last executing test programs: 3m19.954028855s ago: executing program 0 (id=3604): syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x802) io_setup(0x6, &(0x7f0000000140)=0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0xa0541, 0x0) r2 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0xc4bc, 0x10100, 0x0, 0xbe}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r2, 0x48eb, 0x1158, 0x2, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f00000008c0)=[{0x6, 0xfe}]}) bpf$MAP_CREATE(0x0, 0x0, 0x48) close_range(r5, 0xffffffffffffffff, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r1, &(0x7f0000000040)={0x2000000c}) epoll_ctl$EPOLL_CTL_MOD(r6, 0x3, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5-generic\x00'}, 0x5a) syz_clone(0x1002000, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = accept4(r7, 0x0, 0x0, 0x0) write(r8, &(0x7f0000000040)="cb", 0xfffffdef) write$rfkill(r1, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) io_submit(r0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r6, 0x0}]) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="040e040c122022"], 0x7) 3m19.338467234s ago: executing program 0 (id=3606): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0103000000000000000001000000050a03000000000000000000010020000900030073797a320000000014000000110001"], 0x68}}, 0x200000d4) (async) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000000380)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f00000000c0)='O', 0x1}], 0x1}}, {{&(0x7f0000000280)={0xa, 0x4e24, 0x5, @local, 0x6}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000d00)='\t', 0x1}], 0x1}}], 0x2, 0x0) (async) shutdown(r0, 0x1) (async, rerun: 32) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000006c0)={0x0, 0x1, 0xa7d7}, &(0x7f0000000700)=0x8) (rerun: 32) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000000c0)={0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="0000f50000000341e9"], 0x0}, 0x0) (async) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) (async, rerun: 64) syz_80211_inject_frame(&(0x7f0000000000)=@device_b, &(0x7f0000000140)=@mgmt_frame=@reassoc_resp={{{0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x74a}, @broadcast, @device_b, @random="8af12423a3d4", {0x8}, @value=@ver_80211n={0x0, 0x7ff1, 0x3, 0x3, 0x0, 0x0, 0x1}}, 0x4284, 0x52, @default, @void, @void, [{0xdd, 0x9d, "24566e1cd3ea18f91cbc57a1282c131834491b97ad051fcc490b2a486f51ace84f9e2ae8b7abe981c560057f581c270d45961262ede28ebed5a1df29b66427392a0c5fc315fa441bae7b3601ebc41e2233702597283049944c10933d7cb94b4f59c0e834eff02d5441de832ab16100e18c6537969062bdf8616c371a712feda4d5c36372edd9c8e5e552bfdffadaf682aa5aeb5789972f5c7283783193"}, {0xdd, 0x53, "4f94032e844701896c8f8f01adcc055862e4d0c6e32849709b43e9c6f69d1a2f65ec2328c928ae0ed79746545a0550b7ccb418075c262c439560be98df516930ca628fa8399bcbc509d7b91bcbe43d72253711"}, {0xdd, 0xc6, "30226b9ca53670588c8f637d0e05d4e5e3ce7be5b9f58f9485e9090ac376d5e6efd2b1dd0296a7275d5f1b752159e149a746d4878baa1aafb49ea05c8355a80829b0eb7587b14221d1b60b54f04a990bea227921308976256bd9262fd38c0525da574e791055515b8b1547f17b131c5a393ca4357fcb9baaa9671cc1cdf3f1ed9b795d548cfd1300091b2c04eb80d24243da9a0c9ad39af1ae4da439c13b24d5405e523fb984c588b8d83139998355e461eb4311a4bc78c1055b5da21d44a161ce13d97df491"}]}, 0x1de) (rerun: 64) 3m16.178362987s ago: executing program 0 (id=3618): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0xc0fe, &(0x7f0000000480)={&(0x7f00000001c0)=@ipv6_newroute={0x1c, 0x18, 0x111, 0xffffffff, 0x0, {0xa, 0x60, 0x0, 0x0, 0xff, 0x0, 0x0, 0x6}}, 0x1c}}, 0x0) 3m15.312865871s ago: executing program 0 (id=3620): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000140)) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) 3m14.262986324s ago: executing program 0 (id=3625): r0 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x800000, 0x10000}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000000240)={0x10, 0x0, 0xa03, 0x2}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x810000}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r5, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x4140045e}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x5) bind$netlink(r7, &(0x7f0000000080)={0x10, 0x0, 0x25dfdc00, 0x4000000}, 0xc) r8 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2}, 0xc) r9 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r9, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbff, 0x200000}, 0xc) r10 = socket$netlink(0x10, 0x3, 0x8) bind$netlink(r10, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r11 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r11, &(0x7f0000000340)={0x10, 0x0, 0x25dfdbfb, 0x200}, 0xc) socket$netlink(0x10, 0x3, 0x1) bind$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfb, 0x2}, 0xc) r12 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r12, &(0x7f0000000280)={0x10, 0x0, 0x25dfdbfe, 0x100000}, 0xc) bind$netlink(r1, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc) r13 = socket$netlink(0x10, 0x3, 0x4) writev(r13, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}], 0x1) 3m13.779497213s ago: executing program 0 (id=3626): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) connect$inet(0xffffffffffffffff, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140), 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x4, 0x530, 0xc, 0xfffffffffffffffd, 0x59c}) ioctl$SG_BLKTRACETEARDOWN(r2, 0x1276, 0x20000000) r3 = socket$kcm(0x10, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d800000019007b29e00212ba0d8105040a601100fe02040b067c55a1bc001400090006990600000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5000000000000", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x0) r4 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000640)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4], 0x20}, 0x1, 0x0, 0x0, 0x4001c000}, 0x0) listen(0xffffffffffffffff, 0x8) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)={0x14, 0x2, 0x6, 0x801}, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000004d040000000000002d000000000000005504030001ed0a0025000000170000001c0080ff000000007b0a00fe000000006e04000000000000e5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379d00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a607c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a59234ed56bc83987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d06c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292cfbe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d700ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec52d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d105800f000000000000ef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f6845b6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd51015dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d0800bf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3aee1ff8c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6b8306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9000080ac970cc4fd0847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000000000000000000000000000be9ab5e329e962d96a283b6182c1cf6c8e350a7784ca39ecb9178f4118559f1eccb0b738a255146ebbc4357c16f94cd4"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) 3m12.779478546s ago: executing program 32 (id=3626): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) connect$inet(0xffffffffffffffff, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140), 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x4, 0x530, 0xc, 0xfffffffffffffffd, 0x59c}) ioctl$SG_BLKTRACETEARDOWN(r2, 0x1276, 0x20000000) r3 = socket$kcm(0x10, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d800000019007b29e00212ba0d8105040a601100fe02040b067c55a1bc001400090006990600000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5000000000000", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x0) r4 = syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000640)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4], 0x20}, 0x1, 0x0, 0x0, 0x4001c000}, 0x0) listen(0xffffffffffffffff, 0x8) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)={0x14, 0x2, 0x6, 0x801}, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000004d040000000000002d000000000000005504030001ed0a0025000000170000001c0080ff000000007b0a00fe000000006e04000000000000e5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379d00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a607c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a59234ed56bc83987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d06c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292cfbe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d700ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec52d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d105800f000000000000ef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f6845b6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd51015dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d0800bf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3aee1ff8c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6b8306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9000080ac970cc4fd0847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000000000000000000000000000be9ab5e329e962d96a283b6182c1cf6c8e350a7784ca39ecb9178f4118559f1eccb0b738a255146ebbc4357c16f94cd4"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) 6.009025305s ago: executing program 4 (id=4390): fsopen(&(0x7f0000000080)='autofs\x00', 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) 5.852070291s ago: executing program 4 (id=4394): socket$inet6(0xa, 0x11, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x70bd2b, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7b, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x1a6c42) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000000c80)={r3, 0x0, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0xfffffffffffffffc]}}) r5 = dup(r4) write$UHID_INPUT(r5, &(0x7f0000001c00)={0x8, {"b0476b76ba5d044f65271519727e4ff1ff0d12c0e6bdf3ea1f52e24f60ca698457b32832b83d7e96694c1feb5809bd67002f71e0b97c0d5270c04ffa64f63b2e18ee4b7b572fe2f4d03cad38bcd106ff12f53b443ac6fc81da518f54b9004a44859529c07a2b1b8feddc0180a0f37b13babba1dd0813b7ea56dac4b7ffe9a2ef54221439ecc55223ef2d40f4ba8108c10387ddffbaed25d41e7692bf26ddfa747a666caff49843e38c86cac7323f784a17df6beaa49c3f4a98fb4013f4e573e2ef77b0965d4bfbdf7d5eada69406ca93f422495e00addfca1518085a40f10284ff59388ecf476a12ef1a540163922098d600519ae8cf3ef544344e9d968f341af618503b455f3976b76975270e94d714302382c63de5b7c1fad1fa373b369916cb3b4d583a9ebbaeb262884d25a0e1d9fb141de60df7e64cb38b6f7167991f8fba06bffe2d49133bbb462cd8a9493177eee5f03875b15c7a92c3cd6a3fdfc64f236e14fa05a0e8d3c45f13eecd22e13528c74186dc50e0e2af44177e26bded1161e5533375508dadb83db5126cc810f4e30d4e24ec12c3b99e5220aacf42c58f2960bd43c337dbd318aeeb5c9a6cd5ffd3bf1497bb48ab7bcb32c9c33c9f5b9bc4645b96f23f9e0d826b780030444ffb925f55df587ef5ca5ea74ccd66afc7981da496d6f037efbb0b08f3f5078c60ffb4db18d1b59996bd9b1513442785bf4ece8587b39d8176dc9c735d5ea25133b2053bba227b81faab7220326f8814a9df4eba4ecc6acdd82f70b653b56a18cc9dfa4deb0a112c797ab89a51a103c3a9085d828523370c4d79d9484f4dc910735a2c9b5b85197cd9c073df7a54b40df8e1bf595bab957900c2a1a7dc40e88ed0c55c362ffbb7f88a0725a6ae73b936a639e951faf9c45ae74a2ece2f6f88e425ee41d2c60cb083a2fd6d07381908a7f629e32f89a553cf0794f54b8bdc7bd541d88464a4f80ac0b8b625a803a55de4b05a95fc7f8fc3d6d79858ccb269b7b8b21657654164a9aa29f4e8462377e9d234a41ea69841a4aaa1e5f89f9b074f6f71cb1ffaa450c3160b0e319ec81ad30101db66218b0c69f97c234465dc45849fcfd62d396f2b50ddcc0ed7dd8651431534232ab6d1186d7760770a1fc6c77553a79d0297194f794997ee47781094a76d9dccf632dcbb527b3e68950d9bb534245c7f08ae1d6ef2750292ae28e5e6dcfe2a69737dd7a1e453f3902ae90789e98c212905422099904d3bfb949bde187682a59c01aa8e6a9972a63d6aaef4d4139b10a24e063707f1aba79bd59e3f9709a873dff401d1f356c4be5e449ae0e2633a1fe50ed367fe56b0499957c3b6cabb42256547995ea998f3937d153897d1c83f1ad922d6835bdfa3b986dc6f4bd927a4ca13fbaa99b7b43758e2329d588f40fac718b16cca855468643f3818496b4915fe9a2bdd3e68889fea24bc1dfa6287a801d49a7bb84654147448550d2919e4df3a943a88cf616befea4e7a4fddb7969311c6837f9529966241be1e57ed2d773debc542986d09866905a3f63b6e1820086d52a70f039154e839da7ea852c33bf3722a048f61bbf068519e050b8788370fb130a42e9f5322dfff65b15d588f9e926b70e4530e8b66697cabb1e8514831431fa0eaecb49f9613ed5fd7bc50f897bda36d24d4296e143e2480e325ec09a77c03a07b4f86eb703085313ebeee94ef5b1cde3f6a7efd785772eb4034039f598c07819b769416a223fab824c4ac50086e78042a1ccf47b6c7ede8540cded4bd4c920ce6c2b7493a5634c5e96bb761373623ab473b121d555bfd5a8bc3f5c5418bed83ffd0d6492840550fccc0c35746370396d0190b7b1d2cadcc150877e0d197f692f97cec790c95e3d3959dc7c68aca37306c1bc13ad33848395dba5e3c9ce8090bc0e7e8312091773641be56411921e3d473321c6d8bd10b7d3f5aedd6620bcaa06474bbb298bc77297b8b5dcb9e6b33dbe676460cca825609857724cee245306d07fda287d5fe57c424c27cf9b6cf0f16d2c6a8071bd57c826d7371841cf43dab1b42421ce416d0d3a9c80bc807d2e6761e53f06b3e63c0af1b4548d820118421205f040f4ab35307871e4c7a21ff28082c29e02e89486064661898c0eb1811c70a6124c1f25d62c38794a3e87c312c870db7b60d0df8b57860c94d1a9c561b327fae3a68ce9ff4551e418eb00766f0341c5e796e3cbbbe6b4864928b966110256d5475eb1fd7b2893b60e19e859baaf23c9233a1b064771671ee2d07c151e2e99c37a116a338788052a726a8519b8335e9ff4f71d00ab634543c20ddea1bf57d4f2b797182ff19618b6974d2b69d9f052934d527a1830bf2785842f35eaf32b65b7c9fdd6f0c41756072a59c0cce0b7305740729f1daa14e0092da9d022321b726d658fcef55affa2bbf36ad788f1f423b7dfd328435b4d5df315143d8b8028ba4bea6134a3dc9720c73d5e66b8b8168752eea6b78c75f04efd9677dbe419f13f5e1c9764276a83821b710307d8f85359b34d038ff17de45e8739d4b647fd1a8d794a3273d922af3374f5d3c75b8345b9dfdabb2c0418a358921e0e73d0fe88caab1741b913673e22ff4b59afa0f653a423d9b2bb20cbf07951a349eea18a891b4f4dc6df8e42a6181284f643de5fd2924ae54f672a1920343476c67333e1e8205bf4877b1251a83f417936714edb1c6975ba7969d2fcc2e69024a4669ac2f998116ade1bd84568b8f3f1fccbe95df9ed21db77315b7469f30bfae418415d9cb5aeea627ba6811e30d56d4f4bfe5f794ea4243e3cdfad3ef55199699b8433083b6f72f95effc5f2f613cfcefaf0b94e801ebcb7095a1474ee93142b82c9bf9886617b6bf69d08c83c76cd21d4cce5872d99de8e54bbff915ab923b2d24bb3aa178dd50b44fd0eb880ef33ca51d4bf5f0fbc8ffe18afe4245397f277e4efad955baa10cf56613481253d69c02e7661714b68be0fd64f29bdafbc8b4a0b30bd6709c67fe8e8915d0479b3902b1d0169fb5486b02e966ad5d8a2bcf42ecba59177cd85e17239667f6b045d1f873ce24733ae17e2d8432709062e786a32ac925121f1b0d46c66d4fb9088f4aa0cfe2149f6c2cb5b75d45349bc88fbd47e01ea07e7cd573335aab8d389846566800dd084bc3caa95f7632719c651f2d33be0fb56347c063b3c6e3e75c5e58caeb4c37574859b78c1ed018fbeed788a4305a9ee1c1ef65a0c83a7cd717a8c08ecd4e86370ffffd6d40a89a0b1e8c15a10ad5406e867e49319ad83bfbb925d5e240b4bd44fd751e7510d5ea03a6cab95f37155d1fd69aaea1db4a1f53714eb90e669209cf634f84a50c85bdc51838ebbb545b4387790df67f0122740c2abc910cf83230394172a56c9ffda6675bb8bb39846730a1bf764aeb92407c90a194da880cb8a4efb5b57a8311d864209c7fd226b93582b6b11eec559abfbba653c0569c219d3a2e60555cb739f9d32d564f23c4e98be78aa553610822af426f961df0df2185c61ccaa22b2a6aa6fb3e917bdfb2be9c3ffb8a50821321119c4cf4917db39548abc17bfba267fa50f6af15c560a21055f967f1ca6f656ddb556f9c7e17a771eeef7e80940d1c14ddf2c27647686fd0526460036aeea395fb10abef2be2ea96c9bb380370c08d1568d30eea0f3e6b7cf8f7edc7b36d4d0affd249330707b54ee620f208d885791171eb67a25a80fcc6922e0258c9673b6576564949dfa5bed9a0299bf952aade654de16e22d54fcd391ded6adab94ff621efcd91ef69acf8dfa1b22692ba3e49cd1d3fbed6db1402065ab37e457056877977ebac33ef566f28a19b9acb67a9cc53feb156814e880b3dd5a9119ffdbc5a45c20ea375f2882575b9a28740eebf63f2895d9ffac1ec33cbdcdede98a201424d000df1efd64dd7268cc1b2366ccfb09754822dafdb1821de5e6ebee09608e82e679fafb7a5100172f26998d31d7f27c2b310f0372c3b5e888f8e6efb56074177bf6a2a5bbd9ed070ad5aaf23ce144d1ac86cad110e5916a8a57e1e7fc3d37353f84f2f6d43d92ab8b35040467f3f8b1d23fac021bbac3710edc8e2e26d794db38e48020f63e94d4b4dca3e015537a8e3008274d55f81af931a0faf1a438444b6a0489b93f7b88f81f761eae0f82e60cb0cf2745ca8c9e30d3cc189c1405b1994ed71b00d90ea7a94102916cdc915620c363d04e51eabaaca6c2814a7c1e7aaeec80bdc13135b813e6d0eea83446a5c57ec29695c302c0d8da65b61fe8ada51a36e1aff34d449f9eb70cb94931226121ab121a971c2fc070ca84272d122c1696f52fbd5ed06783abe188dcf133c4d41e10295f6ffda69fa8c5a7c0fec3425a2d60523a60d280b5ce34eac5911268172e772fefba63a6f5c6dafa9e500a5e1355fb614613f8fc1ef5e5466fa19212bcdc349a865f4cee6ea80b11a410bb6e4ad677393973e38621d25ff6c4876ef8a8d2ba651be4a78d2ba9fafadcea8eff9cca3f4ab71a0b84917794e521220dad099ac8aaf32abd162348879e4299e4d46395f9d55267b635e18ca2e2fc96146b96c8a8055130b8d8cb10cc31382df34057bd8637f86e48adc854af408226752a04df8d0362db263e0959f2bd7e8a4d33a8c4b257e19d308280baf40cced1b3cd3a86ee22df0da49d750539eee1104e99a9f8a065e5499c73125a8a8430eda7aee156821a97c237611b50f682a2cccd0969304f0a50ae98800dfb32ee1bcfeab98182c34a51e67fa5bd738c22c44fc1269ce73f464edd2f31296e92e62df51cf55798ae2e3c33c57b09f4ecd13469122095a3563f95f0a04cf58dcea4aed5e8bdda7617863cbc37a97ebadb46d679f7e30014d96d0ac7ce9484368fa5fd19cbc3d139410a2bd7ffacef1bdf76dd1d5f34d2392fcb91c7585fc1ae7d8ba2aa8ded9645d5a5e76e2279b6e0692101137da946dfbd3836476f5dad7fed70115d716dce87b5ad755e5653a709f5aa42265ec9657ed406cc9256af3628c0116b8e1d23306983e9adbc19dec354870c98e2e76566895df933a80c4c36b617db4bbda1a4ca7d6c80a43734471fc92d0bdeacfc125dddd73febd8f7ef84f221d52ae71372cee802d59013a15958e850f8fdf46d8fd3b874633daf3b1f346470456c05722258480959dd6afcffa1f3f2ca033011339c5cb85b7d1c9b5916fb8dc9c2783df64eb5cca5af83a74fe5bb259f93722842eb4ac851e71f3cfd67a39590e7f8e20f018744b9277e6eb46b5f211df5f767ef29dc9a972e14c40ea2d4624f187f301c1116d3a61adeb5c6f7ccc021ac5e18d8b40d7f1f19daf4445c06e72db8701c267c0144c92cddd49af7a87aca5aa05d0e380dd27cc780d2f7db3bef26cc4fd358543e19d73179b879f7bdc702ab405270c93a3ed64153e20b5b663773a2ad4e8e3e1e8eaf39ec80d75d02f74ff94f0e095240a564eeece4fc9bcf19bf2243c700e1dae14a1b0217013977bfa05f681abc37714fe462d0a632044ce52fdaa1c1a806b1eb4370e23ca0247e536165aa9f1c2af8adfea369ee1f4a2c7823a7baef028a1e77501db48db6aa0d7e30969f7197368db02d443803b53b2899315f7e2ba9c5ae952a3866b4ea60f3d669e0a91f7ef640cd938646bf8822fe455f0302fccf87c7fad6daf38fde038fa596b83a9fd5bf675669a6cb2bab44c6617f07950bf34edb93bbcb4174630f275dbda7a0631c4b456e5f80eb6258c1874e77d426743e478917fe44b73dc203baa2cc442b84b5818409abae99d97a28754969bd393df", 0x1000}}, 0xfffffe38) r6 = socket(0x8000000010, 0x2, 0x0) write(r6, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9463cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r7 = socket(0x840000000002, 0x3, 0x100) connect$inet(r7, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r7, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r8, 0x8955, &(0x7f0000000180)={{0x2, 