalid length. [ 502.882198][ T5224] usb 1-1: config 0 descriptor?? [ 502.906207][ T5224] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 502.926168][T10921] netlink: 'syz.3.1317': attribute type 29 has an invalid length. [ 503.114384][T10921] netlink: 'syz.3.1317': attribute type 1 has an invalid length. [ 503.122853][T10921] netlink: 'syz.3.1317': attribute type 37 has an invalid length. [ 503.124811][T10901] netlink: 'syz.0.1310': attribute type 1 has an invalid length. [ 503.142101][ T5224] dvb-usb: bulk message failed: -22 (4/0) [ 503.154005][ T5224] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 503.165391][ T5224] dvb-usb: bulk message failed: -22 (5/0) [ 503.175376][ T5224] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 503.184178][T10921] netlink: 'syz.3.1317': attribute type 2 has an invalid length. [ 503.201417][T10921] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.260648][ T5894] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 503.294572][ T5224] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 503.312587][T10901] ttusb2: more than 2 i2c messages at a time is not handled yet. TODO. [ 503.324298][T10901] dvb-usb: bulk message failed: -22 (7/0) [ 503.330459][T10901] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 503.351803][T10901] ttusb2: i2c transfer failed. [ 503.360768][ T5224] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 503.376715][ T5224] usb 1-1: media controller created [ 503.427295][ T5224] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 503.463736][ T5894] usb 6-1: config 0 has an invalid interface number: 200 but max is 0 [ 503.481196][ T5894] usb 6-1: config 0 has no interface number 0 [ 503.502412][ T5894] usb 6-1: config 0 interface 200 altsetting 2 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 503.502546][ T5224] usb 1-1: selecting invalid altsetting 3 [ 503.555407][ T5894] usb 6-1: config 0 interface 200 altsetting 2 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 503.582801][ T5224] ttusb2: set interface to alts=3 failed [ 503.596659][ T5894] usb 6-1: config 0 interface 200 has no altsetting 0 [ 503.613898][ T5894] usb 6-1: New USB device found, idVendor=0b57, idProduct=8528, bcdDevice=6d.39 [ 503.629147][ T5894] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.648090][ T5894] usb 6-1: Product: syz [ 503.652868][ T5894] usb 6-1: Manufacturer: syz [ 503.657692][ T5894] usb 6-1: SerialNumber: syz [ 503.675432][ T5894] usb 6-1: config 0 descriptor?? [ 503.709861][ T5224] DVB: Unable to find symbol tda10086_attach() [ 503.717113][ T5224] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 503.726784][ T5224] dvb-usb: bulk message failed: -22 (4/0) [ 503.734129][ T5224] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 503.744912][ T5224] dvb-usb: bulk message failed: -22 (5/0) [ 503.780937][ T5224] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 503.808199][ T5224] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 503.926281][ T5894] input: Hanwang Art Master III 0906 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.200/input/input19 [ 504.018064][ C0] usb 6-1: hanwang_irq - nonzero urb status received: -71 [ 504.026163][ C0] usb 6-1: hanwang_irq - nonzero urb status received: -71 [ 504.033632][ C0] usb 6-1: hanwang_irq - nonzero urb status received: -71 [ 504.034170][ T5894] usb 6-1: USB disconnect, device number 9 [ 504.040819][ C0] usb 6-1: hanwang_irq - usb_submit_urb failed with result -19 [ 504.068162][ T5224] usb 1-1: USB disconnect, device number 60 [ 504.203177][ T5224] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 504.219844][T10945] netlink: 512 bytes leftover after parsing attributes in process `syz.0.1322'. [ 504.401532][ T5923] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 504.569323][T10948] tipc: Started in network mode [ 504.574450][ T5923] usb 4-1: device descriptor read/64, error -71 [ 504.600703][T10948] tipc: Node identity 4, cluster identity 4711 [ 504.618471][T10948] tipc: Node number set to 4 [ 504.618655][T10952] dlm: plock device version mismatch: kernel (1.2.0), user (1.28.0) [ 504.821838][ T5894] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 504.841641][ T5923] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 504.985367][ T5894] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 505.001266][ T5923] usb 4-1: device descriptor read/64, error -71 [ 505.022979][ T5894] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 505.038765][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.079040][ T5894] usb 2-1: Product: syz [ 505.090882][ T5894] usb 2-1: Manufacturer: syz [ 505.099108][ T5894] usb 2-1: SerialNumber: syz [ 505.111557][ T5923] usb usb4-port1: attempt power cycle [ 505.184649][ T5894] cdc_ncm 2-1:1.0: skipping garbage [ 505.341921][T10961] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1328'. [ 505.501178][ T5923] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 505.534491][ T5923] usb 4-1: device descriptor read/8, error -71 [ 505.582031][T10972] syzkaller0: entered promiscuous mode [ 505.588117][T10972] syzkaller0: entered allmulticast mode [ 505.791303][ T5923] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 505.817134][T10951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.828012][T10951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.877723][ T5923] usb 4-1: device descriptor read/8, error -71 [ 505.981528][ T5224] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 506.031790][ T5923] usb usb4-port1: unable to enumerate USB device [ 506.039440][T10951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.051654][T10951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.172834][ T5224] usb 1-1: Using ep0 maxpacket: 16 [ 506.234533][ T5224] usb 1-1: config 0 has an invalid interface number: 126 but max is 0 [ 506.242897][ T5224] usb 1-1: config 0 has an invalid descriptor of length 108, skipping remainder of the config [ 506.255039][ T5224] usb 1-1: config 0 has no interface number 0 [ 506.261427][ T5224] usb 1-1: config 0 interface 126 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 506.273354][ T5224] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x87 has invalid maxpacket 34328, setting to 1024 [ 506.285155][ T5224] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 506.297141][ T5224] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x4 has invalid maxpacket 31379, setting to 1024 [ 506.310326][ T5224] usb 1-1: config 0 interface 126 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 506.331206][ T5224] usb 1-1: config 0 interface 126 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 506.344764][ T5224] usb 1-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 506.368732][ T5224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 506.395087][ T5224] usb 1-1: config 0 descriptor?? [ 506.405420][T10973] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 506.416783][T10973] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 506.439907][ T5224] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 506.709798][ T5224] usb 1-1: USB disconnect, device number 61 [ 506.769187][T10951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.778042][ T5894] cdc_ncm 2-1:1.0: bind() failure [ 506.788177][ T5894] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 506.810014][ T5894] cdc_ncm 2-1:1.1: bind() failure [ 506.836581][T10951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.005114][ T5923] usb 2-1: USB disconnect, device number 60 [ 507.036934][T10982] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1332'. [ 507.431277][ T5923] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 507.658683][ T5923] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 48 [ 507.689354][ T5923] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 507.721998][ T5923] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 507.827142][ T5923] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.891218][ T5923] usb 2-1: Product: 猜쳅ꏆ峈原̅钏禎꿠⚝ᯅ툔뀿눢헮⮧櫰佘硙ᆺ㹝舢瑾㚓 [ 507.911367][ T5923] usb 2-1: SerialNumber: ц [ 508.488212][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 508.496614][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 508.520198][ T5923] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 508.537798][ T5923] cdc_ncm 2-1:1.0: bind() failure [ 508.559286][T11007] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1338'. [ 508.574010][ T5923] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 508.609037][ T5923] cdc_ncm 2-1:1.1: bind() failure [ 508.784077][ T5923] usb 2-1: USB disconnect, device number 61 [ 510.181515][ T5915] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 510.333193][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 510.360163][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1280, setting to 1024 [ 510.411595][ T5915] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 510.451201][ T5915] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 510.460435][ T5915] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.481392][ T5224] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 510.561724][ T5915] usb 2-1: config 0 descriptor?? [ 510.568297][T11025] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 510.674932][ T5224] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 510.694323][ T5224] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 510.741384][ T5224] usb 3-1: config 220 has no interface number 2 [ 510.758343][ T5224] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 510.801149][ T5224] usb 3-1: config 220 interface 0 has no altsetting 0 [ 510.821365][ T5224] usb 3-1: config 220 interface 76 has no altsetting 0 [ 510.828337][ T5224] usb 3-1: config 220 interface 1 has no altsetting 0 [ 510.858827][T11054] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1351'. [ 510.882873][ T5224] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 510.913003][ T5224] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.925323][T11053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.951500][ T5224] usb 3-1: Product: syz [ 510.961277][ T5224] usb 3-1: Manufacturer: syz [ 510.967017][ T5224] usb 3-1: SerialNumber: syz [ 510.972437][T11053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.049104][ T5915] plantronics 0003:047F:FFFF.0015: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 511.121167][ T5894] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 511.413708][ T5915] usb 2-1: USB disconnect, device number 62 [ 511.676982][T11067] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 511.822931][T11058] fido_id[11058]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 514.970034][T11105] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1363'. [ 