0x0, @remote}, {0x20000010304, @dev}, 0x4, {0x2, 0x0, @multicast1=0xe000cc02}}) 5.153980418s ago: executing program 5 (id=4398): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$igmp(0x2, 0x3, 0x2) syz_emit_ethernet(0x50, &(0x7f0000000440)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x6, 0x4, 0x0, 0x0, 0x42, 0x0, 0x20, 0xfc, 0x2, 0x0, @rand_addr=0x1c, @multicast1=0xe0000300, {[@timestamp={0x44, 0x4, 0x7f, 0x0, 0x9}]}}, @echo_reply={0x0, 0x0, 0x0, 0x67, 0x5, "5c1bda64d9bbb795506667f359c477398e7a5ec5cb38489b4507e009453d7b60d620"}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df05f496d0420922f45a71c1daa8b630468cd140526c41ef8d3a4a422", 0x3, 0x1, 0x85}, 0x3c) 4.83897829s ago: executing program 5 (id=4401): prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x1) socket$netlink(0x10, 0x3, 0x15) r3 = socket$rxrpc(0x21, 0x2, 0xa) syz_emit_vhci(&(0x7f0000000000)=ANY=[], 0xffffffffffffff2b) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r4, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r6 = syz_open_dev$dri(&(0x7f00000008c0), 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r6, 0xc0286405, &(0x7f0000000000)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x74}}, 0x0) bind$rxrpc(r3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f00000001c0)=@ethtool_gfeatures}) 4.092168497s ago: executing program 1 (id=4409): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[r1, 0x0], 0x2, 0x80800, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(r2, 0xc01464a6, &(0x7f0000000180)={r3}) 3.692425973s ago: executing program 1 (id=4412): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="940000000308010200000000000000000a000001050003003a0000000400048006000240892f000006000240886400003c000480080008400000000608000b400000000008000b400000000808000b400400e19e08000a400000a91908000a4000000ad4080004400000100006000240880900000500030006"], 0x94}}, 0x8084) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2300, 0x0) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000040)=0x1) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0x40047459, 0x0) 3.337992188s ago: executing program 3 (id=4414): ioprio_set$pid(0x2, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.253435568s ago: executing program 1 (id=4415): ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0x40405514, &(0x7f0000000540)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0xfffffffffffffe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x40, 0x8, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4000000000000000, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xc, 0x2, 0x0, 0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}) 2.892883322s ago: executing program 1 (id=4417): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 2.684117868s ago: executing program 2 (id=4418): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r0, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 2.625106075s ago: executing program 3 (id=4419): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='setgroups\x00') ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6680, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x29, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc80, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x1000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x389, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0xa842, 0x0) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) close_range(r0, 0xffffffffffffffff, 0x0) 2.453404969s ago: executing program 1 (id=4420): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendto$packet(r2, &(0x7f0000000280)="0f30", 0x2, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x24, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xfff1, 0xffff}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000800}, 0x88) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x2a, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x6}, {0x0, 0xffff}}}, 0x24}}, 0x0) 2.256553749s ago: executing program 1 (id=4421): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000080)={0x5, 0x2}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x8, @mcast2}, {0xa, 0x0, 0x7, @remote}, r2}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0xa, 0x3, 0x3, @local}, r2}}, 0x48) gettid() prlimit64(0x0, 0xe, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x48802) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_io_uring_setup(0x497, &(0x7f0000000200)={0x0, 0xba7b, 0x0, 0x4, 0x2c}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) r9 = syz_open_dev$usbmon(0x0, 0x51c, 0x4000) ioctl$MON_IOCT_RING_SIZE(r9, 0x9204, 0xf0ffa) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x2}}) io_uring_enter(r6, 0x3516, 0x0, 0x0, 0x0, 0x0) 2.170072342s ago: executing program 2 (id=4422): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[r1, 0x0], 0x2, 0x80800, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) ioctl$DRM_IOCTL_MODE_GETENCODER(r2, 0xc01464a6, &(0x7f0000000180)={r3}) 2.169145882s ago: executing program 3 (id=4423): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$sysfs(0xffffff9c, &(0x7f0000000180)='/sys/power/pm_debug_messages', 0x42a00, 0x40) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3c, [0x8000, 0xc95a, 0xf, 0x2, 0x6fba950d, 0x2, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x6, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0xf, 0x3, 0x0, 0x5, 0x2c, 0x1, 0x7, 0x3c5b, 0x1, 0x20, 0x81, 0x7e, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x5, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x407, 0x6, 0x3f, 0x8f, 0x4006, 0x6, 0x0, 0xffffffff, 0x4, 0x8, 0x400, 0x10000080, 0x0, 0x5, 0x7, 0x8, 0x4, 0x0, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xb, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x30f, 0x10, 0xea4, 0x7, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0xfffffffc, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x2, 0x5, 0x3, 0x9, 0x2, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x8], [0x4, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x3, 0x0, 0x7fff, 0x0, 0x5, 0x8000000b, 0x40000004, 0x9, 0x55f, 0x4, 0x1ef, 0x8, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x5, 0x1, 0x800003, 0x4000200, 0x80, 0x3, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x8005, 0x9, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x4800000, 0x0, 0x5, 0x1c, 0x120000, 0x0, 0x2006, 0x80a2ed, 0x4, 0x1ff], [0x9, 0xbb33, 0x7, 0xb, 0x7fff, 0x938, 0x6, 0x6, 0x4, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x2, 0x3, 0x101, 0x8, 0x5, 0xfffffff9, 0xffff, 0x2000a620, 0x2, 0x5, 0xfffffffd, 0x2, 0x5, 0xe7, 0x6, 0x3, 0xffffffff, 0x80000003, 0x5, 0x4, 0xc8, 0xa, 0x3, 0x10000, 0x7, 0x7e, 0x100, 0x7f, 0x107, 0x2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x4a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) socket$inet_sctp(0x2, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) mkdirat(0xffffffffffffff9c, 0x0, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x6}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fffffff, 0x2) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000080)={0x3}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_UNLINK(r4, 0x40044160, 0x3) r5 = accept4(r3, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) sendmmsg$unix(r5, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) 1.981149108s ago: executing program 2 (id=4424): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x760, 0x103382) ioctl$LOOP_SET_STATUS(r0, 0x1277, &(0x7f0000000200)={0x0, {}, 0x0, {}, 0x0, 0x0, 0xc, 0x9, "4b8b3ea46929dfed0b2f34380d308f95a023d009852471dd5a94a9fe9549918ae7fd1f0ececd9bada8b108403362cfe0f4fccffb1b6a2115354d4df15d017a3f", "2363f18d9acc6c25af21ca2af6d2e80e4caadd6d126cfb80c92dc817d44dcdec", [0x1, 0x9]}) 1.56361678s ago: executing program 2 (id=4425): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="940000000308010200000000000000000a000001050003003a0000000400048006000240892f000006000240886400003c000480080008400000000608000b400000000008000b400000000808000b400400e19e08000a400000a91908000a4000000ad4080004400000100006000240880900000500030006"], 0x94}}, 0x8084) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2300, 0x0) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000040)=0x1) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0x40047459, 0x0) 1.320999688s ago: executing program 2 (id=4426): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x87f}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8080}, 0x40020) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000600)=@newtfilter={0x88c, 0x2c, 0xd27, 0x70bd25, 0x5, {0x0, 0x0, 0x0, r3, {0x0, 0xfffc}, {}, {0x4, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x858, 0x2, [@TCA_BPF_POLICE={0x848, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0xe, 0x7, 0x4, 0xc, 0x9, {0xd, 0x2, 0x4, 0x4, 0x7, 0x401}, {0x4, 0x1, 0x5, 0x10, 0xfff7, 0x4b2}, 0x6, 0x14ff, 0x3ff}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x38, 0x1, 0x1, 0x8, 0x7f, 0xa, 0x3, 0x6, 0x1, 0x95, 0x9, 0x6, 0x1, 0x9, 0x5f, 0x0, 0x0, 0x13f, 0xfffffffe, 0x0, 0xd31, 0xf54, 0xc, 0x4, 0x4, 0x6, 0x9, 0x7fffffff, 0xfffffffd, 0x7fffffff, 0x8, 0x0, 0xfffffffe, 0x5, 0x5dbd0fd8, 0x8, 0x1887, 0x2, 0x95f, 0x7, 0x6, 0xa, 0x7f, 0xfffffffe, 0x8, 0x2, 0x6, 0x4, 0x6, 0x402f, 0xd, 0x5, 0x6f9d, 0x0, 0x800, 0x3ff, 0x8, 0xa, 0x9, 0x4, 0xd, 0x3, 0xb8f, 0x6, 0x0, 0xffffffff, 0x8000, 0xffffffff, 0x8, 0xfffffffc, 0xee, 0x4, 0x9, 0x2, 0x54eef178, 0xc, 0x9, 0x5, 0xe2, 0x20004, 0x1, 0xffff, 0x5, 0x5, 0x7, 0x5, 0x7, 0x4, 0x4, 0x7, 0x100, 0x8, 0x2, 0x9, 0x0, 0x0, 0xe32, 0x6, 0x8, 0x6, 0x66, 0x7, 0x7, 0x8, 0x5b, 0x7625, 0x51, 0x6, 0xfffffffe, 0x0, 0xa4d, 0x2, 0x10001, 0x7, 0x8, 0x3, 0x8, 0x3, 0x6, 0x6, 0xffffffff, 0x3, 0x0, 0x400000, 0xc55b, 0x8000, 0xf943, 0x4, 0x3000000, 0x2, 0x10000, 0xd, 0xffffffff, 0x9, 0xd3, 0xfffffffb, 0x4, 0x80000001, 0x401, 0x82baa23, 0xd, 0x0, 0x6, 0x21a, 0xf, 0x1, 0x1430, 0x8, 0x4, 0x7, 0xe, 0x7dab, 0x4, 0x5, 0x4, 0x3, 0xfffffffe, 0x7, 0x6, 0x8ef6, 0x7239, 0x80000001, 0x0, 0xd41, 0x6, 0x2, 0x4, 0x200, 0x8, 0x5, 0xc14, 0x7324, 0x4, 0x50f6, 0x5, 0x4, 0x3, 0x2, 0x7, 0x4, 0x6, 0x5, 0x3, 0x7767, 0x8, 0xe0ba, 0x4f, 0x3, 0x4, 0x7, 0x7fffffff, 0x3, 0x3, 0x5, 0x8, 0x4, 0x80, 0x401, 0x7, 0x1, 0x0, 0x8, 0x7c4, 0x3, 0x6, 0x6, 0xe8, 0x0, 0x6, 0x6, 0x3, 0x8a4, 0x5, 0x9, 0x9, 0x9, 0x200, 0x7, 0xd235, 0x9, 0x7fffffff, 0xf7d, 0x7ffd, 0x2, 0x7fff, 0x9f7c, 0x7, 0x4, 0xf, 0x5, 0x2, 0x6, 0x400, 0x5, 0x80, 0x400, 0x5, 0xc, 0xff, 0xffff7002, 0x63c, 0x9, 0x1ff, 0xfff, 0x8, 0x8c, 0x40, 0x8, 0xed6, 0xf6, 0x0, 0x3, 0x9, 0x10, 0x9, 0x6]}, @TCA_POLICE_RATE={0x404, 0x2, [0x8, 0x6, 0x8, 0x8000, 0x8, 0x2, 0x9, 0x5, 0xfff, 0x3, 0x101, 0xbf7, 0x8, 0xff, 0x6, 0x113, 0xffff, 0x1, 0x8, 0x200, 0x6, 0x9, 0x33, 0x5, 0x2f7, 0x100, 0x21, 0x4, 0x7, 0xff, 0x6, 0xfffffffe, 0x7, 0x8, 0x1, 0x8, 0xf33c, 0x3, 0x1, 0x7ffffffc, 0x4, 0x3, 0xdb2, 0x0, 0xe00, 0x4, 0x2, 0x3, 0x2, 0xfffffff6, 0x5, 0x1, 0x7, 0x8, 0x1, 0x7f, 0x8, 0x6, 0x4, 0x3, 0xfffffffe, 0x803, 0x1, 0x5, 0x0, 0x8000, 0xfffffffa, 0xb7, 0xc8b6f5a2, 0x6, 0x2f, 0x7ff, 0x9, 0x8, 0x6, 0x0, 0x8, 0x9, 0x0, 0x5, 0x8b34, 0x2, 0x7e, 0x4, 0x4, 0xfeffffff, 0x1, 0xa, 0xfffffffb, 0x3, 0x80000001, 0x0, 0x4, 0x9, 0x7, 0x4, 0x3, 0x8, 0x9, 0x8, 0x2de0, 0x5191, 0x6, 0x1401, 0x7, 0x9, 0x7, 0x3, 0x6, 0x1, 0xfffffffb, 0xb839, 0xfffffffa, 0x4, 0x768, 0x7, 0x7f, 0x6, 0x7, 0x4, 0x8b, 0x4, 0x0, 0x5, 0xf0, 0x42490, 0xd, 0x3, 0x5c, 0x1, 0x2, 0x800, 0x8, 0x6, 0xff, 0xffff0000, 0x3, 0x10000, 0x80000001, 0x5, 0xffffffff, 0x4be24694, 0x2, 0x2, 0x100, 0x5, 0x1, 0x7, 0x4, 0xffffff95, 0x5, 0x0, 0xc, 0x6, 0x1000, 0xa, 0x7, 0x4, 0x340, 0x0, 0x0, 0x7, 0x101, 0x2, 0x7ce2352, 0x7fffffff, 0x5e, 0x8e5b, 0x3, 0x8, 0x9, 0x1, 0x80000000, 0x7, 0x301, 0x91, 0x3, 0x80000001, 0x9, 0x1, 0x3e79, 0xffffffff, 0x8, 0x525, 0x7, 0x6, 0x2470a614, 0xe, 0x8, 0x5, 0x7, 0x0, 0x5, 0x4, 0x1, 0x1, 0xfffffc1f, 0x6, 0x2, 0x1, 0x9, 0x7fff, 0xffffffff, 0x4, 0xffff2b7d, 0x4, 0xcdff, 0x9, 0x0, 0x49, 0x6, 0x0, 0x5, 0x9, 0x1, 0x8, 0x7, 0xea, 0x7, 0x7, 0x2, 0x5, 0xff, 0x6, 0xffff, 0x4cd, 0x7, 0x3, 0x3, 0x10001, 0x0, 0x6, 0x7, 0xffffffff, 0xe000000, 0x1, 0x4, 0x7, 0x8, 0xb, 0x7, 0x0, 0xcb65, 0x6, 0xe, 0x240000, 0x9, 0x8, 0x8, 0xfffffff8, 0x9, 0xf, 0x8, 0x5, 0x9, 0x100]}]}, @TCA_BPF_OPS={{0x6}, {0x4}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0x10}}]}, 0x88c}, 0x1, 0x0, 0x0, 0xc004884}, 0x0) 1.113000585s ago: executing program 3 (id=4427): r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f00000009c0)={&(0x7f00000000c0)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x20044818) sendmsg$sock(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000080)=[@timestamping={{0x14, 0x1, 0x25, 0x303}}], 0x18}, 0x4000081) 988.851818ms ago: executing program 2 (id=4428): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000400)={0xf0f020}) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000005dc0)={0x0, 0x0, &(0x7f0000005d80)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00\x00'], 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x44814) r1 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r2 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xa) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000300)="6c40f17773e937dfe9109c9b0f013c9720622990efc3eee4568a7a2d31258e18a839e57e6c61fde1627d869cf0f5417a7d1d14e206f7670e76217cd70d6a9b0aa5f790e9052ab0b72c06d000a5c72908") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) ioctl$SNDRV_PCM_IOCTL_REWIND(0xffffffffffffffff, 0xc0844123, &(0x7f0000000180)=0x4) sendfile(r4, r3, &(0x7f00000000c0)=0x58, 0x5) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x11, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000e9050000000000000004000018110000", @ANYRES32=r3, @ANYBLOB="0100000000000000b7080000040000007b8af8ff00000000bfa200000000000007020000f8ffffffb70300000800000200000000000000008500003816000000181200001497f0e40527c1c64e7409a43d950fa566bf0b", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x3e, &(0x7f00000002c0)=""/62, 0x41000, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0x1, 0x2}, 0x8, 0x10, &(0x7f00000003c0)={0x0, 0x5, 0x0, 0x9}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000500)=[r3, 0xffffffffffffffff, r3, r3, r3, r3, r3, r3], &(0x7f0000000540)=[{0x0, 0x3, 0x4, 0xb}, {0x2, 0x5, 0x7, 0x4}, {0x3, 0x4e7, 0xf}, {0x4, 0x4, 0x7, 0x5}, {0x2, 0x4, 0x7, 0x7}, {0x3, 0x4, 0x4, 0xb}, {0x4, 0x5, 0xb, 0x3}, {0x1, 0x1, 0x4, 0x1}, {0x4, 0x4, 0xe, 0xa}], 0x10, 0x400, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r5, 0x0, 0x30, 0x9, @void}, 0xfffffffffffffc75) open$dir(&(0x7f0000000240)='./file0\x00', 0x20e02, 0x0) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000007fc0)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000100)=0x10) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040), 0x55af) 903.285321ms ago: executing program 5 (id=4429): sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40840) r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0x80000}}}, 0x108) r2 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000440)={'syz_tun\x00', 0x101}) 885.93241ms ago: executing program 4 (id=4430): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 707.401383ms ago: executing program 5 (id=4431): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendto$packet(r2, &(0x7f0000000280)="0f30", 0x2, 0x0, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x24, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xfff1, 0xffff}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000800}, 0x88) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x2a, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x6}, {0x0, 0xffff}}}, 0x24}}, 0x0) 641.521582ms ago: executing program 4 (id=4432): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r0, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 483.018197ms ago: executing program 5 (id=4433): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x24}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bind$inet6(0xffffffffffffffff, 0x0, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x40806685, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x2}]}, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @local}}, {0x14, 0x2, @in={0x2, 0x0, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x60, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x4c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a300000000000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000100000000000000014100000018001700000000000000006574683a7465616d30000000"], 0x34}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f00000000c0)={0x1, @vbi={0xe, 0xfffff800, 0x31384142, 0x33363248, [0x4, 0xa], [0x58e3, 0x741], 0x1}}) close_range(r5, 0xffffffffffffffff, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_HIDDEN_SSID={0xa, 0x7e, @default_ibss_ssid}, @NL80211_ATTR_HANDLE_DFS={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x891}, 0x44080) sendmsg$nl_generic(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)={0x2c, 0x3e, 0x107, 0x70bd2d, 0x25dfdbfc, {0x4, 0x7c}, [@typed={0x4}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @ipv4=@local}, @typed={0x8, 0x13, 0x0, 0x0, @u32=0x7fffffff}]}]}, 0x2c}}, 0x0) 368.729065ms ago: executing program 4 (id=4434): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000080fcdbdf254400000008000300", @ANYRES32, @ANYBLOB="24002380060019004700000008000b"], 0x40}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) 132.615656ms ago: executing program 3 (id=4435): ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x1277, &(0x7f0000000200)={0x0, {}, 0x0, {}, 0x0, 0x0, 0xc, 0x9, "4b8b3ea46929dfed0b2f34380d308f95a023d009852471dd5a94a9fe9549918ae7fd1f0ececd9bada8b108403362cfe0f4fccffb1b6a2115354d4df15d017a3f", "2363f18d9acc6c25af21ca2af6d2e80e4caadd6d126cfb80c92dc817d44dcdec", [0x1, 0x9]}) 111.856025ms ago: executing program 4 (id=4436): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="940000000308010200000000000000000a000001050003003a0000000400048006000240892f000006000240886400003c000480080008400000000608000b400000000008000b400000000808000b400400e19e08000a400000a91908000a4000000ad4080004400000100006000240880900000500030006"], 0x94}}, 0x8084) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2300, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0x40047459, 0x0) 8.949534ms ago: executing program 5 (id=4437): r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r1, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x2], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x400]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x401}]}]}]}}, @TCA_RATE={0x6, 0x5, {0x8, 