515.144207][T11111] fuse: Bad value for 'fd' [ 515.209032][ T5224] usb 3-1: selecting invalid altsetting 0 [ 515.245857][ T5224] uvcvideo 3-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 515.283230][ T5224] uvcvideo 3-1:220.0: No valid video chain found. [ 515.329428][ T5224] usb 3-1: selecting invalid altsetting 0 [ 515.356058][ T5224] usbtest 3-1:220.1: probe with driver usbtest failed with error -22 [ 515.487889][ T5224] usb 3-1: USB disconnect, device number 48 [ 515.520363][T11115] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 516.236443][T11130] netlink: 'syz.1.1370': attribute type 29 has an invalid length. [ 516.257320][T11130] netlink: 'syz.1.1370': attribute type 29 has an invalid length. [ 516.275600][T11130] netlink: 500 bytes leftover after parsing attributes in process `syz.1.1370'. [ 516.544739][T11132] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1371'. [ 516.932434][T11137] netlink: 'syz.3.1373': attribute type 12 has an invalid length. [ 516.940670][T11137] netlink: 'syz.3.1373': attribute type 29 has an invalid length. [ 516.982905][T11137] netlink: 'syz.3.1373': attribute type 1 has an invalid length. [ 517.021202][T11137] netlink: 'syz.3.1373': attribute type 37 has an invalid length. [ 517.064245][T11137] netlink: 'syz.3.1373': attribute type 2 has an invalid length. [ 517.112988][T11137] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.234933][T11140] netlink: 'syz.1.1374': attribute type 12 has an invalid length. [ 517.276568][T11140] netlink: 'syz.1.1374': attribute type 29 has an invalid length. [ 517.308757][T11140] netlink: 'syz.1.1374': attribute type 1 has an invalid length. [ 517.336497][T11140] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.374495][T11140] FAULT_INJECTION: forcing a failure. [ 517.374495][T11140] name failslab, interval 1, probability 0, space 0, times 0 [ 517.551865][T11140] CPU: 1 UID: 0 PID: 11140 Comm: syz.1.1374 Tainted: G L syzkaller #0 PREEMPT(full) [ 517.551904][T11140] Tainted: [L]=SOFTLOCKUP [ 517.551913][T11140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 517.551926][T11140] Call Trace: [ 517.551935][T11140] [ 517.551945][T11140] dump_stack_lvl+0xe8/0x150 [ 517.551982][T11140] should_fail_ex+0x412/0x560 [ 517.552021][T11140] should_failslab+0xa8/0x100 [ 517.552053][T11140] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 517.552081][T11140] ? __alloc_skb+0x1d0/0x7d0 [ 517.552104][T11140] ? __local_bh_enable_ip+0xd0/0x130 [ 517.552136][T11140] __alloc_skb+0x1d0/0x7d0 [ 517.552159][T11140] ? br_setlink+0x6cc/0x8c0 [ 517.552190][T11140] br_info_notify+0x105/0x280 [ 517.552221][T11140] br_setlink+0x390/0x8c0 [ 517.552252][T11140] ? __pfx_br_setlink+0x10/0x10 [ 517.552319][T11140] ? __local_bh_enable_ip+0xd0/0x130 [ 517.552351][T11140] ? mutex_is_locked+0x17/0x50 [ 517.552386][T11140] rtnl_bridge_setlink+0x5bb/0x7e0 [ 517.552419][T11140] ? __pfx_rtnl_bridge_setlink+0x10/0x10 [ 517.552453][T11140] ? __pfx_rtnl_bridge_setlink+0x10/0x10 [ 517.552477][T11140] rtnetlink_rcv_msg+0x77e/0xbe0 [ 517.552505][T11140] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 517.552528][T11140] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 517.552548][T11140] ? ref_tracker_free+0x693/0x840 [ 517.552568][T11140] ? __copy_skb_header+0xa3/0x4a0 [ 517.552597][T11140] ? __pfx_ref_tracker_free+0x10/0x10 [ 517.552618][T11140] ? __skb_clone+0x63/0x7a0 [ 517.552654][T11140] netlink_rcv_skb+0x232/0x4b0 [ 517.552679][T11140] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 517.552704][T11140] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 517.552739][T11140] ? netlink_deliver_tap+0x2e/0x1b0 [ 517.552770][T11140] netlink_unicast+0x80f/0x9b0 [ 517.552811][T11140] ? __pfx_netlink_unicast+0x10/0x10 [ 517.552844][T11140] ? netlink_sendmsg+0x650/0xb40 [ 517.552865][T11140] ? skb_put+0x11b/0x210 [ 517.552898][T11140] netlink_sendmsg+0x813/0xb40 [ 517.552932][T11140] ? __pfx_netlink_sendmsg+0x10/0x10 [ 517.552957][T11140] ? aa_sock_msg_perm+0xf1/0x1b0 [ 517.552992][T11140] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 517.553022][T11140] ____sys_sendmsg+0x972/0x9f0 [ 517.553050][T11140] ? __lock_acquire+0x6b5/0x2cf0 [ 517.553085][T11140] ? __pfx_____sys_sendmsg+0x10/0x10 [ 517.553123][T11140] ? import_iovec+0x73/0xa0 [ 517.553151][T11140] ___sys_sendmsg+0x2a5/0x360 [ 517.553186][T11140] ? __pfx____sys_sendmsg+0x10/0x10 [ 517.553247][T11140] ? __fget_files+0x2a/0x420 [ 517.553267][T11140] ? __fget_files+0x3a0/0x420 [ 517.553304][T11140] __sys_sendmmsg+0x27c/0x4e0 [ 517.553339][T11140] ? __pfx___sys_sendmmsg+0x10/0x10 [ 517.553364][T11140] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 517.553422][T11140] ? ksys_write+0x242/0x270 [ 517.553451][T11140] ? rcu_is_watching+0x15/0xb0 [ 517.553489][T11140] __x64_sys_sendmmsg+0xa0/0xc0 [ 517.553519][T11140] do_syscall_64+0x14d/0xf80 [ 517.553548][T11140] ? trace_irq_disable+0x3b/0x150 [ 517.553567][T11140] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.553590][T11140] ? clear_bhb_loop+0x40/0x90 [ 517.553616][T11140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.553637][T11140] RIP: 0033:0x7f838859c819 [ 517.553659][T11140] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 517.553677][T11140] RSP: 002b:00007f83893f8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 517.553702][T11140] RAX: ffffffffffffffda RBX: 00007f8388815fa0 RCX: 00007f838859c819 [ 517.553718][T11140] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000006 [ 517.553731][T11140] RBP: 00007f83893f8090 R08: 0000000000000000 R09: 0000000000000000 [ 517.553744][T11140] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 517.553757][T11140] R13: 00007f8388816038 R14: 00007f8388815fa0 R15: 00007f838893fa48 [ 517.553791][T11140] [ 518.440225][T11152] fuse: Bad value for 'fd' [ 519.021217][ T29] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 519.213924][ T29] usb 3-1: Using ep0 maxpacket: 8 [ 519.222074][ T29] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 519.230770][ T29] usb 3-1: config 179 has no interface number 0 [ 519.240055][ T29] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 519.270676][ T29] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 519.302078][ T29] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 519.347688][ T29] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 519.421744][ T29] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 519.481274][ T29] usb 3-1: config 179 interface 65 has no altsetting 0 [ 519.498335][ T29] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 519.531159][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.588973][ T29] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input20 [ 519.631822][T11163] netlink: 500 bytes leftover after parsing attributes in process `syz.0.1381'. [ 519.741441][ T5181] input input20: unable to receive magic message: -110 [ 519.788350][T11158] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.835495][T11158] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.852808][ T5181] input input20: unable to receive magic message: -32 [ 519.931043][ T5181] input input20: unable to receive magic message: -32 [ 520.110030][ T5181] input input20: unable to receive magic message: -32 [ 520.220673][ T5181] input input20: unable to receive magic message: -32 [ 520.398745][T11173] netlink: 204 bytes leftover after parsing attributes in process `syz.5.1385'. [ 520.457274][T11173] netlink: 84 bytes leftover after parsing attributes in process `syz.5.1385'. [ 520.805143][T11182] sctp: [Deprecated]: syz.3.1388 (pid 11182) Use of struct sctp_assoc_value in delayed_ack socket option. [ 520.805143][T11182] Use struct sctp_sack_info instead [ 521.001238][ T5224] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 521.161195][ T5224] usb 6-1: Using ep0 maxpacket: 8 [ 521.174613][ T5224] usb 6-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 521.186513][ T5224] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.206747][ T5224] usb 6-1: Product: syz [ 521.228127][ T5224] usb 6-1: Manufacturer: syz [ 521.253568][ T5224] usb 6-1: SerialNumber: syz [ 521.300514][ T5224] usb 6-1: config 0 descriptor?? [ 521.337462][ T5224] gspca_main: sq930x-2.14.0 probing 2770:930c [ 521.485076][T11191] validate_nla: 4 callbacks suppressed [ 521.485098][T11191] netlink: 'syz.0.1390': attribute type 10 has an invalid length. [ 521.645690][ T29] usb 3-1: USB disconnect, device number 49 [ 521.645773][ C1] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 521.735606][T11191] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 521.903364][T11192] 8021q: adding VLAN 0 to HW filter on device bond6 [ 522.003104][T11191] bond_slave_0: entered promiscuous mode [ 522.009203][T11191] bond_slave_1: entered promiscuous mode [ 522.015072][T11191] syz_tun: entered promiscuous mode [ 522.109502][T11191] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 522.144987][T11191] bond6: (slave macvlan2): unknown ethtool speed (30000) for port 1 (set it to 0) [ 522.186253][T11191] bond6: (slave macvlan2): speed changed to 0 on port 1 [ 522.198780][T11202] netlink: 'syz.3.1393': attribute type 6 has an invalid length. [ 522.230219][T11191] bond6: (slave macvlan2): Enslaving as a backup interface with an up link [ 522.264527][T11204] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1393'. [ 522.404866][T11203] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 522.643774][T11210] netlink: 512 bytes leftover after parsing attributes in process `syz.3.1396'. [ 522.655246][T11208] netlink: 'syz.1.1395': attribute type 29 has an invalid length. [ 522.675919][T11208] netlink: 'syz.1.1395': attribute type 29 has an invalid length. [ 522.712485][T11208] netlink: 500 bytes leftover after parsing attributes in process `syz.1.1395'. [ 522.812772][ T5224] gspca_sq930x: reg_w 0105 0e00 failed -71 [ 523.051417][ T5224] gspca_sq930x: Sensor ov9630 not yet treated [ 523.057802][ T5224] sq930x 6-1:0.0: probe with driver sq930x failed with error -22 [ 523.224219][ T5224] usb 6-1: USB disconnect, device number 11 [ 523.290798][T11219] fuse: Bad value for 'fd' [ 523.309030][ T6164] udevd[6164]: setting mode of /dev/bus/usb/006/011 to 020664 failed: No such file or directory [ 523.349578][T11224] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1400'. [ 523.471978][ T6164] udevd[6164]: setting owner of /dev/bus/usb/006/011 to uid=0, gid=0 failed: No such file or directory [ 523.901220][ T5224] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 524.072592][ T5224] usb 6-1: Using ep0 maxpacket: 32 [ 524.082833][ T5224] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 524.092475][ T5224] usb 6-1: config 0 has