0x3}}]}, 0xac}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 0s ago: executing program 3 (id=4438): r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000040)={&(0x7f0000001800)=[{0x8, 0x2800, 0x0, 0x0}, {0x9, 0x800, 0x1, &(0x7f0000001600)="e9"}], 0x2}) kernel console output (not intermixed with test programs): ] ? clear_bhb_loop+0x60/0xb0 [ 1112.192437][T19070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1112.192451][T19070] RIP: 0033:0x7f02cf18e969 [ 1112.192465][T19070] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1112.192479][T19070] RSP: 002b:00007f02cffdc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1112.192495][T19070] RAX: ffffffffffffffda RBX: 00007f02cf3b5fa0 RCX: 00007f02cf18e969 [ 1112.192526][T19070] RDX: 0000200000001ac0 RSI: 0000000000004c0a RDI: 000000000000000a [ 1112.192536][T19070] RBP: 00007f02cffdc090 R08: 0000000000000000 R09: 0000000000000000 [ 1112.192547][T19070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1112.192556][T19070] R13: 0000000000000000 R14: 00007f02cf3b5fa0 R15: 00007f02cf4dfa28 [ 1112.192580][T19070] [ 1112.193062][T19070] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1112.309872][ T5888] usb 6-1: Using ep0 maxpacket: 8 [ 1112.453220][T18828] usb 4-1: config 0 has no interfaces? [ 1112.734773][ T5888] usb 6-1: config 0 has an invalid interface number: 25 but max is 0 [ 1112.751052][T19070] loop6: detected capacity change from 0 to 524287999 [ 1112.780689][ T5888] usb 6-1: config 0 has no interface number 0 [ 1112.857765][ T5888] usb 6-1: config 0 interface 25 altsetting 6 endpoint 0x8 has invalid maxpacket 544, setting to 64 [ 1112.901719][ T5888] usb 6-1: config 0 interface 25 has no altsetting 0 [ 1112.937304][ T5888] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1c00, bcdDevice=b4.82 [ 1112.973956][ T5888] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1112.996555][ T5888] usb 6-1: Product: syz [ 1113.004655][ T5888] usb 6-1: Manufacturer: syz [ 1113.009395][ T5888] usb 6-1: SerialNumber: syz [ 1113.039636][T18829] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1113.056878][ T5888] usb 6-1: config 0 descriptor?? [ 1113.057560][T18829] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 1113.077097][T18829] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1113.098508][T18829] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 1113.114625][T18828] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1113.124490][T18828] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1113.143364][T18829] usb 2-1: USB disconnect, device number 111 [ 1113.158068][T18828] usb 4-1: Product: syz [ 1113.162963][T18828] usb 4-1: Manufacturer: syz [ 1113.168019][T18828] usb 4-1: SerialNumber: syz [ 1113.202369][T18828] usb 4-1: config 0 descriptor?? [ 1113.379234][T19079] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3939'. [ 1113.506248][T19063] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1113.527909][T19063] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1113.558198][ T5888] usb 6-1: bad CDC descriptors [ 1113.565469][ T5888] cp210x 6-1:0.25: cp210x converter detected [ 1113.581796][ T5888] cp210x 6-1:0.25: failed to get vendor val 0x370b size 1: -71 [ 1113.589386][ T5888] cp210x 6-1:0.25: querying part number failed [ 1113.621381][ T5888] usb 6-1: cp210x converter now attached to ttyUSB0 [ 1113.649407][ T5888] usb 6-1: USB disconnect, device number 24 [ 1113.688796][ T5888] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1113.710926][ T5888] cp210x 6-1:0.25: device disconnected [ 1114.068576][T19089] ptrace attach of "./syz-executor exec"[5849] was attempted by "./syz-executor exec"[19089] [ 1114.324297][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 1114.324318][ T30] audit: type=1400 audit(1748649956.768:3081): apparmor="DENIED" operation="setprocattr" info="exec" error=-22 profile="unconfined" pid=19090 comm="syz.2.3942" [ 1114.540445][T19098] fuse: Invalid rootmode [ 1114.679585][T18828] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1114.875073][T19100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1114.883284][T18828] usb 6-1: Using ep0 maxpacket: 8 [ 1114.902001][T19100] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1114.933445][T18828] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x73, changing to 0x3 [ 1114.964781][ T977] usb 4-1: USB disconnect, device number 32 [ 1114.990245][T18828] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1115.054893][T18828] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1115.099961][T18828] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1115.129975][T18828] usb 6-1: Product: syz [ 1115.134203][T18828] usb 6-1: Manufacturer: syz [ 1115.138835][T18828] usb 6-1: SerialNumber: syz [ 1115.183847][T18828] usb 6-1: config 0 descriptor?? [ 1115.195836][T19104] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 1115.205303][T18828] streamzap 6-1:0.0: streamzap_probe: endpoint doesn't match input device 0203 [ 1115.442084][ T5888] usb 6-1: USB disconnect, device number 25 [ 1115.698367][T19114] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1115.973049][T18828] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1116.081960][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.088711][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.129618][T18828] usb 2-1: device descriptor read/64, error -71 [ 1116.271757][T18829] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1116.363561][T19125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1116.378538][T19125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1116.386643][T18828] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 1116.409852][T18831] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1116.419950][T18829] usb 4-1: device descriptor read/64, error -71 [ 1116.520748][T18828] usb 2-1: device descriptor read/64, error -71 [ 1116.579569][T18831] usb 6-1: Using ep0 maxpacket: 8 [ 1116.606087][T18831] usb 6-1: config 0 has an invalid interface number: 25 but max is 0 [ 1116.629978][T18831] usb 6-1: config 0 has no interface number 0 [ 1116.636094][T18831] usb 6-1: config 0 interface 25 altsetting 6 endpoint 0x8 has invalid maxpacket 544, setting to 64 [ 1116.661925][T18829] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1116.671195][T18828] usb usb2-port1: attempt power cycle [ 1116.677027][T18831] usb 6-1: config 0 interface 25 has no altsetting 0 [ 1116.704850][T18831] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1c00, bcdDevice=b4.82 [ 1116.714479][T18831] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1116.729590][T18831] usb 6-1: Product: syz [ 1116.733764][T18831] usb 6-1: Manufacturer: syz [ 1116.751132][T18831] usb 6-1: SerialNumber: syz [ 1116.763368][T18831] usb 6-1: config 0 descriptor?? [ 1116.829726][T18829] usb 4-1: device descriptor read/64, error -71 [ 1116.985969][T18829] usb usb4-port1: attempt power cycle [ 1116.994906][T19129] fuse: Bad value for 'rootmode' [ 1117.050171][T18828] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 1117.092684][T18828] usb 2-1: device descriptor read/8, error -71 [ 1117.178740][T19123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1117.190408][T19123] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1117.213097][T18831] usb 6-1: bad CDC descriptors [ 1117.218738][T18831] cp210x 6-1:0.25: cp210x converter detected [ 1117.228540][T18831] cp210x 6-1:0.25: failed to get vendor val 0x370b size 1: -71 [ 1117.237205][T18831] cp210x 6-1:0.25: querying part number failed [ 1117.254248][T18831] usb 6-1: cp210x converter now attached to ttyUSB0 [ 1117.268998][T18831] usb 6-1: USB disconnect, device number 26 [ 1117.275119][T18830] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 1117.293943][T18831] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1117.307622][T18831] cp210x 6-1:0.25: device disconnected [ 1117.340832][T18829] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 1117.359971][T18828] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 1117.380672][T18829] usb 4-1: device descriptor read/8, error -71 [ 1117.387355][T18828] usb 2-1: device descriptor read/8, error -71 [ 1117.413437][T19135] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1117.423807][T19135] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1117.440103][T18830] usb 5-1: Using ep0 maxpacket: 8 [ 1117.446940][T18830] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1117.454961][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1117.466286][T18830] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1117.478655][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1117.490556][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1117.503972][T18828] usb usb2-port1: unable to enumerate USB device [ 1117.511779][T18830] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1117.519212][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1117.530869][T18830] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1117.542655][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1117.553778][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1117.566737][T18830] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1117.574737][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1117.586022][T18830] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1117.597979][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1117.609077][T18830] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1117.624164][T18830] usb 5-1: string descriptor 0 read error: -22 [ 1117.630463][T18829] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 1117.638275][T18830] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1117.647687][T18830] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1117.667631][T18830] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1117.675869][T18829] usb 4-1: device descriptor read/8, error -71 [ 1117.799622][T18829] usb usb4-port1: unable to enumerate USB device [ 1117.833986][T19140] netlink: 'syz.5.3960': attribute type 10 has an invalid length. [ 1117.854128][T19140] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1118.234824][T19144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1118.261520][T19144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1118.308520][T19144] netlink: 'syz.2.3961': attribute type 1 has an invalid length. [ 1118.333063][T19144] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3961'. [ 1119.055582][T19152] fuse: Bad value for 'user_id' [ 1119.069033][T19152] fuse: Bad value for 'user_id' [ 1119.321990][T18828] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 1119.375288][T19161] fuse: Bad value for 'rootmode' [ 1119.494327][T18828] usb 2-1: New USB device found, idVendor=0545, idProduct=808b, bcdDevice=31.ad [ 1119.518158][T18828] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1119.546253][T18828] usb 2-1: config 0 descriptor?? [ 1119.581725][T18828] gspca_main: tv8532-2.14.0 probing 0545:808b [ 1119.781081][T19153] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3964'. [ 1120.300225][ T5888] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1120.480413][T19171] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3971'. [ 1120.519747][ T5888] usb 6-1: Using ep0 maxpacket: 8 [ 1120.538600][ T5888] usb 6-1: config 0 has no interfaces? [ 1120.574684][ T5888] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ee [ 1120.592177][T19172] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1120.621790][ T5888] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1120.683750][ T5888] usb 6-1: Product: syz [ 1120.724409][ T5888] usb 6-1: Manufacturer: syz [ 1120.729029][ T5888] usb 6-1: SerialNumber: syz [ 1120.777141][ T5888] usb 6-1: config 0 descriptor?? [ 1121.085615][ T5888] usb 6-1: USB disconnect, device number 27 [ 1121.361745][T19185] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1121.720056][T18829] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 1121.862574][T19196] netlink: 'syz.2.3977': attribute type 1 has an invalid length. [ 1121.883423][T19196] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3977'. [ 1121.892758][T18829] usb 4-1: device descriptor read/64, error -71 [ 1122.019335][T19198] fuse: Bad value for 'user_id' [ 1122.042203][T19198] fuse: Bad value for 'user_id' [ 1122.129897][T18829] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 1122.290570][ T5888] usb 5-1: USB disconnect, device number 2 [ 1122.299653][T18829] usb 4-1: device descriptor read/64, error -71 [ 1122.488049][T18829] usb usb4-port1: attempt power cycle [ 1122.700791][T19209] fuse: Bad value for 'rootmode' [ 1122.850111][T18828] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1122.950193][T18829] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 1122.990156][T18829] usb 4-1: device descriptor read/8, error -71 [ 1123.053253][T19212] fuse: Bad value for 'user_id' [ 1123.092910][T18828] usb 5-1: no configurations [ 1123.097647][T18828] usb 5-1: can't read configurations, error -22 [ 1123.119597][T19212] fuse: Bad value for 'user_id' [ 1123.259620][T18829] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 1123.299818][T18828] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1123.309650][T18829] usb 4-1: device descriptor read/8, error -71 [ 1123.434433][T18829] usb usb4-port1: unable to enumerate USB device [ 1123.453643][ T30] audit: type=1326 audit(1748649965.898:3082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1123.458715][T19217] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3984'. [ 1123.478732][T18828] usb 5-1: no configurations [ 1123.526854][T18828] usb 5-1: can't read configurations, error -22 [ 1123.579636][T18828] usb usb5-port1: attempt power cycle [ 1123.587243][T19218] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3984'. [ 1123.615266][ T30] audit: type=1326 audit(1748649965.898:3083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1123.748538][ T30] audit: type=1326 audit(1748649965.898:3084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1123.854370][ T30] audit: type=1326 audit(1748649965.898:3085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1123.963183][ T30] audit: type=1326 audit(1748649965.898:3086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1124.003999][ T30] audit: type=1326 audit(1748649965.898:3087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1124.005211][T18828] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 1124.114467][ T30] audit: type=1326 audit(1748649965.898:3088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1124.212250][ T30] audit: type=1326 audit(1748649965.898:3089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1124.232102][T18828] usb 5-1: no configurations [ 1124.264327][T18828] usb 5-1: can't read configurations, error -22 [ 1124.311469][ T30] audit: type=1326 audit(1748649965.898:3090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1124.344660][ T30] audit: type=1326 audit(1748649965.898:3091): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19216 comm="syz.1.3984" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1124.439912][T18828] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1124.469691][ T9] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1124.511340][T18828] usb 5-1: no configurations [ 1124.516014][T18828] usb 5-1: can't read configurations, error -22 [ 1124.544800][T18828] usb usb5-port1: unable to enumerate USB device [ 1124.620254][T19228] ALSA: mixer_oss: invalid OSS volume '' [ 1124.633241][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 1124.683034][ T5888] usb 2-1: USB disconnect, device number 116 [ 1124.695626][ T9] usb 6-1: config 0 has an invalid interface number: 23 but max is 0 [ 1124.724259][ T9] usb 6-1: config 0 has no interface number 0 [ 1124.758088][ T9] usb 6-1: config 0 interface 23 has no altsetting 0 [ 1124.788642][ T9] usb 6-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice=f9.bf [ 1124.818223][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1124.842079][ T9] usb 6-1: Product: syz [ 1124.846360][ T9] usb 6-1: Manufacturer: syz [ 1124.867924][ T9] usb 6-1: SerialNumber: syz [ 1124.899169][ T9] usb 6-1: config 0 descriptor?? [ 1124.947769][T19230] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1124.993632][T19230] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1125.070908][ T5888] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1125.137762][T19213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1125.202765][T19213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1125.240805][ T9] usb 6-1: USB disconnect, device number 28 [ 1125.260404][ T5888] usb 2-1: Using ep0 maxpacket: 8 [ 1125.274569][ T5888] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1125.282368][T18828] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 1125.302381][ T5888] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1125.314304][ T5888] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1125.322758][ T5888] usb 2-1: Product: syz [ 1125.327074][ T5888] usb 2-1: Manufacturer: syz [ 1125.333858][ T5888] usb 2-1: SerialNumber: syz [ 1125.360807][ T5888] usb 2-1: config 0 descriptor?? [ 1125.392375][ T5888] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1125.459948][T18828] usb 4-1: Using ep0 maxpacket: 8 [ 1125.466056][T18828] usb 4-1: no configurations [ 1125.471143][T18828] usb 4-1: can't read configurations, error -22 [ 1125.600186][T18828] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 1125.759215][T19243] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1125.769204][T19243] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1125.772157][T18828] usb 4-1: Using ep0 maxpacket: 8 [ 1125.773092][T18828] usb 4-1: no configurations [ 1125.773111][T18828] usb 4-1: can't read configurations, error -22 [ 1125.782693][T18828] usb usb4-port1: attempt power cycle [ 1125.958951][ T5888] gspca_zc3xx: reg_w_i err -110 [ 1125.968885][T19246] fuse: Bad value for 'fd' [ 1126.009571][T18831] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 1126.159942][T18831] usb 5-1: Using ep0 maxpacket: 8 [ 1126.172005][T18831] usb 5-1: New USB device found, idVendor=0c45, idProduct=614a, bcdDevice=c4.6d [ 1126.181931][T18831] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1126.190349][T18828] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 1126.198139][T18831] usb 5-1: Product: syz [ 1126.203001][T18831] usb 5-1: Manufacturer: syz [ 1126.208358][T18831] usb 5-1: SerialNumber: syz [ 1126.222639][T18828] usb 4-1: Using ep0 maxpacket: 8 [ 1126.232613][T18828] usb 4-1: no configurations [ 