no interface number 0 [ 524.098839][ T5224] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 524.171246][ T5224] usb 6-1: config 0 interface 85 has no altsetting 0 [ 524.190194][ T5224] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 524.202273][ T5224] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.228295][ T5224] usb 6-1: Product: syz [ 524.239077][ T5224] usb 6-1: Manufacturer: syz [ 524.255449][ T5224] usb 6-1: SerialNumber: syz [ 524.292270][ T5224] usb 6-1: config 0 descriptor?? [ 524.424521][T11235] sctp: [Deprecated]: syz.2.1405 (pid 11235) Use of struct sctp_assoc_value in delayed_ack socket option. [ 524.424521][T11235] Use struct sctp_sack_info instead [ 524.938213][T11243] netlink: 192 bytes leftover after parsing attributes in process `syz.3.1407'. [ 525.311337][ T5923] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 525.500745][T11254] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1408'. [ 525.522935][T11254] openvswitch: netlink: Flow key attr not present in new flow. [ 525.557142][ T5923] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 525.571498][ T5923] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 525.607110][T11254] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 525.614454][ T5923] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 525.655473][ T5923] usb 2-1: config 1 interface 1 altsetting 157 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 525.741255][ T29] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 525.748097][ T5923] usb 2-1: config 1 interface 1 has no altsetting 0 [ 525.771197][ T5894] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 525.786113][ T5923] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 525.795900][ T5923] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.804451][ T5923] usb 2-1: Product: syz [ 525.808815][ T5923] usb 2-1: Manufacturer: syz [ 525.819617][ T5923] usb 2-1: SerialNumber: syz [ 525.909103][ T5923] usb 2-1: selecting invalid altsetting 0 [ 525.926282][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 525.934688][ T5923] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 525.951488][ T24] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 525.972443][ T29] usb 1-1: config 166 has an invalid interface number: 177 but max is 1 [ 525.981364][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 525.987160][ T29] usb 1-1: config 166 has an invalid interface number: 34 but max is 1 [ 525.997889][ T5923] usb 2-1: selecting invalid altsetting 0 [ 526.000674][ T5894] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 526.021259][ T5894] usb 3-1: config 0 has no interface number 0 [ 526.038741][ T5923] usbtest 2-1:1.1: probe with driver usbtest failed with error -22 [ 526.041399][ T29] usb 1-1: config 166 has no interface number 0 [ 526.065829][ T5894] usb 3-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 526.090222][T11242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.102614][T11242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.124997][ T24] usb 4-1: device descriptor read/64, error -71 [ 526.133885][ T29] usb 1-1: config 166 has no interface number 1 [ 526.146712][ T5894] usb 3-1: config 0 interface 89 has no altsetting 0 [ 526.157911][ T29] usb 1-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 526.186782][ T5894] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 526.202529][ T29] usb 1-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 526.222881][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.240172][ T29] usb 1-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 526.269282][ T5894] usb 3-1: Product: syz [ 526.285192][ T5894] usb 3-1: Manufacturer: syz [ 526.298852][ T5894] usb 3-1: SerialNumber: syz [ 526.304038][ T29] usb 1-1: config 166 interface 34 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 526.357474][ T5894] usb 3-1: config 0 descriptor?? [ 526.369451][ T29] usb 1-1: config 166 interface 34 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 526.383351][ T24] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 526.410199][ T5894] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 526.459098][ T29] usb 1-1: config 166 interface 34 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 526.471840][ T5894] em28xx 3-1:0.89: Video interface 89 found: [ 526.497478][ T29] usb 1-1: config 166 interface 34 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 526.531991][ T24] usb 4-1: device descriptor read/64, error -71 [ 526.543588][ T29] usb 1-1: config 166 interface 34 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 526.578700][ T29] usb 1-1: config 166 interface 34 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 526.634885][ T29] usb 1-1: config 166 interface 177 has no altsetting 0 [ 526.642679][ T24] usb usb4-port1: attempt power cycle [ 526.683081][ T29] usb 1-1: config 166 interface 34 has no altsetting 0 [ 526.705133][ T29] usb 1-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 526.781347][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.801823][ T29] usb 1-1: Product: syz [ 526.817188][ T29] usb 1-1: Manufacturer: syz [ 526.845841][ T29] usb 1-1: SerialNumber: syz [ 526.991441][ T24] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 527.019237][ T5894] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 527.031879][ T24] usb 4-1: device descriptor read/8, error -71 [ 527.080596][ T29] ums-realtek 1-1:166.177: USB Mass Storage device detected [ 527.090478][T11255] netlink: 'syz.2.1410': attribute type 1 has an invalid length. [ 527.129297][T11255] netlink: 'syz.2.1410': attribute type 2 has an invalid length. [ 527.281254][ T24] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 527.291446][ T29] ums-realtek 1-1:166.34: USB Mass Storage device detected [ 527.336811][ T24] usb 4-1: device descriptor read/8, error -71 [ 527.488966][ T24] usb usb4-port1: unable to enumerate USB device [ 527.550236][ T5224] appletouch 6-1:0.85: Failed to request geyser raw mode [ 527.587728][ T29] ums-realtek 1-1:166.34: probe with driver ums-realtek failed with error -5 [ 527.622775][ T5224] appletouch 6-1:0.85: probe with driver appletouch failed with error -5 [ 527.718346][ T5923] usb 2-1: USB disconnect, device number 63 [ 527.734168][T11250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 527.775508][T11250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 527.799896][ T5224] usb 6-1: USB disconnect, device number 12 [ 527.983052][ T29] uvcvideo 1-1:166.34: Found UVC 0.00 device syz (0bda:0138) [ 527.999283][ T29] uvcvideo 1-1:166.34: No valid video chain found. [ 528.058317][ T29] usb 1-1: USB disconnect, device number 62 [ 528.201720][ T5224] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 528.351324][ T5224] usb 6-1: device descriptor read/64, error -71 [ 528.596326][ T5894] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 528.615201][ T5224] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 528.625482][ T5894] em28xx 3-1:0.89: board has no eeprom [ 528.711363][ T5894] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 528.791262][ T5224] usb 6-1: device descriptor read/64, error -71 [ 528.928729][ T5894] em28xx 3-1:0.89: analog set to bulk mode. [ 528.929907][ T5224] usb usb6-port1: attempt power cycle [ 528.941185][ T29] em28xx 3-1:0.89: Registering V4L2 extension [ 529.045234][T11274] IPVS: set_ctl: invalid protocol: 8 172.30.1.4:20004 [ 529.404600][ T5224] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 529.441962][ T5224] usb 6-1: device descriptor read/8, error -71 [ 529.465480][ C1] raw-gadget.3 gadget.2: ignoring, device is not running [ 529.496778][ T29] em28xx 3-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 529.539480][ T5923] usb 3-1: USB disconnect, device number 50 [ 529.555012][ T29] em28xx 3-1:0.89: reading from i2c device at 0x48 failed (error=-19) [ 529.650431][ T29] em28xx 3-1:0.89: reading from i2c device at 0x42 failed (error=-19) [ 529.685671][ T29] em28xx 3-1:0.89: reading from i2c device at 0x40 failed (error=-19) [ 529.701288][ T5224] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 529.723374][ T29] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 529.782216][ T29] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 529.812771][ T29] em28xx 3-1:0.89: No AC97 audio processor [ 529.891961][ T5224] usb 6-1: device descriptor read/8, error -71 [ 530.011828][ T5224] usb usb6-port1: unable to enumerate USB device [ 530.074540][ T5923] em28xx 3-1:0.89: Disconnecting em28xx [ 530.105865][ T29] usb 3-1: Decoder not found [ 530.110847][ T29] em28xx 3-1:0.89: failed to create media graph [ 530.133801][T11273] geneve2: entered promiscuous mode [ 530.141205][T11273] geneve2: entered allmulticast mode [ 530.222373][ T29] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 530.266869][T11294] ================================================================== [ 530.275180][T11294] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 530.283204][T11294] Read of size 8 at addr ffff888029960790 by task v4l_id/11294 [ 530.290795][T11294] [ 530.293172][T11294] CPU: 1 UID: 0 PID: 11294 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 530.293201][T11294] Tainted: [L]=SOFTLOCKUP [ 530.293207][T11294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 530.293218][T11294] Call Trace: [ 530.293227][T11294] [ 530.293235][T11294] dump_stack_lvl+0xe8/0x150 [ 530.293264][T11294] print_report+0xba/0x230 [ 530.293282][T11294] ? v4l2_fh_open+0xac/0x420 [ 530.293304][T11294] kasan_report+0x117/0x150 [ 530.293327][T11294] ? v4l2_fh_open+0xac/0x420 [ 530.293350][T11294] v4l2_fh_open+0xac/0x420 [ 530.293372][T11294] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 530.293397][T11294] em28xx_v4l2_open+0x157/0x9a0 [ 530.293418][T11294] ? do_raw_spin_lock+0x12b/0x2f0 [ 530.293437][T11294] v4l2_open+0x1bf/0x3a0 [ 530.293463][T11294] chrdev_open+0x4cd/0x5e0 [ 530.293483][T11294] ? __pfx_chrdev_open+0x10/0x10 [ 530.293501][T11294] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 530.293520][T11294] ? __pfx_chrdev_open+0x10/0x10 [ 530.293537][T11294] do_dentry_open+0x785/0x14e0 [ 530.293564][T11294] vfs_open+0x3b/0x340 [ 530.293583][T11294] ? path_openat+0x2df0/0x3860 [ 530.293601][T11294] path_openat+0x2e08/0x3860 [ 530.293623][T11294] ? __pfx_stack_trace_save+0x10/0x10 [ 530.293640][T11294] ? stack_depot_save_flags+0x33/0x810 [ 530.293668][T11294] ? __pfx_path_openat+0x10/0x10 [ 530.293683][T11294] ? __x64_sys_openat+0x138/0x170 [ 530.293703][T11294] ? do_syscall_64+0x14d/0xf80 [ 530.293722][T11294] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.293740][T11294] ? __lock_acquire+0x6b5/0x2cf0 [ 530.293762][T11294] do_file_open+0x23e/0x4a0 [ 530.293780][T11294] ? __pfx_do_file_open+0x10/0x10 [ 530.293804][T11294] ? _raw_spin_unlock+0x28/0x50 [ 530.293820][T11294] ? alloc_fd+0x64b/0x6c0 [ 530.293845][T11294] do_sys_openat2+0x113/0x200 [ 530.293867][T11294] ? __pfx_do_sys_openat2+0x10/0x10 [ 530.293889][T11294] ? exc_page_fault+0x6a/0xc0 [ 530.293909][T11294] ? do_user_addr_fault+0xc6f/0x1340 [ 530.293930][T11294] __x64_sys_openat+0x138/0x170 [ 530.293954][T11294] do_syscall_64+0x14d/0xf80 [ 530.293973][T11294] ? trace_irq_disable+0x3b/0x150 [ 530.293986][T11294] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.294000][T11294] ? clear_bhb_loop+0x40/0x90 [ 530.294017][T11294] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.294032][T11294] RIP: 0033:0x7f11d60a7407 [ 530.294049][T11294] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 530.294063][T11294] RSP: 002b:00007ffe81d42110 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 530.294080][T11294] RAX: ffffffffffffffda RBX: 00007f11d6774880 RCX: 00007f11d60a7407 [ 530.294091][T11294] RDX: 0000000000000000 RSI: 00007ffe81d43f1e RDI: ffffffffffffff9c [ 530.294102][T11294] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 530.294110][T11294] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 530.294119][T11294] R13: 00007ffe81d42360 R14: 00007f11d68db000 R15: 000056512c00d4d8 [ 530.294136][T11294] [ 530.294142][T11294] [ 530.598777][T11294] Allocated by task 29: [ 530.602949][T11294] kasan_save_track+0x3e/0x80 [ 530.607660][T11294] __kasan_kmalloc+0x93/0xb0 [ 530.612261][T11294] __kmalloc_cache_noprof+0x31c/0x660 [ 530.617645][T11294] em28xx_v4l2_init+0x10b/0x2e70 [ 530.622598][T11294] em28xx_init_extension+0x120/0x1c0 [ 530.628087][T11294] process_scheduled_works+0xb6e/0x18c0 [ 530.633680][T11294] worker_thread+0xa53/0xfc0 [ 530.638379][T11294] kthread+0x388/0x470 [ 530.642625][T11294] ret_from_fork+0x51e/0xb90 [ 530.647225][T11294] ret_from_fork_asm+0x1a/0x30 [ 530.652097][T11294] [ 530.654596][T11294] Freed by task 29: [ 530.658402][T11294] kasan_save_track+0x3e/0x80 [ 530.663177][T11294] kasan_save_free_info+0x46/0x50 [ 530.668222][T11294] __kasan_slab_free+0x5c/0x80 [ 530.673022][T11294] kfree+0x1c1/0x630 [ 530.676933][T11294] em28xx_v4l2_init+0x1683/0x2e70 [ 530.681982][T11294] em28xx_init_extension+0x120/0x1c0 [ 530.687332][T11294] process_scheduled_works+0xb6e/0x18c0 [ 530.692900][T11294] worker_thread+0xa53/0xfc0 [ 530.697611][T11294] kthread+0x388/0x470 [ 530.701701][T11294] ret_from_fork+0x51e/0xb90 [ 530.706409][T11294] ret_from_fork_asm+0x1a/0x30 [ 530.711215][T11294] [ 530.713743][T11294] The buggy address belongs to the object at ffff888029960000 [ 530.713743][T11294] which belongs to the cache kmalloc-8k of size 8192 [ 530.727900][T11294] The buggy address is located 1936 bytes inside of [ 530.727900][T11294] freed 8192-byte region [ffff888029960000, ffff888029962000) [ 530.741986][T11294] [ 530.744544][T11294] The buggy address belongs to the physical page: [ 530.750995][T11294] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29960 [ 530.759997][T11294] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 530.768590][T11294] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 530.776149][T11294] page_type: f5(slab) [ 530.780157][T11294] raw: 00fff00000000040 ffff88813fea7280 dead000000000100 dead000000000122 [ 530.788785][T11294] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 530.797687][T11294] head: 00fff00000000040 ffff88813fea7280 dead000000000100 dead000000000122 [ 530.806371][T11294] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 530.815209][T11294] head: 00fff00000000003 ffffea0000a65801 00000000ffffffff 00000000ffffffff [ 530.823902][T11294] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 530.832586][T11294] page dumped because: kasan: bad access detected [ 530.839133][T11294] page_owner tracks the page as allocated [ 530.844870][T11294] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5846, tgid 5846 (syz-executor), ts 103677747835, free_ts 99574301312 [ 530.866513][T11294] post_alloc_hook+0x231/0x280 [ 530.871323][T11294] get_page_from_freelist+0x24dc/0x2580 [ 530.876963][T11294] __alloc_frozen_pages_noprof+0x18d/0x380 [ 530.882821][T11294] allocate_slab+0x77/0x660 [ 530.887373][T11294] refill_objects+0x331/0x3c0 [ 530.892078][T11294] __pcs_replace_empty_main+0x2e6/0x730 [ 530.897773][T11294] __kmalloc_noprof+0x474/0x760 [ 530.902724][T11294] ops_init+0x7b/0x5c0 [ 530.906823][T11294] setup_net+0x118/0x340 [ 530.911135][T11294] copy_net_ns+0x50e/0x730 [ 530.915616][T11294] create_new_namespaces+0x3e7/0x6a0 [ 530.921172][T11294] unshare_nsproxy_namespaces+0x11a/0x160 [ 530.927054][T11294] ksys_unshare+0x51d/0x930 [ 530.931812][T11294] __x64_sys_unshare+0x38/0x50 [ 530.936635][T11294] do_syscall_64+0x14d/0xf80 [ 530.941257][T11294] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.947280][T11294] page last free pid 5814 tgid 5814 stack trace: [ 530.953628][T11294] __free_frozen_pages+0xc2b/0xdb0 [ 530.958791][T11294] __folio_put+0x414/0x4f0 [ 530.963238][T11294] skb_release_data+0x4cb/0x940 [ 530.968127][T11294] __kfree_skb+0x5d/0x210 [ 530.972705][T11294] tcp_ack+0x2826/0x7da0 [ 530.977199][T11294] tcp_rcv_established+0x1478/0x2740 [ 530.982731][T11294] tcp_v4_do_rcv+0xa90/0x1430 [ 530.987714][T11294] __release_sock+0x265/0x3a0 [ 530.992619][T11294] release_sock+0x5f/0x1f0 [ 