1126.247852][T18831] usb 5-1: config 0 descriptor?? [ 1126.253150][T18828] usb 4-1: can't read configurations, error -22 [ 1126.262745][T18831] gspca_main: sonixj-2.14.0 probing 0c45:614a [ 1126.350375][T18830] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1126.409955][T18828] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1126.430520][T18828] usb 4-1: Using ep0 maxpacket: 8 [ 1126.448491][T18828] usb 4-1: no configurations [ 1126.453761][T18828] usb 4-1: can't read configurations, error -22 [ 1126.461636][T18828] usb usb4-port1: unable to enumerate USB device [ 1126.513953][T18830] usb 6-1: config 0 has no interfaces? [ 1126.524681][T18830] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1126.533849][T18830] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1126.542359][T18830] usb 6-1: Product: syz [ 1126.546672][T18830] usb 6-1: Manufacturer: syz [ 1126.551476][T18830] usb 6-1: SerialNumber: syz [ 1126.561133][T18830] usb 6-1: config 0 descriptor?? [ 1126.589659][ T5888] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1126.606699][ T5888] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1126.664688][ T5888] usb 2-1: USB disconnect, device number 117 [ 1127.075354][T18831] gspca_sonixj: reg_r err -32 [ 1127.080752][T18831] sonixj 5-1:0.0: probe with driver sonixj failed with error -32 [ 1127.659631][ T5888] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 1127.800561][ T5888] usb 2-1: device descriptor read/64, error -71 [ 1128.042939][ T5888] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 1128.179636][ T5888] usb 2-1: device descriptor read/64, error -71 [ 1128.314306][ T5888] usb usb2-port1: attempt power cycle [ 1128.670866][ T5888] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 1128.710056][ T9] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 1128.724103][ T5888] usb 2-1: device descriptor read/8, error -71 [ 1128.737659][T18669] usb 5-1: USB disconnect, device number 7 [ 1128.880000][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 1128.893541][ T9] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1128.903325][ T9] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1128.914932][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1128.927849][ T9] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1128.938228][ T9] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1128.954367][ T9] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1128.964126][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1128.974147][ T5888] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 1129.003890][ T5888] usb 2-1: device descriptor read/8, error -71 [ 1129.086444][T18831] usb 6-1: USB disconnect, device number 29 [ 1129.129356][ T5888] usb usb2-port1: unable to enumerate USB device [ 1129.187978][T19276] netlink: 'syz.5.4002': attribute type 10 has an invalid length. [ 1129.203919][ T9] usb 4-1: GET_CAPABILITIES returned 0 [ 1129.218488][ T9] usbtmc 4-1:16.0: can't read capabilities [ 1129.338859][T19280] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4004'. [ 1129.405791][T19282] fuse: Bad value for 'fd' [ 1129.428733][T18831] usb 4-1: USB disconnect, device number 45 [ 1129.529699][ T9] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 1129.683686][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1129.694109][ T9] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1129.704797][ T9] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1129.713988][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1129.733293][ T9] usb 5-1: config 0 descriptor?? [ 1129.739669][T18828] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1129.786877][T19289] syzkaller0: entered promiscuous mode [ 1129.792547][T19289] syzkaller0: entered allmulticast mode [ 1129.811198][T19289] binder: 19288:19289 ioctl c0306201 2000000003c0 returned -22 [ 1129.819189][T19289] binder: 19288:19289 ioctl c0306201 2000000001c0 returned -22 [ 1129.862253][T19289] binder: 19288:19289 ioctl ae80 0 returned -22 [ 1129.911957][T18828] usb 6-1: Using ep0 maxpacket: 8 [ 1129.921261][T18828] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1129.933698][T18828] usb 6-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1129.944675][T18828] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1129.952842][T18828] usb 6-1: Product: syz [ 1129.957246][T18828] usb 6-1: Manufacturer: syz [ 1129.967445][T18828] usb 6-1: SerialNumber: syz [ 1129.979713][T19278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1129.992494][T19278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1130.003091][T18828] usb 6-1: config 0 descriptor?? [ 1130.020448][T18828] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1130.539862][T18828] gspca_zc3xx: reg_w_i err -110 [ 1131.009920][ T9] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 1131.145243][T18828] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1131.152561][T18828] gspca_zc3xx 6-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1131.187763][ T9] usb 4-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 1131.187896][T18828] usb 6-1: USB disconnect, device number 30 [ 1131.215739][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1131.243175][ T9] usb 4-1: config 0 descriptor?? [ 1131.272661][ T9] usb 4-1: selecting invalid altsetting 1 [ 1131.408435][ T9] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1131.499641][ T5888] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 1131.670568][ T5888] usb 2-1: Using ep0 maxpacket: 32 [ 1131.688271][ T5888] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1131.702976][ T5888] usb 2-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 1131.731325][ T5888] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1131.740144][ T5888] usb 2-1: Product: syz [ 1131.754340][ T5888] usb 2-1: Manufacturer: syz [ 1131.769784][ T5888] usb 2-1: SerialNumber: syz [ 1131.777947][ T5888] usb 2-1: config 0 descriptor?? [ 1131.797433][ T5888] usb 2-1: no audio or video endpoints found [ 1133.045223][T18828] usb 5-1: USB disconnect, device number 8 [ 1133.184537][T19310] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4015'. [ 1133.230790][T19312] fuse: Bad value for 'fd' [ 1133.375202][ T5888] usb 4-1: USB disconnect, device number 46 [ 1133.875260][T19329] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 1133.881826][T19329] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1133.900382][T19329] vhci_hcd vhci_hcd.0: Device attached [ 1133.913460][ T9] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1134.225574][T19332] vhci_hcd: connection closed [ 1134.230051][ T13] vhci_hcd: stop threads [ 1134.252891][ T13] vhci_hcd: release socket [ 1134.284086][ T13] vhci_hcd: disconnect device [ 1134.335636][ T977] usb 2-1: USB disconnect, device number 122 [ 1134.383987][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 1134.425155][ T9] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x73, changing to 0x3 [ 1134.486167][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1134.516472][T19339] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1134.539144][ T9] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1134.548962][T18669] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 1134.557945][T19339] FAULT_INJECTION: forcing a failure. [ 1134.557945][T19339] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1134.573971][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1134.585079][ T9] usb 6-1: Product: syz [ 1134.590631][ T9] usb 6-1: Manufacturer: syz [ 1134.595364][T19339] CPU: 0 UID: 0 PID: 19339 Comm: syz.1.4022 Not tainted 6.15.0-syzkaller-09113-g8477ab143069 #0 PREEMPT(full) [ 1134.595390][T19339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1134.595403][T19339] Call Trace: [ 1134.595411][T19339] [ 1134.595421][T19339] dump_stack_lvl+0x189/0x250 [ 1134.595460][T19339] ? __pfx____ratelimit+0x10/0x10 [ 1134.595481][T19339] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1134.595520][T19339] ? __pfx__printk+0x10/0x10 [ 1134.595556][T19339] should_fail_ex+0x414/0x560 [ 1134.595584][T19339] _copy_to_user+0x31/0xb0 [ 1134.595617][T19339] iommufd_fill_cap_iova+0x20a/0x2b0 [ 1134.595656][T19339] ? __pfx_iommufd_fill_cap_iova+0x10/0x10 [ 1134.595713][T19339] iommufd_vfio_ioctl+0xe32/0x12f0 [ 1134.595750][T19339] ? __pfx_iommufd_vfio_ioctl+0x10/0x10 [ 1134.595783][T19339] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1134.595817][T19339] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1134.595869][T19339] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 1134.595901][T19339] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1134.595936][T19339] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1134.595989][T19339] ? __lock_acquire+0xab9/0xd20 [ 1134.596020][T19339] iommufd_fops_ioctl+0xfd/0x520 [ 1134.596053][T19339] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1134.596088][T19339] ? __fget_files+0x2a/0x420 [ 1134.596121][T19339] ? __fget_files+0x2a/0x420 [ 1134.596150][T19339] ? __fget_files+0x3a0/0x420 [ 1134.596178][T19339] ? __fget_files+0x2a/0x420 [ 1134.596212][T19339] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1134.596239][T19339] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1134.596269][T19339] __se_sys_ioctl+0xf9/0x170 [ 1134.596296][T19339] do_syscall_64+0xfa/0x3b0 [ 1134.596319][T19339] ? lockdep_hardirqs_on+0x9c/0x150 [ 1134.596340][T19339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.596362][T19339] ? clear_bhb_loop+0x60/0xb0 [ 1134.596390][T19339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.596411][T19339] RIP: 0033:0x7f687178e969 [ 1134.596431][T19339] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1134.596450][T19339] RSP: 002b:00007f687257b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1134.596474][T19339] RAX: ffffffffffffffda RBX: 00007f68719b5fa0 RCX: 00007f687178e969 [ 1134.596491][T19339] RDX: 0000200000000540 RSI: 0000000000003b70 RDI: 0000000000000003 [ 1134.596514][T19339] RBP: 00007f687257b090 R08: 0000000000000000 R09: 0000000000000000 [ 1134.596528][T19339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1134.596542][T19339] R13: 0000000000000000 R14: 00007f68719b5fa0 R15: 00007f6871adfa28 [ 1134.596576][T19339] [ 1134.875084][ T9] usb 6-1: SerialNumber: syz [ 1135.161070][ T9] usb 6-1: config 0 descriptor?? [ 1135.172775][ T9] streamzap 6-1:0.0: streamzap_probe: endpoint doesn't match input device 0203 [ 1135.209714][T18669] usb 4-1: device descriptor read/64, error -71 [ 1135.271977][T19344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1135.292829][T19344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1135.304805][T19344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1135.318941][T19344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1135.443461][ T9] usb 6-1: USB disconnect, device number 31 [ 1135.480252][T18669] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 1135.632462][T18669] usb 4-1: device descriptor read/64, error -71 [ 1135.749987][T18669] usb usb4-port1: attempt power cycle [ 1136.027486][T19356] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4029'. [ 1136.027721][T19353] fuse: Bad value for 'fd' [ 1136.109825][T18669] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 1136.141873][T18669] usb 4-1: device descriptor read/8, error -71 [ 1136.229589][T18831] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 1136.268405][T19366] fuse: Bad value for 'fd' [ 1136.399698][T18669] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 1136.399834][T18831] usb 2-1: Using ep0 maxpacket: 32 [ 1136.427530][T18831] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1136.440473][T18669] usb 4-1: device descriptor read/8, error -71 [ 1136.444488][T18831] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 245, changing to 11 [ 1136.458791][T18831] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 58613, setting to 1024 [ 1136.478795][T18831] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1136.495906][T18831] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1136.549258][T18831] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1136.561612][T18669] usb usb4-port1: unable to enumerate USB device [ 1136.565696][T18831] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1136.644777][T18831] usb 2-1: Product: syz [ 1136.689508][T18831] usb 2-1: Manufacturer: syz [ 1136.704433][T18831] usb 2-1: SerialNumber: syz [ 1136.742153][T18831] usb 2-1: config 0 descriptor?? [ 1137.174216][T19354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1137.213431][T19354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1137.259395][T19354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1137.286508][T19354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1137.305664][T18831] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1137.312065][T18831] input input68: Device does not respond to id packet M [ 1137.321497][T18831] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1137.327629][T18831] input input68: Device does not respond to id packet P [ 1137.341412][T18831] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1137.388596][T18831] input input68: Device does not respond to id packet B [ 1137.450416][T18831] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1137.457368][T18831] input input68: Device does not respond to id packet N [ 1137.511645][T18831] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1137.528612][T18831] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1137.555689][T18831] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1137.583575][T18831] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1137.620370][T18831] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input68 [ 1137.634025][T19390] netlink: 'syz.3.4040': attribute type 10 has an invalid length. [ 1137.774520][T18831] usb 2-1: USB disconnect, device number 123 [ 1137.889783][T18828] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1137.968043][T19393] fuse: Bad value for 'fd' [ 1138.090480][T18828] usb 6-1: Using ep0 maxpacket: 8 [ 1138.131415][T18828] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x73, changing to 0x3 [ 1138.183382][T18828] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1138.228265][T18828] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1138.269706][T18828] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.313285][T18828] usb 6-1: Product: syz [ 1138.317601][T18828] usb 6-1: Manufacturer: syz [ 1138.345592][T19400] fuse: Bad value for 'fd' [ 1138.374794][T18828] usb 6-1: SerialNumber: syz [ 1138.400931][T18828] usb 6-1: config 0 descriptor?? [ 1138.449159][T18828] streamzap 6-1:0.0: streamzap_probe: endpoint doesn't match input device 0203 [ 1138.512522][T19404] IPv6: Can't replace route, no match found [ 1138.573191][T19408] Invalid logical block size (253) [ 1138.693334][T18828] usb 6-1: USB disconnect, device number 32 [ 1139.420389][T19428] fuse: Invalid rootmode [ 1139.664423][T19437] FAULT_INJECTION: forcing a failure. [ 1139.664423][T19437] name failslab, interval 1, probability 0, space 0, times 0 [ 1139.702347][T19437] CPU: 1 UID: 0 PID: 19437 Comm: syz.4.4057 Not tainted 6.15.0-syzkaller-09113-g8477ab143069 #0 PREEMPT(full) [ 1139.702380][T19437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1139.702395][T19437] Call Trace: [ 1139.702404][T19437] [ 1139.702414][T19437] dump_stack_lvl+0x189/0x250 [ 1139.702452][T19437] ? __pfx____ratelimit+0x10/0x10 [ 1139.702475][T19437] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1139.702507][T19437] ? __pfx__printk+0x10/0x10 [ 1139.702536][T19437] ? __pfx___might_resched+0x10/0x10 [ 1139.702561][T19437] ? fs_reclaim_acquire+0x7d/0x100 [ 1139.702608][T19437] should_fail_ex+0x414/0x560 [ 1139.702637][T19437] should_failslab+0xa8/0x100 [ 1139.702668][T19437] __kmalloc_noprof+0xcb/0x4f0 [ 1139.702694][T19437] ? security_sk_alloc+0x52/0x390 [ 1139.702729][T19437] security_sk_alloc+0x52/0x390 [ 1139.702761][T19437] sk_prot_alloc+0x101/0x220 [ 1139.702801][T19437] sk_alloc+0x3a/0x370 [ 1139.702836][T19437] inet_create+0x76b/0x1000 [ 1139.702874][T19437] ? inet_create+0x97/0x1000 [ 1139.702904][T19437] __sock_create+0x4b3/0x9f0 [ 1139.702937][T19437] udp_sock_create4+0xbe/0x4b0 [ 1139.702964][T19437] ? __pfx_udp_sock_create4+0x10/0x10 [ 1139.703002][T19437] rxrpc_lookup_local+0xcae/0x1410 [ 1139.703045][T19437] ? __pfx_rxrpc_lookup_local+0x10/0x10 [ 1139.703085][T19437] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1139.703117][T19437] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1139.703148][T19437] ? do_raw_spin_unlock+0x122/0x240 [ 1139.703187][T19437] rxrpc_sendmsg+0x399/0x710 [ 1139.703220][T19437] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 1139.703249][T19437] __sock_sendmsg+0x21c/0x270 [ 1139.703275][T19437] ____sys_sendmsg+0x505/0x830 [ 1139.703313][T19437] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1139.703354][T19437] ? import_iovec+0x74/0xa0 [ 1139.703390][T19437] ___sys_sendmsg+0x21f/0x2a0 [ 1139.703423][T19437] ? __pfx____sys_sendmsg+0x10/0x10 [ 1139.703503][T19437] ? __fget_files+0x2a/0x420 [ 1139.703534][T19437] ? __fget_files+0x3a0/0x420 [ 1139.703575][T19437] __x64_sys_sendmsg+0x19b/0x260 [ 1139.703609][T19437] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1139.703651][T19437] ? __pfx_ksys_write+0x10/0x10 [ 1139.703675][T19437] ? rcu_is_watching+0x15/0xb0 [ 1139.703708][T19437] ? do_syscall_64+0xbe/0x3b0 [ 1139.703735][T19437] do_syscall_64+0xfa/0x3b0 [ 1139.703757][T19437] ? lockdep_hardirqs_on+0x9c/0x150 [ 1139.703778][T19437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1139.703807][T19437] ? clear_bhb_loop+0x60/0xb0 [ 1139.703834][T19437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1139.703855][T19437] RIP: 0033:0x7f02cf18e969 [ 1139.703875][T19437] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1139.703894][T19437] RSP: 002b:00007f02cffdc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1139.703918][T19437] RAX: ffffffffffffffda RBX: 00007f02cf3b5fa0 RCX: 00007f02cf18e969 [ 1139.703935][T19437] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1139.703950][T19437] RBP: 00007f02cffdc090 R08: 0000000000000000 R09: 0000000000000000 [ 1139.703963][T19437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1139.703977][T19437] R13: 0000000000000000 R14: 00007f02cf3b5fa0 R15: 00007f02cf4dfa28 [ 1139.704010][T19437] [ 1140.740353][T19430] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1140.755697][T19430] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1142.318810][T19462] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1142.709896][T19476] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4068'. [ 