530.997077][T11294] sk_stream_wait_memory+0x72b/0xf80 [ 531.002409][T11294] tcp_sendmsg_locked+0x23ba/0x5490 [ 531.007653][T11294] tcp_sendmsg+0x2f/0x50 [ 531.011925][T11294] sock_write_iter+0x406/0x4f0 [ 531.016711][T11294] vfs_write+0x61d/0xb90 [ 531.021116][T11294] ksys_write+0x150/0x270 [ 531.025674][T11294] do_syscall_64+0x14d/0xf80 [ 531.030401][T11294] [ 531.032741][T11294] Memory state around the buggy address: [ 531.038483][T11294] ffff888029960680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 531.046762][T11294] ffff888029960700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 531.054913][T11294] >ffff888029960780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 531.063089][T11294] ^ [ 531.067699][T11294] ffff888029960800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 531.075908][T11294] ffff888029960880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 531.084114][T11294] ================================================================== [ 531.096987][ T29] em28xx 3-1:0.89: Registering snapshot button... [ 531.115894][ T29] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input22 [ 531.151604][ T5937] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 531.171378][ T29] em28xx 3-1:0.89: Remote control support is not available for this card. [ 531.181651][ T5923] em28xx 3-1:0.89: Closing input extension [ 531.193744][ T5923] em28xx 3-1:0.89: Deregistering snapshot button [ 531.314912][T11298] fuse: Bad value for 'fd' [ 531.527403][ T5937] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 531.574221][ T5937] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 531.585550][ T5937] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 531.623218][ T5937] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 531.643245][ T5937] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.664504][T11294] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 531.671794][T11294] CPU: 1 UID: 0 PID: 11294 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 531.682436][T11294] Tainted: [L]=SOFTLOCKUP [ 531.686824][T11294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 531.697012][T11294] Call Trace: [ 531.700388][T11294] [ 531.703368][T11294] vpanic+0x56c/0xa60 [ 531.707423][T11294] ? __pfx_vpanic+0x10/0x10 [ 531.712097][T11294] ? irqentry_exit+0x59e/0x620 [ 531.717110][T11294] panic+0xc5/0xd0 [ 531.720893][T11294] ? __pfx_panic+0x10/0x10 [ 531.725380][T11294] ? __pfx_panic+0x10/0x10 [ 531.729859][T11294] ? v4l2_fh_open+0xac/0x420 [ 531.734557][T11294] check_panic_on_warn+0x89/0xb0 [ 531.739558][T11294] ? v4l2_fh_open+0xac/0x420 [ 531.744298][T11294] end_report+0x73/0x180 [ 531.748595][T11294] ? v4l2_fh_open+0xac/0x420 [ 531.753241][T11294] kasan_report+0x128/0x150 [ 531.757806][T11294] ? v4l2_fh_open+0xac/0x420 [ 531.762447][T11294] v4l2_fh_open+0xac/0x420 [ 531.767124][T11294] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 531.773342][T11294] em28xx_v4l2_open+0x157/0x9a0 [ 531.778263][T11294] ? do_raw_spin_lock+0x12b/0x2f0 [ 531.783361][T11294] v4l2_open+0x1bf/0x3a0 [ 531.787885][T11294] chrdev_open+0x4cd/0x5e0 [ 531.792370][T11294] ? __pfx_chrdev_open+0x10/0x10 [ 531.797569][T11294] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 531.803977][T11294] ? __pfx_chrdev_open+0x10/0x10 [ 531.808974][T11294] do_dentry_open+0x785/0x14e0 [ 531.813794][T11294] vfs_open+0x3b/0x340 [ 531.817899][T11294] ? path_openat+0x2df0/0x3860 [ 531.822702][T11294] path_openat+0x2e08/0x3860 [ 531.827424][T11294] ? __pfx_stack_trace_save+0x10/0x10 [ 531.833191][T11294] ? stack_depot_save_flags+0x33/0x810 [ 531.838797][T11294] ? __pfx_path_openat+0x10/0x10 [ 531.844322][T11294] ? __x64_sys_openat+0x138/0x170 [ 531.849633][T11294] ? do_syscall_64+0x14d/0xf80 [ 531.854805][T11294] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.861282][T11294] ? __lock_acquire+0x6b5/0x2cf0 [ 531.866297][T11294] do_file_open+0x23e/0x4a0 [ 531.871151][T11294] ? __pfx_do_file_open+0x10/0x10 [ 531.876272][T11294] ? _raw_spin_unlock+0x28/0x50 [ 531.881206][T11294] ? alloc_fd+0x64b/0x6c0 [ 531.885593][T11294] do_sys_openat2+0x113/0x200 [ 531.890310][T11294] ? __pfx_do_sys_openat2+0x10/0x10 [ 531.895541][T11294] ? exc_page_fault+0x6a/0xc0 [ 531.900267][T11294] ? do_user_addr_fault+0xc6f/0x1340 [ 531.905594][T11294] __x64_sys_openat+0x138/0x170 [ 531.910736][T11294] do_syscall_64+0x14d/0xf80 [ 531.915950][T11294] ? trace_irq_disable+0x3b/0x150 [ 531.921021][T11294] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.927138][T11294] ? clear_bhb_loop+0x40/0x90 [ 531.931846][T11294] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.937954][T11294] RIP: 0033:0x7f11d60a7407 [ 531.942487][T11294] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 531.962648][T11294] RSP: 002b:00007ffe81d42110 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 531.971201][T11294] RAX: ffffffffffffffda RBX: 00007f11d6774880 RCX: 00007f11d60a7407 [ 531.979681][T11294] RDX: 0000000000000000 RSI: 00007ffe81d43f1e RDI: ffffffffffffff9c [ 531.987717][T11294] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 531.995893][T11294] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 532.004086][T11294] R13: 00007ffe81d42360 R14: 00007f11d68db000 R15: 000056512c00d4d8 [ 532.012123][T11294] [ 532.015801][T11294] Kernel Offset: disabled [ 532.020238][T11294] Rebooting in 86400 seconds..