1142.730140][ T5888] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1142.892553][ T5888] usb 5-1: config 129 has an invalid interface number: 3 but max is 0 [ 1142.910652][ T5888] usb 5-1: config 129 has no interface number 0 [ 1142.917408][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 1142.917803][ T30] audit: type=1326 audit(1748649985.358:3116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1142.951344][ T5888] usb 5-1: config 129 interface 3 altsetting 128 has an invalid descriptor for endpoint zero, skipping [ 1142.964989][ T5888] usb 5-1: config 129 interface 3 altsetting 128 has an invalid descriptor for endpoint zero, skipping [ 1142.976267][ T5888] usb 5-1: config 129 interface 3 altsetting 128 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 1142.988187][ T30] audit: type=1326 audit(1748649985.358:3117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1143.027804][ T5888] usb 5-1: config 129 interface 3 altsetting 128 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 1143.418191][ T30] audit: type=1326 audit(1748649985.358:3118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=433 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1143.448732][ T30] audit: type=1326 audit(1748649985.358:3119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1143.474347][ T30] audit: type=1326 audit(1748649985.358:3120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1143.498668][ T30] audit: type=1326 audit(1748649985.358:3121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1143.534659][ T30] audit: type=1326 audit(1748649985.358:3122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1143.581426][ T5888] usb 5-1: config 129 interface 3 altsetting 128 has an invalid descriptor for endpoint zero, skipping [ 1143.604687][ T30] audit: type=1326 audit(1748649985.358:3123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1143.647631][T19494] FAULT_INJECTION: forcing a failure. [ 1143.647631][T19494] name failslab, interval 1, probability 0, space 0, times 0 [ 1143.658650][ T30] audit: type=1326 audit(1748649985.358:3124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19481 comm="syz.2.4071" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f627fd8e969 code=0x7ffc0000 [ 1143.661381][ T5888] usb 5-1: config 129 interface 3 altsetting 128 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 1143.718635][T19494] CPU: 0 UID: 0 PID: 19494 Comm: syz.5.4073 Not tainted 6.15.0-syzkaller-09113-g8477ab143069 #0 PREEMPT(full) [ 1143.718669][T19494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1143.718683][T19494] Call Trace: [ 1143.718693][T19494] [ 1143.718702][T19494] dump_stack_lvl+0x189/0x250 [ 1143.718740][T19494] ? __pfx____ratelimit+0x10/0x10 [ 1143.718763][T19494] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1143.718796][T19494] ? __pfx__printk+0x10/0x10 [ 1143.718822][T19494] ? __pfx___might_resched+0x10/0x10 [ 1143.718850][T19494] ? fs_reclaim_acquire+0x7d/0x100 [ 1143.718886][T19494] should_fail_ex+0x414/0x560 [ 1143.718916][T19494] should_failslab+0xa8/0x100 [ 1143.718947][T19494] __kmalloc_cache_noprof+0x70/0x3d0 [ 1143.718974][T19494] ? snd_pcm_hw_param_near+0x24a/0x500 [ 1143.719005][T19494] snd_pcm_hw_param_near+0x24a/0x500 [ 1143.719039][T19494] snd_pcm_oss_change_params_locked+0x2135/0x3e40 [ 1143.719101][T19494] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 1143.719125][T19494] ? snd_pcm_oss_write+0x28f/0x11a0 [ 1143.719154][T19494] ? aa_file_perm+0x3e7/0xed0 [ 1143.719200][T19494] snd_pcm_oss_write+0x2fb/0x11a0 [ 1143.719244][T19494] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 1143.719271][T19494] ? bpf_lsm_file_permission+0x9/0x20 [ 1143.719301][T19494] ? security_file_permission+0x75/0x290 [ 1143.719338][T19494] ? rw_verify_area+0x258/0x650 [ 1143.719362][T19494] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 1143.719388][T19494] vfs_write+0x27e/0xa90 [ 1143.719425][T19494] ? __pfx_vfs_write+0x10/0x10 [ 1143.719452][T19494] ? __fget_files+0x2a/0x420 [ 1143.719485][T19494] ? __fget_files+0x2a/0x420 [ 1143.719513][T19494] ? __fget_files+0x3a0/0x420 [ 1143.719577][T19494] ? __fget_files+0x2a/0x420 [ 1143.719616][T19494] ksys_write+0x145/0x250 [ 1143.719647][T19494] ? __pfx_ksys_write+0x10/0x10 [ 1143.719671][T19494] ? rcu_is_watching+0x15/0xb0 [ 1143.719705][T19494] ? do_syscall_64+0xbe/0x3b0 [ 1143.719746][T19494] do_syscall_64+0xfa/0x3b0 [ 1143.719768][T19494] ? lockdep_hardirqs_on+0x9c/0x150 [ 1143.719790][T19494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1143.719810][T19494] ? clear_bhb_loop+0x60/0xb0 [ 1143.719835][T19494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1143.719856][T19494] RIP: 0033:0x7fe91818e969 [ 1143.719875][T19494] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1143.719896][T19494] RSP: 002b:00007fe918f0f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1143.719919][T19494] RAX: ffffffffffffffda RBX: 00007fe9183b5fa0 RCX: 00007fe91818e969 [ 1143.719936][T19494] RDX: 0000000000004000 RSI: 00002000000012c0 RDI: 0000000000000003 [ 1143.719951][T19494] RBP: 00007fe918f0f090 R08: 0000000000000000 R09: 0000000000000000 [ 1143.719965][T19494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1143.719979][T19494] R13: 0000000000000000 R14: 00007fe9183b5fa0 R15: 00007fe9184dfa28 [ 1143.720013][T19494] [ 1144.006808][ T5888] usb 5-1: config 129 interface 3 altsetting 128 has a duplicate endpoint with address 0x7, skipping [ 1144.018006][ T5888] usb 5-1: config 129 interface 3 altsetting 128 has an invalid descriptor for endpoint zero, skipping [ 1144.029136][ T5888] usb 5-1: config 129 interface 3 altsetting 128 has a duplicate endpoint with address 0xD, skipping [ 1144.040248][ T5888] usb 5-1: config 129 interface 3 altsetting 128 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 1144.051373][ T5888] usb 5-1: config 129 interface 3 altsetting 128 has a duplicate endpoint with address 0x83, skipping [ 1144.062449][ T5888] usb 5-1: config 129 interface 3 has no altsetting 0 [ 1144.080089][ T5888] usb 5-1: New USB device found, idVendor=1199, idProduct=9013, bcdDevice=cb.2d [ 1144.089182][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1144.097464][ T5888] usb 5-1: Product: Ќ [ 1144.101640][ T5888] usb 5-1: Manufacturer: 鲤ʢ赎蠱೏嗮Ꝏ⯶閔輂ὓ伞邛淝✻즴迒鼚鬄⍑ꬩ촒挳ȕ쯖蝗᰼੉텣䞹쭆⁤뙃ဦ䉌랪瀧ⳏ㐕遼ⶫ䌐若ἪÕ樣儿य틞⠁煯돀貆饀譖冔鋺绀墔夔䛝鮌⢫㏆鬢쏹뫢ù᫔稭낮餟蠾৮㤣㨘㢆蝶랍菂弄ఉ⯯䧼蚃侙輆ꅤ뎔虿孺뻥语솘롞Žﴠ疘총䃺꤃뫏蒅䑗᱋䏈蟡겟 [ 1144.139617][ T5888] usb 5-1: SerialNumber: Є [ 1144.589643][T18669] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1144.757359][T18669] usb 6-1: New USB device found, idVendor=0545, idProduct=808b, bcdDevice=31.ad [ 1144.778361][ T5888] usb 5-1: USB disconnect, device number 9 [ 1144.788521][T18669] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1144.797592][ T9] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 1144.847173][T18669] usb 6-1: config 0 descriptor?? [ 1144.878873][T18669] gspca_main: tv8532-2.14.0 probing 0545:808b [ 1144.982944][ T9] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1144.991552][ T9] usb 4-1: can't read configurations, error -61 [ 1145.099686][T18830] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 1145.147539][ T9] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 1145.209656][ T5888] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 1145.259618][T18830] usb 2-1: Using ep0 maxpacket: 16 [ 1145.272657][T18830] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1145.292807][T18830] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1145.314110][T18830] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1145.329170][T18830] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1145.341596][T18830] usb 2-1: Product: syz [ 1145.345949][T18830] usb 2-1: Manufacturer: syz [ 1145.348721][ T9] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1145.352310][T18830] usb 2-1: SerialNumber: syz [ 1145.375824][T18830] usb 2-1: config 0 descriptor?? [ 1145.392838][T18830] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1145.404740][T18830] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1145.404748][ T5888] usb 5-1: device descriptor read/64, error -71 [ 1145.424125][ T9] usb 4-1: can't read configurations, error -61 [ 1145.446567][ T9] usb usb4-port1: attempt power cycle [ 1145.779882][ T5888] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 1145.860046][ T9] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 1145.908702][ T9] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1145.926303][T19522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1145.939651][ T9] usb 4-1: can't read configurations, error -61 [ 1145.942733][T19522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1145.959740][ T5888] usb 5-1: device descriptor read/64, error -71 [ 1146.003056][T18830] em28xx 2-1:0.0: chip ID is em28174 [ 1146.100080][ T9] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1146.107908][ T5888] usb usb5-port1: attempt power cycle [ 1146.162715][ T9] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1146.174648][ T9] usb 4-1: can't read configurations, error -61 [ 1146.189382][ T9] usb usb4-port1: unable to enumerate USB device [ 1146.204385][T19525] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1146.238247][T19525] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1146.511227][ T5888] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1147.259564][ T5888] usb 5-1: device descriptor read/8, error -71 [ 1147.660452][T18828] usb 6-1: USB disconnect, device number 33 [ 1147.892854][ T9] usb 2-1: USB disconnect, device number 124 [ 1147.950214][ T9] em28xx 2-1:0.0: Disconnecting em28xx [ 1147.969800][ T5888] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1148.034216][ T5888] usb 5-1: device descriptor read/8, error -71 [ 1148.105458][ T9] em28xx 2-1:0.0: Freeing device [ 1148.229864][ T5888] usb usb5-port1: unable to enumerate USB device [ 1148.454602][T17238] vhci_hcd: connection reset by peer [ 1148.493529][ T1042] vhci_hcd: stop threads [ 1148.525557][ T1042] vhci_hcd: release socket [ 1148.621748][ T1042] vhci_hcd: disconnect device [ 1148.680095][T12037] vhci_hcd: vhci_device speed not set [ 1149.271941][T19539] FAULT_INJECTION: forcing a failure. [ 1149.271941][T19539] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1149.340551][T19538] netlink: 'syz.4.4086': attribute type 10 has an invalid length. [ 1149.365788][T19539] CPU: 0 UID: 0 PID: 19539 Comm: syz.1.4084 Not tainted 6.15.0-syzkaller-09113-g8477ab143069 #0 PREEMPT(full) [ 1149.365822][T19539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1149.365836][T19539] Call Trace: [ 1149.365846][T19539] [ 1149.365856][T19539] dump_stack_lvl+0x189/0x250 [ 1149.365896][T19539] ? __pfx____ratelimit+0x10/0x10 [ 1149.365920][T19539] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1149.365954][T19539] ? __pfx__printk+0x10/0x10 [ 1149.365992][T19539] should_fail_ex+0x414/0x560 [ 1149.366023][T19539] _copy_to_user+0x31/0xb0 [ 1149.366058][T19539] simple_read_from_buffer+0xe1/0x170 [ 1149.366093][T19539] proc_fail_nth_read+0x1df/0x250 [ 1149.366131][T19539] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1149.366176][T19539] ? rw_verify_area+0x258/0x650 [ 1149.366201][T19539] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1149.366237][T19539] vfs_read+0x200/0x980 [ 1149.366268][T19539] ? __pfx___mutex_lock+0x10/0x10 [ 1149.366294][T19539] ? __pfx_vfs_read+0x10/0x10 [ 1149.366322][T19539] ? __fget_files+0x2a/0x420 [ 1149.366358][T19539] ? __fget_files+0x3a0/0x420 [ 1149.366386][T19539] ? __fget_files+0x2a/0x420 [ 1149.366428][T19539] ksys_read+0x145/0x250 [ 1149.366456][T19539] ? __pfx_ksys_read+0x10/0x10 [ 1149.366479][T19539] ? rcu_is_watching+0x15/0xb0 [ 1149.366512][T19539] ? do_syscall_64+0xbe/0x3b0 [ 1149.366540][T19539] do_syscall_64+0xfa/0x3b0 [ 1149.366561][T19539] ? lockdep_hardirqs_on+0x9c/0x150 [ 1149.366583][T19539] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1149.366605][T19539] ? clear_bhb_loop+0x60/0xb0 [ 1149.366632][T19539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1149.366654][T19539] RIP: 0033:0x7f687178d37c [ 1149.366673][T19539] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1149.366693][T19539] RSP: 002b:00007f687257b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1149.366717][T19539] RAX: ffffffffffffffda RBX: 00007f68719b5fa0 RCX: 00007f687178d37c [ 1149.366734][T19539] RDX: 000000000000000f RSI: 00007f687257b0a0 RDI: 0000000000000004 [ 1149.366748][T19539] RBP: 00007f687257b090 R08: 0000000000000000 R09: 0000000000000000 [ 1149.366763][T19539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1149.366777][T19539] R13: 0000000000000000 R14: 00007f68719b5fa0 R15: 00007f6871adfa28 [ 1149.366815][T19539] [ 1149.699815][T19538] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4086'. [ 1149.942914][T19546] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1149.964244][T19546] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1149.966758][T19538] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 1149.984376][T19546] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1150.033377][T19546] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1150.041261][T19546] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1150.060046][T13920] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1150.067699][T13920] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1150.076704][T13920] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1150.096049][T19538] team0: Port device geneve0 added [ 1150.105084][T13920] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1150.113011][T13920] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1150.338908][T19553] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4089'. [ 1150.507152][ T30] audit: type=1326 audit(1748649992.948:3125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1150.583865][ T30] audit: type=1326 audit(1748649992.948:3126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1150.712146][ T30] audit: type=1326 audit(1748649992.978:3127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1150.712204][ T30] audit: type=1326 audit(1748649992.978:3128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1150.712251][ T30] audit: type=1326 audit(1748649992.978:3129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1150.807679][ T5850] syz-executor (5850) used greatest stack depth: 19896 bytes left [ 1150.876148][ T30] audit: type=1326 audit(1748649992.978:3130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f687178d2d0 code=0x7ffc0000 [ 1150.920051][ T30] audit: type=1326 audit(1748649992.988:3131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1150.943501][ T30] audit: type=1326 audit(1748649992.988:3132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1151.120649][T19551] chnl_net:caif_netlink_parms(): no params data found [ 1151.179532][ T30] audit: type=1326 audit(1748649992.988:3133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1151.245097][T19573] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1151.339863][ T30] audit: type=1326 audit(1748649992.988:3134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19557 comm="syz.1.4091" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f687178e969 code=0x7ffc0000 [ 1151.461278][T19551] bridge0: port 1(bridge_slave_0) entered blocking state [ 1151.471164][T19551] bridge0: port 1(bridge_slave_0) entered disabled state [ 1151.479749][T19551] bridge_slave_0: entered allmulticast mode [ 1151.490417][T19551] bridge_slave_0: entered promiscuous mode [ 1151.500773][T19551] bridge0: port 2(bridge_slave_1) entered blocking state [ 1151.508803][T19551] bridge0: port 2(bridge_slave_1) entered disabled state [ 1151.518178][T19551] bridge_slave_1: entered allmulticast mode [ 1151.527598][T19551] bridge_slave_1: entered promiscuous mode [ 1151.579328][T19551] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1151.614159][T19551] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1151.709337][T19551] team0: Port device team_slave_0 added [ 1151.733688][T19551] team0: Port device team_slave_1 added [ 1151.856303][T19551] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1151.864051][T19551] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1151.926774][T19551] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1151.946432][T19551] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1151.963646][T19551] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1152.001653][T19551] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1152.082189][T19551] hsr_slave_0: entered promiscuous mode [ 1152.096987][T19551] hsr_slave_1: entered promiscuous mode [ 1152.121684][T19551] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1152.133977][T19551] Cannot create hsr debugfs directory [ 1152.199637][T19546] Bluetooth: hci5: command tx timeout [ 1152.401430][T19551] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1152.468977][T19551] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1152.556738][T19551] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1152.633924][T19551] bond0: (slave netdevsim0): Releasing backup interface [ 1152.644169][T19551] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1152.767829][T19551] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1152.778474][T19551] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1152.788542][T19551] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1152.798723][T19551] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1152.878807][T19551] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1152.900088][T19551] 8021q: adding VLAN 0 to HW filter on device team0 [ 1152.913036][ T6946] bridge0: port 1(bridge_slave_0) entered blocking state [ 1152.920258][ T6946] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1152.937038][ T6946] bridge0: port 2(bridge_slave_1) entered blocking state [ 1152.944355][ T6946] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1153.022445][T19551] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1153.068453][T19551] veth0_vlan: entered promiscuous mode [ 1153.080662][T19551] veth1_vlan: entered promiscuous mode [ 1153.112661][T19551] veth0_macvtap: entered promiscuous mode [ 1153.124048][T19551] veth1_macvtap: entered promiscuous mode [ 1153.144236][T19551] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1153.157721][T19551] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1153.187758][T19551] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.196619][T19551] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.206573][T19551] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.215665][T19551] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.306194][ T6946] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1153.317813][ T6946] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1153.357084][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1153.365924][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1153.434823][T19579] fuse: Invalid rootmode [ 1154.280559][T19546] Bluetooth: hci5: command tx timeout [ 1156.360157][T19546] Bluetooth: hci5: command tx timeout [ 1158.441907][T19546] Bluetooth: hci5: command tx timeout [ 1176.375331][T19600] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4101'. [ 1176.509626][T18831] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1176.683429][T18831] usb 4-1: Using ep0 maxpacket: 8 [ 1176.764020][T18831] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1176.816304][T18831] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1176.904781][T13920] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1176.916543][T13920] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1176.928011][T13920] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1176.939035][T13920] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1176.939738][T18831] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1176.964650][T13920] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1176.976411][T18831] usb 4-1: Product: syz [ 1176.995949][T18831] usb 4-1: Manufacturer: syz [ 1177.005914][T18831] usb 4-1: SerialNumber: syz [ 1177.035760][T18831] usb 4-1: config 0 descriptor?? [ 1177.058773][T19616] fuse: Invalid rootmode [ 1177.078569][T18831] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1177.351577][T19621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1177.360700][T19621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1177.484305][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.491518][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.610038][T18831] gspca_zc3xx: reg_w_i err -110 [ 1178.209517][T18831] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1178.218420][T18831] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1178.508042][ T13] bond0: (slave netdevsim0): Releasing backup interface [ 1178.556889][T19614] chnl_net:caif_netlink_parms(): no params data found [ 1178.606041][ T5888] usb 4-1: USB disconnect, device number 55 [ 1178.999837][T19546] Bluetooth: hci3: command tx timeout [ 1179.028291][ T13] bridge_slave_1: left allmulticast mode [ 1179.040942][ T13] bridge_slave_1: left promiscuous mode [ 1179.048322][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1179.062166][ T13] bridge_slave_0: left allmulticast mode [ 1179.078037][ T13] bridge_slave_0: left promiscuous mode [ 1179.101367][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1181.080251][T19546] Bluetooth: hci3: command tx timeout [ 1181.096657][T19672] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 1181.103242][T19672] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 1181.123619][T19672] vhci_hcd vhci_hcd.0: Device attached [ 1181.191100][T19674] vhci_hcd: cannot find the pending unlink 8 [ 1181.217848][T19674] vhci_hcd: connection closed [ 1181.218012][ T1042] vhci_hcd: stop threads [ 1181.253271][ T1042] vhci_hcd: release socket [ 1181.258160][ T1042] vhci_hcd: disconnect device [ 1181.320481][T12037] vhci_hcd: vhci_device speed not set [ 1181.497017][ T13] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1181.864532][T19685] SET target dimension over the limit! [ 1182.109335][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1182.144283][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1182.179085][ T13] bond0 (unregistering): (slave batadv_slave_0): Releasing backup interface [ 1182.226831][ T13] bond0 (unregistering): Released all slaves [ 1182.292030][ T13] bond1 (unregistering): Released all slaves [ 1182.382813][T19614] bridge0: port 1(bridge_slave_0) entered blocking state [ 1182.396447][T19614] bridge0: port 1(bridge_slave_0) entered disabled state [ 1182.443235][T19614] bridge_slave_0: entered allmulticast mode [ 1182.459264][T19614] bridge_slave_0: entered promiscuous mode [ 1182.534680][ T13] : left promiscuous mode [ 1182.630870][T19614] bridge0: port 2(bridge_slave_1) entered blocking state [ 1182.654636][T19614] bridge0: port 2(bridge_slave_1) entered disabled state [ 1182.674987][T19614] bridge_slave_1: entered allmulticast mode [ 1182.688314][T19614] bridge_slave_1: entered promiscuous mode [ 1182.803353][T19696] ptrace attach of "./syz-executor exec"[18070] was attempted by "./syz-executor exec"[19696] [ 1182.863157][T19698] FAULT_INJECTION: forcing a failure. [ 1182.863157][T19698] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1182.878758][T19698] CPU: 1 UID: 0 PID: 19698 Comm: syz.2.4124 Not tainted 6.15.0-syzkaller-09113-g8477ab143069 #0 PREEMPT(full) [ 1182.878789][T19698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1182.878801][T19698] Call Trace: [ 1182.878808][T19698] [ 1182.878815][T19698] dump_stack_lvl+0x189/0x250 [ 1182.878845][T19698] ? __pfx____ratelimit+0x10/0x10 [ 1182.878862][T19698] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1182.878886][T19698] ? __pfx__printk+0x10/0x10 [ 1182.878904][T19698] ? __might_fault+0xb0/0x130 [ 1182.878933][T19698] should_fail_ex+0x414/0x560 [ 1182.878956][T19698] _copy_from_user+0x2d/0xb0 [ 1182.878980][T19698] kstrtouint_from_user+0xc4/0x170 [ 1182.879001][T19698] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1182.879034][T19698] proc_fail_nth_write+0x88/0x240 [ 1182.879058][T19698] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1182.879095][T19698] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1182.879120][T19698] vfs_write+0x27e/0xa90 [ 1182.879145][T19698] ? __pfx_vfs_write+0x10/0x10 [ 1182.879165][T19698] ? __fget_files+0x2a/0x420 [ 1182.879190][T19698] ? __fget_files+0x3a0/0x420 [ 1182.879211][T19698] ? __fget_files+0x2a/0x420 [ 1182.879240][T19698] ksys_write+0x145/0x250 [ 1182.879260][T19698] ? __pfx_ksys_write+0x10/0x10 [ 1182.879277][T19698] ? rcu_is_watching+0x15/0xb0 [ 1182.879301][T19698] ? do_syscall_64+0xbe/0x3b0 [ 1182.879321][T19698] do_syscall_64+0xfa/0x3b0 [ 1182.879336][T19698] ? lockdep_hardirqs_on+0x9c/0x150 [ 1182.879351][T19698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1182.879367][T19698] ? clear_bhb_loop+0x60/0xb0 [ 1182.879386][T19698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1182.879401][T19698] RIP: 0033:0x7f627fd8d41f [ 1182.879415][T19698] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1182.879439][T19698] RSP: 002b:00007f6280c51030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1182.879461][T19698] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f627fd8d41f [ 1182.879477][T19698] RDX: 0000000000000001 RSI: 00007f6280c510a0 RDI: 0000000000000005 [ 1182.879491][T19698] RBP: 00007f6280c51090 R08: 0000000000000000 R09: 0000000000000000 [ 1182.879505][T19698] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1182.879519][T19698] R13: 0000000000000000 R14: 00007f627ffb5fa0 R15: 00007f62800dfa28 [ 1182.879550][T19698] [ 1183.126767][T18828] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1183.150227][T19614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1183.178662][T19546] Bluetooth: hci3: command tx timeout [ 1183.224982][T19614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1183.419519][T18828] usb 4-1: Using ep0 maxpacket: 32 [ 1183.435935][T18828] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 1183.450229][T18828] usb 4-1: config 0 has no interface number 0 [ 1183.456397][T18828] usb 4-1: config 0 interface 12 has no altsetting 0 [ 1183.477510][T19701] netlink: 'syz.2.4126': attribute type 10 has an invalid length. [ 1183.526331][T18828] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1183.581498][T18828] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1183.607990][T19614] team0: Port device team_slave_0 added [ 1183.616630][T18828] usb 4-1: Product: syz [ 1183.623602][T18828] usb 4-1: Manufacturer: syz [ 1183.631176][T18828] usb 4-1: SerialNumber: syz [ 1183.654073][T18828] usb 4-1: config 0 descriptor?? [ 1183.676255][T19614] team0: Port device team_slave_1 added [ 1184.505018][T19614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1184.588438][T19614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1184.597599][T19719] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4130'. [ 1184.692959][T19614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1184.722444][T19614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1184.737581][T19614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1184.776029][T19614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1184.827076][ T13] hsr_slave_0: left promiscuous mode [ 1184.839333][ T13] hsr_slave_1: left promiscuous mode [ 1184.883680][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 1184.883702][ T30] audit: type=1326 audit(1748650027.328:3146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1184.912841][ T5888] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1184.969184][ T30] audit: type=1326 audit(1748650027.328:3147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe91818d2d0 code=0x7ffc0000 [ 1185.007974][ T30] audit: type=1326 audit(1748650027.358:3148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1185.098322][ T30] audit: type=1326 audit(1748650027.358:3149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1185.149594][ T5888] usb 5-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 1185.157903][T18828] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1185.178983][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1185.184085][T18828] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 1185.202528][ T5888] usb 5-1: Product: syz [ 1185.211389][T18828] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1185.227963][ T5888] usb 5-1: Manufacturer: syz [ 1185.228229][T18828] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 1185.232682][ T30] audit: type=1326 audit(1748650027.368:3150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1185.232732][ T30] audit: type=1326 audit(1748650027.368:3151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1185.289959][T19546] Bluetooth: hci3: command tx timeout [ 1185.296811][ T5888] usb 5-1: SerialNumber: syz [ 1185.314763][ T5888] usb 5-1: config 0 descriptor?? [ 1185.334175][T18828] usb 4-1: USB disconnect, device number 56 [ 1185.345577][ T5888] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 1185.427217][ T30] audit: type=1326 audit(1748650027.368:3152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1185.482732][ T30] audit: type=1326 audit(1748650027.378:3153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1185.536094][ T30] audit: type=1326 audit(1748650027.378:3154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe91818e9a3 code=0x7ffc0000 [ 1185.640458][ T30] audit: type=1326 audit(1748650027.378:3155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19723 comm="syz.5.4131" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe91818e9a3 code=0x7ffc0000 [ 1185.643450][ T5888] sonixb 5-1:0.0: Error reading register 00: -32 [ 1185.961433][ T5888] usb 5-1: USB disconnect, device number 14 [ 1186.196115][T18828] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1186.351207][T18828] usb 4-1: Using ep0 maxpacket: 8 [ 1186.386245][T18828] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1186.433227][T18828] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1186.543706][T18828] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1186.572948][T18828] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1186.574243][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1186.628593][T18828] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1186.645863][T18828] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1186.661258][T18828] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1186.695710][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1186.900252][T18831] usb 6-1: new full-speed USB device number 34 using dummy_hcd [ 1186.908644][T18828] usb 4-1: usb_control_msg returned -71 [ 1186.924356][T18828] usbtmc 4-1:16.0: can't read capabilities [ 1186.998300][T18828] usb 4-1: USB disconnect, device number 57 [ 1187.092959][T18831] usb 6-1: not running at top speed; connect to a high speed hub [ 1187.116150][T18831] usb 6-1: config 1 interface 0 altsetting 15 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1187.143150][T18831] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1187.153986][T18831] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1187.172235][T18831] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1187.180691][T18831] usb 6-1: Product: syz [ 1187.184900][T18831] usb 6-1: Manufacturer: syz [ 1187.190804][T18831] usb 6-1: SerialNumber: syz [ 1187.208948][T19742] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1187.379674][T18830] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1187.454758][T18831] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -22 [ 1187.491293][T18831] usb 6-1: USB disconnect, device number 34 [ 1187.570810][T18830] usb 5-1: Using ep0 maxpacket: 8 [ 1187.588007][T18830] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1187.610231][T18830] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1187.638846][T18830] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1187.658606][T18830] usb 5-1: Product: syz [ 1187.668855][T18830] usb 5-1: Manufacturer: syz [ 1187.691856][T18830] usb 5-1: SerialNumber: syz [ 1187.725614][T18830] usb 5-1: config 0 descriptor?? [ 1187.751892][T18830] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1188.271777][T18830] gspca_zc3xx: reg_w_i err -110 [ 1188.961652][T18830] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1188.989843][T18830] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1189.025194][ T5888] usb 5-1: USB disconnect, device number 15 [ 1189.693935][T19614] hsr_slave_0: entered promiscuous mode [ 1189.726899][T19614] hsr_slave_1: entered promiscuous mode [ 1189.831588][T19775] netlink: 'syz.2.4144': attribute type 1 has an invalid length. [ 1189.857336][T19775] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4144'. [ 1190.065204][T19779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1190.099151][T19779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1190.149247][T19779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1190.197000][T19779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1190.236485][T19779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1190.275019][ T13] IPVS: stop unused estimator thread 0... [ 1190.288625][T19779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1190.829872][T18831] usb 5-1: new low-speed USB device number 16 using dummy_hcd [ 1190.992480][T18831] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1191.030697][T18831] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1191.050702][T18831] usb 5-1: New USB device found, idVendor=046d, idProduct=c52f, bcdDevice= 0.00 [ 1191.074761][T18831] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1191.112581][T18831] usb 5-1: config 0 descriptor?? [ 1191.326899][T19785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1191.360757][T19785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1191.647499][T18831] usbhid 5-1:0.0: can't add hid device: -71 [ 1191.693942][T18831] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1191.774351][T18831] usb 5-1: USB disconnect, device number 16 [ 1191.817388][T19614] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1191.985210][T19614] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1192.042379][T19614] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1192.136888][T19614] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1192.373210][T19817] GUP no longer grows the stack in syz.2.4154 (19817): 200000004000-200000005000 (200000001000) [ 1192.387243][T19817] CPU: 1 UID: 0 PID: 19817 Comm: syz.2.4154 Not tainted 6.15.0-syzkaller-09113-g8477ab143069 #0 PREEMPT(full) [ 1192.387279][T19817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1192.387296][T19817] Call Trace: [ 1192.387306][T19817] [ 1192.387317][T19817] dump_stack_lvl+0x189/0x250 [ 1192.387362][T19817] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1192.387396][T19817] ? __pfx__printk+0x10/0x10 [ 1192.387418][T19817] ? find_vma+0xe7/0x160 [ 1192.387461][T19817] __get_user_pages+0x2a96/0x30c0 [ 1192.387527][T19817] ? __pfx___get_user_pages+0x10/0x10 [ 1192.387554][T19817] ? __gup_longterm_locked+0xbf7/0x15b0 [ 1192.387581][T19817] ? down_read_killable+0x1d1/0x350 [ 1192.387607][T19817] ? try_get_folio+0x633/0x660 [ 1192.387640][T19817] __gup_longterm_locked+0xd66/0x15b0 [ 1192.387674][T19817] ? try_grab_folio_fast+0x1be/0x4f0 [ 1192.387715][T19817] ? gup_fast_fallback+0x1afc/0x2260 [ 1192.387746][T19817] gup_fast_fallback+0x1cd4/0x2260 [ 1192.387814][T19817] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1192.387839][T19817] ? trace_contention_end+0x39/0x120 [ 1192.387871][T19817] ? __mutex_lock+0x330/0xe80 [ 1192.387900][T19817] ? is_valid_gup_args+0x11f/0x200 [ 1192.387930][T19817] ? get_user_pages_fast+0x4d/0xb0 [ 1192.387960][T19817] __iov_iter_get_pages_alloc+0x39a/0xb40 [ 1192.388001][T19817] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 1192.388032][T19817] ? wait_for_space+0x24d/0x2d0 [ 1192.388064][T19817] iov_iter_get_pages2+0x5e/0xa0 [ 1192.388101][T19817] __se_sys_vmsplice+0x548/0x10d0 [ 1192.388165][T19817] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 1192.388201][T19817] ? __pfx_futex_wake+0x10/0x10 [ 1192.388284][T19817] ? rcu_is_watching+0x15/0xb0 [ 1192.388329][T19817] ? do_syscall_64+0xbe/0x3b0 [ 1192.388356][T19817] do_syscall_64+0xfa/0x3b0 [ 1192.388378][T19817] ? lockdep_hardirqs_on+0x9c/0x150 [ 1192.388399][T19817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1192.388421][T19817] ? clear_bhb_loop+0x60/0xb0 [ 1192.388448][T19817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1192.388470][T19817] RIP: 0033:0x7f627fd8e969 [ 1192.388489][T19817] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1192.388509][T19817] RSP: 002b:00007f6280c51038 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 1192.388531][T19817] RAX: ffffffffffffffda RBX: 00007f627ffb5fa0 RCX: 00007f627fd8e969 [ 1192.388547][T19817] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000008 [ 1192.388562][T19817] RBP: 00007f627fe10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1192.388576][T19817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1192.388589][T19817] R13: 0000000000000000 R14: 00007f627ffb5fa0 R15: 00007f62800dfa28 [ 1192.388623][T19817] [ 1192.966474][T19614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1193.033165][T19614] 8021q: adding VLAN 0 to HW filter on device team0 [ 1193.049761][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 1193.049780][ T30] audit: type=1326 audit(1748650035.488:3160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1193.097301][T11390] bridge0: port 1(bridge_slave_0) entered blocking state [ 1193.104565][T11390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1193.119131][T19827] netlink: 'syz.4.4155': attribute type 10 has an invalid length. [ 1193.122373][T11390] bridge0: port 2(bridge_slave_1) entered blocking state [ 1193.134549][T11390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1193.225747][ T30] audit: type=1326 audit(1748650035.488:3161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1193.348868][ T30] audit: type=1326 audit(1748650035.558:3162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe91818d2d0 code=0x7ffc0000 [ 1193.448018][ T30] audit: type=1326 audit(1748650035.558:3163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1193.543856][ T30] audit: type=1326 audit(1748650035.558:3164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1193.615314][ T30] audit: type=1326 audit(1748650035.558:3165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1193.686010][ T30] audit: type=1326 audit(1748650035.558:3166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1193.697528][T19614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1193.786636][ T30] audit: type=1326 audit(1748650035.558:3167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1193.871786][ T30] audit: type=1326 audit(1748650035.558:3168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fe91818e969 code=0x7ffc0000 [ 1193.951273][ T30] audit: type=1326 audit(1748650035.558:3169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19824 comm="syz.5.4151" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe91818e9a3 code=0x7ffc0000 [ 1193.998433][T19614] veth0_vlan: entered promiscuous mode [ 1194.068834][T19614] veth1_vlan: entered promiscuous mode [ 1194.176350][T19614] veth0_macvtap: entered promiscuous mode [ 1194.191809][T19614] veth1_macvtap: entered promiscuous mode [ 1194.248598][T19614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1194.281966][T19614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1194.307494][T19614] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1194.325979][T19614] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1194.335532][T19614] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1194.348831][T19614] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1194.920147][ T1042] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1194.965835][ T1042] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1195.238607][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1195.282191][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1195.529876][T12037] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1195.829221][T19856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1195.852201][T19856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1195.890698][T12037] usb 6-1: Using ep0 maxpacket: 32 [ 1195.911688][T12037] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1196.200070][T12037] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 245, changing to 11 [ 1196.250154][T12037] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 58613, setting to 1024 [ 1196.279396][T12037] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1196.305535][T12037] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1196.375410][T12037] usb 6-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1196.411136][T12037] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1196.456977][T12037] usb 6-1: Product: syz [ 1196.468398][T12037] usb 6-1: Manufacturer: syz [ 1196.499801][T12037] usb 6-1: SerialNumber: syz [ 1196.529522][T18828] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 1196.539778][T12037] usb 6-1: config 0 descriptor?? [ 1196.719546][T18828] usb 2-1: Using ep0 maxpacket: 8 [ 1196.728846][T18828] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1196.742932][T18828] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1196.751180][T18828] usb 2-1: Product: syz [ 1196.755477][T18828] usb 2-1: Manufacturer: syz [ 1196.760708][T18828] usb 2-1: SerialNumber: syz [ 1196.768672][T18828] usb 2-1: config 0 descriptor?? [ 1196.990150][T19850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1197.002576][T18828] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1197.057316][T19850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1197.118296][T19850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1197.154235][T19850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1197.224341][T12037] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 1197.237475][T12037] input input69: Device does not respond to id packet M [ 1197.279797][T12037] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 1197.303558][T12037] input input69: Device does not respond to id packet P [ 1197.337262][T12037] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 1197.354600][T12037] input input69: Device does not respond to id packet B [ 1197.385054][T12037] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 1197.399158][T12037] input input69: Device does not respond to id packet N [ 1197.424464][T12037] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 1197.441050][T12037] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 1197.460324][T12037] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 1197.469543][T12037] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 1197.488832][T12037] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input69 [ 1197.531561][T12037] usb 6-1: USB disconnect, device number 35 [ 1197.604189][T13920] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1197.615790][T13920] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1197.624745][T13920] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1197.637971][T13920] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1197.649155][T13920] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1197.701557][T19873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1197.711663][T19873] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1198.259612][T12037] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1198.282025][T18828] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1198.361894][T18829] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1198.422683][T12037] usb 6-1: Using ep0 maxpacket: 8 [ 1198.456402][T12037] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1198.482708][T12037] usb 6-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1198.501215][T12037] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1198.526768][T12037] usb 6-1: Product: syz [ 1198.527409][T18829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1198.539495][T12037] usb 6-1: Manufacturer: syz [ 1198.561121][T12037] usb 6-1: SerialNumber: syz [ 1198.573300][T18829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1198.588666][T12037] usb 6-1: config 0 descriptor?? [ 1198.590754][T19910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1198.608826][T18829] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1198.622821][T18829] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1198.633152][T19910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1198.633196][T12037] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1198.654502][T18829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1198.657631][T19880] chnl_net:caif_netlink_parms(): no params data found [ 1198.684505][T18829] usb 4-1: config 0 descriptor?? [ 1199.189812][T12037] gspca_zc3xx: reg_w_i err -110 [ 1199.278842][T18829] plantronics 0003:047F:FFFF.0041: No inputs registered, leaving [ 1199.391865][T18829] plantronics 0003:047F:FFFF.0041: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 1199.681130][T19880] bridge0: port 1(bridge_slave_0) entered blocking state [ 1199.688449][T19880] bridge0: port 1(bridge_slave_0) entered disabled state [ 1199.696403][T19880] bridge_slave_0: entered allmulticast mode [ 1199.704515][T19880] bridge_slave_0: entered promiscuous mode [ 1199.715493][T19880] bridge0: port 2(bridge_slave_1) entered blocking state [ 1199.723602][T19880] bridge0: port 2(bridge_slave_1) entered disabled state [ 1199.731463][T19880] bridge_slave_1: entered allmulticast mode [ 1199.738908][T19880] bridge_slave_1: entered promiscuous mode [ 1199.762520][T13920] Bluetooth: hci0: command tx timeout [ 1199.779699][T12037] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1199.795809][T12037] gspca_zc3xx 6-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1199.938323][T19880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1199.968993][T19880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1200.335517][T18828] usb 2-1: USB disconnect, device number 125 [ 1200.347031][ T9] usb 6-1: USB disconnect, device number 36 [ 1200.421587][T19880] team0: Port device team_slave_0 added [ 1200.542651][T19880] team0: Port device team_slave_1 added [ 1200.569808][ T9] usb 4-1: USB disconnect, device number 58 [ 1200.726801][T19880] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1200.738631][T19944] fuse: Bad value for 'fd' [ 1200.757531][T19880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1200.794269][T19880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1200.807261][T19880] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1200.817541][T19880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1200.871762][T19880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1201.209587][ T5888] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 1201.354271][T19880] hsr_slave_0: entered promiscuous mode [ 1201.409551][ T5888] usb 2-1: Using ep0 maxpacket: 32 [ 1201.427464][T19880] hsr_slave_1: entered promiscuous mode [ 1201.457167][ T5888] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1201.471546][T19880] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1201.489987][T18828] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 1201.530598][T19880] Cannot create hsr debugfs directory [ 1201.536054][ T5888] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 245, changing to 11 [ 1201.592398][ T5888] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 58613, setting to 1024 [ 1201.664919][T18828] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1201.689120][ T5888] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1201.691634][T18828] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1201.714698][T18828] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1201.731535][T18828] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1201.757963][T18828] usb 4-1: Product: syz [ 1201.769151][T18828] usb 4-1: Manufacturer: syz [ 1201.775709][T18828] usb 4-1: SerialNumber: syz [ 1201.781043][ T5888] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1201.799255][T18828] usb 4-1: config 0 descriptor?? [ 1201.810674][T13920] Bluetooth: hci0: command tx timeout [ 1201.838783][ T5888] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1201.842712][T18828] usb 4-1: selecting invalid altsetting 0 [ 1201.866860][ T5888] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1201.883775][ T5888] usb 2-1: Product: syz [ 1201.896093][ T5888] usb 2-1: Manufacturer: syz [ 1201.946691][ T5888] usb 2-1: SerialNumber: syz [ 1202.008410][ T5888] usb 2-1: config 0 descriptor?? [ 1202.073739][T18828] usb 4-1: USB disconnect, device number 59 [ 1202.170018][T19757] udevd[19757]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1202.435929][T19880] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1202.512632][T19948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1202.573838][T19948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1202.651249][T19948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1202.679014][T19880] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1202.708275][T19948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1202.765192][ T5888] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1202.795149][ T5888] input input70: Device does not respond to id packet M [ 1202.828271][ T5888] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1202.863154][ T5888] input input70: Device does not respond to id packet P [ 1202.892731][ T5888] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1202.908215][ T5888] input input70: Device does not respond to id packet B [ 1202.937316][T19880] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1202.968987][ T5888] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1202.993322][ T5888] input input70: Device does not respond to id packet N [ 1203.025118][ T5888] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1203.039240][ T5888] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1203.069308][ T5888] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1203.095918][ T5888] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 1203.122621][ T5888] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input70 [ 1203.219242][T19880] : (slave netdevsim0): Releasing backup interface [ 1203.251574][ T5888] usb 2-1: USB disconnect, device number 126 [ 1203.302195][T19880] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1203.638983][T19995] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1203.879765][T13920] Bluetooth: hci0: command tx timeout [ 1203.896497][T19880] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1203.944275][T19880] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1203.998735][T19880] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1204.034715][T19880] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1204.278391][T20005] usb usb8: usbfs: process 20005 (syz.3.4190) did not claim interface 0 before use [ 1204.435592][T19880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1204.533923][T20013] input: syz0 as /devices/virtual/input/input71 [ 1204.557389][T19880] 8021q: adding VLAN 0 to HW filter on device team0 [ 1204.587875][T11390] bridge0: port 1(bridge_slave_0) entered blocking state [ 1204.595101][T11390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1204.669005][T11390] bridge0: port 2(bridge_slave_1) entered blocking state [ 1204.676473][T11390] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1204.975805][T19880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1205.150881][T19880] veth0_vlan: entered promiscuous mode [ 1205.195275][T19880] veth1_vlan: entered promiscuous mode [ 1205.355205][T19880] veth0_macvtap: entered promiscuous mode [ 1205.387780][T19880] veth1_macvtap: entered promiscuous mode [ 1205.486027][T19880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1205.512280][T19880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1205.531973][T19880] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1205.546009][T19880] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1205.566499][T19880] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1205.603701][T19880] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1205.716252][T20044] netlink: 328 bytes leftover after parsing attributes in process `syz.5.4206'. [ 1205.895866][T20041] kvm: kvm [20040]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0xc003199 [ 1205.908204][T20041] kvm: kvm [20040]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xc003199 [ 1205.922151][T20041] kvm: kvm [20040]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 1205.934756][T20046] kvm: kvm [20045]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x396d [ 1205.953732][T20041] kvm: kvm [20040]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x6599 [ 1205.964113][T11390] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1205.965551][T20046] kvm: kvm [20045]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x396d [ 1205.972537][T13920] Bluetooth: hci0: command tx timeout [ 1205.986775][T18830] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 1206.004054][T20041] kvm: kvm [20040]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0x6599 [ 1206.012915][T11390] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1206.032504][T20046] kvm: kvm [20045]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x396d [ 1206.041672][T20046] kvm: kvm [20045]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0x396d [ 1206.055727][T20046] kvm: kvm [20045]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x396d [ 1206.069573][T20046] kvm_intel: kvm [20045]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x216d [ 1206.169609][T18830] usb 2-1: Using ep0 maxpacket: 8 [ 1206.177657][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1206.203293][T18830] usb 2-1: config index 0 descriptor too short (expected 5924, got 36) [ 1206.212294][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1206.225003][T18830] usb 2-1: config 250 has an invalid interface number: 228 but max is -1 [ 1206.256533][T18830] usb 2-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 1206.286263][T18830] usb 2-1: config 250 has no interface number 0 [ 1206.305491][T18830] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 1206.336507][T18830] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1206.392898][T18830] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1206.420842][T18830] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 1206.465085][T18830] usb 2-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 1206.510090][T20062] fuse: Unknown parameter 'use00000000000000000000' [ 1206.519616][T18830] usb 2-1: config 250 interface 228 has no altsetting 0 [ 1206.549275][T18830] usb 2-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 1206.571361][T18830] usb 2-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 1206.601481][T18830] usb 2-1: Product: syz [ 1206.610632][T18830] usb 2-1: SerialNumber: syz [ 1206.642705][T18830] hub 2-1:250.228: bad descriptor, ignoring hub [ 1206.649313][T18830] hub 2-1:250.228: probe with driver hub failed with error -5 [ 1206.828209][T20069] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4214'. [ 1206.859917][T18830] usblp 2-1:250.228: usblp0: USB Bidirectional printer dev 127 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 1207.168811][T20077] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 1207.261842][T19337] usb 2-1: USB disconnect, device number 127 [ 1207.633615][T19337] usblp0: removed [ 1207.713540][T18831] IPVS: starting estimator thread 0... [ 1207.853669][T19546] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1207.860030][T20085] IPVS: using max 31 ests per chain, 74400 per kthread [ 1207.876083][T19546] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1207.885310][T19546] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1207.897054][T19546] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1207.908621][T19546] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1208.101477][T20092] netlink: 14212 bytes leftover after parsing attributes in process `syz.1.4224'. [ 1208.217835][T19337] usb 3-1: USB disconnect, device number 67 [ 1208.299721][ T5888] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 1208.554386][ T5888] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 1208.577269][ T5888] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1208.594714][ T5888] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 1208.606249][ T5888] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 255, setting to 64 [ 1208.618886][ T5888] usb 5-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1208.636765][ T5888] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1208.690501][ T5888] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1208.716228][ T5888] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1208.746786][ T5888] usb 5-1: Product: syz [ 1208.764637][ T5888] usb 5-1: Manufacturer: syz [ 1208.777089][ T5888] usb 5-1: SerialNumber: syz [ 1208.798289][ T5888] usb 5-1: config 0 descriptor?? [ 1208.811596][T20089] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1208.814239][ T5888] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1208.879341][ T5888] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1209.099206][T20090] chnl_net:caif_netlink_parms(): no params data found [ 1209.251435][ T5888] usb 5-1: USB disconnect, device number 17 [ 1209.253810][ T5888] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 1209.835776][T20090] bridge0: port 1(bridge_slave_0) entered blocking state [ 1209.854016][T20090] bridge0: port 1(bridge_slave_0) entered disabled state [ 1209.868781][T20090] bridge_slave_0: entered allmulticast mode [ 1209.877550][T20090] bridge_slave_0: entered promiscuous mode [ 1209.897647][T20090] bridge0: port 2(bridge_slave_1) entered blocking state [ 1209.916374][T20090] bridge0: port 2(bridge_slave_1) entered disabled state [ 1209.935413][T20090] bridge_slave_1: entered allmulticast mode [ 1209.951513][T20090] bridge_slave_1: entered promiscuous mode [ 1209.960225][T19546] Bluetooth: hci1: command tx timeout [ 1210.099601][T18830] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1210.167838][T20090] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1210.193107][T20090] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1210.291310][T18830] usb 2-1: Using ep0 maxpacket: 8 [ 1210.316913][T18830] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1210.335865][T20090] team0: Port device team_slave_0 added [ 1210.342870][T18830] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1210.360722][T20090] team0: Port device team_slave_1 added [ 1210.367207][T18830] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1210.387893][T18830] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1210.407251][T18830] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1210.418131][T18830] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1210.484266][T20090] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1210.491574][T20090] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1210.562390][T20090] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1210.675365][T20090] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1210.687043][T18830] usb 2-1: GET_CAPABILITIES returned 0 [ 1210.700796][T18830] usbtmc 2-1:16.0: can't read capabilities [ 1210.719855][T20090] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1210.827646][T20090] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1210.893292][T18831] usb 2-1: USB disconnect, device number 2 [ 1211.008475][T20090] hsr_slave_0: entered promiscuous mode [ 1211.018675][T20090] hsr_slave_1: entered promiscuous mode [ 1211.028656][T20090] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1211.037242][T20090] Cannot create hsr debugfs directory [ 1211.832213][T20179] syz_tun: entered allmulticast mode [ 1211.855189][T20177] syz_tun: left allmulticast mode [ 1212.043597][T19546] Bluetooth: hci1: command tx timeout [ 1212.146198][T20090] bond0: (slave netdevsim0): Releasing backup interface [ 1212.645909][T20090] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1212.701223][T20090] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1212.749747][T20090] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1212.786622][T20090] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1213.176732][T20090] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1213.264226][T20090] 8021q: adding VLAN 0 to HW filter on device team0 [ 1213.309373][ T1042] bridge0: port 1(bridge_slave_0) entered blocking state [ 1213.316614][ T1042] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1213.361815][T20223] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4281'. [ 1213.370020][ T1042] bridge0: port 2(bridge_slave_1) entered blocking state [ 1213.378504][ T1042] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1213.708987][T20090] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1213.969682][T20090] veth0_vlan: entered promiscuous mode [ 1214.037067][T20090] veth1_vlan: entered promiscuous mode [ 1214.121793][T19546] Bluetooth: hci1: command tx timeout [ 1214.166259][T20090] veth0_macvtap: entered promiscuous mode [ 1214.179319][T20090] veth1_macvtap: entered promiscuous mode [ 1214.206674][T20090] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1214.264153][T20090] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1214.329332][T20090] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.379489][T20090] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.408677][T20090] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.440879][T20090] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1214.722418][ T1042] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1214.771753][ T1042] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1214.875898][T11390] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1214.920784][T11390] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1215.336376][T20276] random: crng reseeded on system resumption [ 1215.748626][T20290] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4309'. [ 1216.200970][T19546] Bluetooth: hci1: command tx timeout [ 1216.384855][T20307] xt_hashlimit: size too large, truncated to 1048576 [ 1216.749188][T20321] veth1_macvtap: left promiscuous mode [ 1218.063806][T20340] netlink: 'syz.3.4326': attribute type 13 has an invalid length. [ 1218.263205][T20346] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4328'. [ 1218.620309][T20340] bridge0: port 2(bridge_slave_1) entered disabled state [ 1218.628113][T20340] bridge0: port 1(bridge_slave_0) entered disabled state [ 1219.416423][T20330] ALSA: mixer_oss: invalid OSS volume '' [ 1219.587019][T20340] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1219.607995][T20340] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1220.225694][T20373] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4333'. [ 1220.337725][T20340] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1220.356952][T20340] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1220.381783][T20379] xt_hashlimit: size too large, truncated to 1048576 [ 1220.388708][T20340] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1220.419128][T20340] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1222.922704][T11420] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 1223.137035][T11420] usb 5-1: config 0 has an invalid interface number: 255 but max is 1 [ 1223.186189][T11420] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1223.259382][T11420] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1223.335320][T11420] usb 5-1: config 0 has no interface number 0 [ 1223.396521][T11420] usb 5-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 1223.527936][T11420] usb 5-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1223.555019][T11420] usb 5-1: config 0 interface 255 has no altsetting 0 [ 1223.649513][T11420] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1223.669185][T20391] ALSA: mixer_oss: invalid OSS volume '' [ 1223.746553][T11420] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1223.848800][T11420] usb 5-1: config 0 descriptor?? [ 1224.097275][T11420] usb 5-1: string descriptor 0 read error: -71 [ 1224.158165][T11420] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1224.196663][T11420] dvb-usb: bulk message failed: -22 (3/0) [ 1224.242228][T11420] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1224.276832][T11420] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1224.301295][T11420] usb 5-1: media controller created [ 1224.314850][T11420] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1224.370902][T11420] dvb-usb: bulk message failed: -22 (6/0) [ 1224.409994][T11420] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1224.439899][T11420] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input72 [ 1224.506512][T11420] dvb-usb: schedule remote query interval to 150 msecs. [ 1224.533215][T11420] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1224.573944][T11420] usb 5-1: USB disconnect, device number 18 [ 1224.606866][T11420] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1224.710103][T18825] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 1224.862263][T18825] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1224.892392][T18825] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1224.921555][T18825] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1224.937173][T18825] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1224.946875][T18825] usb 4-1: Product: syz [ 1224.951524][T18825] usb 4-1: Manufacturer: syz [ 1224.956327][T18825] usb 4-1: SerialNumber: syz [ 1224.989114][T18825] cdc_mbim 4-1:1.0: skipping garbage [ 1225.110094][T18829] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 1225.198312][T20436] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1225.269585][T18829] usb 5-1: Using ep0 maxpacket: 32 [ 1225.283359][T18829] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 1225.308470][T18829] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1225.333560][T18829] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1225.359552][T18829] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1225.389539][T18829] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1225.442638][T18829] usb 5-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 1225.481325][T18829] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1225.517478][T18829] usb 5-1: Product: syz [ 1225.535188][T18829] usb 5-1: Manufacturer: syz [ 1225.543980][T20452] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4360'. [ 1225.559897][T18829] usb 5-1: SerialNumber: syz [ 1225.573604][T18829] usb 5-1: config 0 descriptor?? [ 1225.587154][T20446] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1225.620580][T18829] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input73 [ 1225.643967][ T5185] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1225.667572][ T5185] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1225.772399][ T5185] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1225.801971][ T5185] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1225.844542][T20436] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1225.864415][T18825] cdc_mbim 4-1:1.0: setting tx_max = 184 [ 1225.880708][T20446] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1225.891056][T18825] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 1225.948824][T18825] wwan wwan0: port wwan0mbim0 attached [ 1225.966305][ T5185] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1226.072232][T18825] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, ce:b6:57:5a:ef:fe [ 1226.083160][T19739] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1226.094205][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.101132][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.108030][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.114753][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.122577][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.129311][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.136635][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.143437][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.150279][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.156998][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.163733][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.170462][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.176838][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.183553][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.190286][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.197007][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.203899][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.210630][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.217000][ C1] cdc_mbim 4-1:1.0: nonzero urb status received: -71 [ 1226.223720][ C1] cdc_mbim 4-1:1.0: wdm_int_callback - 0 bytes [ 1226.278485][T18825] usb 4-1: USB disconnect, device number 60 [ 1226.278761][ T5185] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1226.295928][T18825] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 1226.440095][ T5185] xpad 5-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1226.620565][T18825] wwan wwan0: port wwan0mbim0 disconnected [ 1226.829662][T11420] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 1227.122865][T20485] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4372'. [ 1227.172354][T11420] usb 3-1: Using ep0 maxpacket: 16 [ 1227.192655][T20490] syz_tun: entered allmulticast mode [ 1227.201040][T11420] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1227.230024][T18826] usb 5-1: USB disconnect, device number 19 [ 1227.242237][T20488] syz_tun: left allmulticast mode [ 1227.274462][T11420] usb 3-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 1227.346248][T11420] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1227.399193][T11420] usb 3-1: Product: syz [ 1227.438659][T11420] usb 3-1: Manufacturer: syz [ 1227.453651][T11420] usb 3-1: SerialNumber: syz [ 1227.476995][T11420] usb 3-1: config 0 descriptor?? [ 1227.497374][T11420] hub 3-1:0.0: bad descriptor, ignoring hub [ 1227.512329][T11420] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1227.567557][T11420] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input74 [ 1227.729940][T20500] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4378'. [ 1228.459220][T20521] syz_tun: entered allmulticast mode [ 1228.478137][T20517] syz_tun: left allmulticast mode [ 1228.510444][T20520] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4385'. [ 1229.779094][T20553] lo: entered allmulticast mode [ 1229.802410][T20552] lo: left allmulticast mode [ 1229.846955][T20557] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4399'. [ 1230.374082][T11420] usb 3-1: USB disconnect, device number 68 [ 1230.711670][T20582] loop6: detected capacity change from 0 to 524287999 [ 1230.858132][T20585] netlink: 'syz.4.4394': attribute type 12 has an invalid length. [ 1231.249387][T20595] syz_tun: entered allmulticast mode [ 1231.297648][T20594] syz_tun: left allmulticast mode [ 1231.305260][T20597] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4412'. [ 1231.603526][T20603] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(5) [ 1231.610108][T20603] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1231.739821][T20603] vhci_hcd vhci_hcd.0: Device attached [ 1231.979881][T18829] usb 43-1: new low-speed USB device number 2 using vhci_hcd [ 1231.993471][T20604] vhci_hcd: connection closed [ 1232.011208][T20606] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 1232.249852][ T13] vhci_hcd: stop threads [ 1232.269537][ T13] vhci_hcd: release socket [ 1232.408850][ T13] vhci_hcd: disconnect device [ 1233.385676][T20635] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4425'. [ 1234.467436][T20657] tipc: Started in network mode [ 1234.494268][T20657] tipc: Node identity ac1414aa, cluster identity 4711 [ 1234.518949][T20657] tipc: Enabled bearer , priority 10 [ 1234.580036][T20657] openvswitch: netlink: Key 6 has unexpected len 4 expected 2 [ 1234.608224][T20645] trusted_key: encrypted_key: insufficient parameters specified [ 1234.867867][T20665] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4436'. [ 1235.112795][ C1] vkms_vblank_simulate: vblank timer overrun [ 1235.643603][ C1] vkms_vblank_simulate: vblank timer overrun [ 1237.182931][ C1] vkms_vblank_simulate: vblank timer overrun [ 1241.639895][T20366] tipc: Node number set to 2886997162 [ 1340.089397][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1340.096427][ C0] rcu: 1-...!: (3 ticks this GP) idle=ee1c/1/0x4000000000000000 softirq=157155/157155 fqs=3 [ 1340.107909][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P20665/1:b..l [ 1340.115950][ C0] rcu: (detected by 0, t=10505 jiffies, g=166713, q=569 ncpus=2) [ 1340.123789][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1340.123832][ C1] NMI backtrace for cpu 1 [ 1340.123849][ C1] CPU: 1 UID: 0 PID: 20642 Comm: syz.1.4421 Not tainted 6.15.0-syzkaller-09113-g8477ab143069 #0 PREEMPT(full) [ 1340.123872][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1340.123885][ C1] RIP: 0010:__hrtimer_run_queues+0x4b3/0xc60 [ 1340.123915][ C1] Code: 04 41 dc 0d 01 0f 85 9d 02 00 00 e8 17 e8 11 00 4d 8d 6c 24 3b 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 0f 85 4b 03 00 00 45 0f b6 6d 00 31 ff 44 89 ee e8 e6 ea 11 [ 1340.123932][ C1] RSP: 0018:ffffc90000a08d40 EFLAGS: 00000806 [ 1340.123949][ C1] RAX: 0000000000000000 RBX: ffff8880b8727c08 RCX: dffffc0000000000 [ 1340.123963][ C1] RDX: 0000000000010000 RSI: ffffffff8be26560 RDI: ffffffff8be26520 [ 1340.123976][ C1] RBP: ffffc90000a08e90 R08: ffffffff8fa0a8f7 R09: 1ffffffff1f4151e [ 1340.123991][ C1] R10: dffffc0000000000 R11: fffffbfff1f4151f R12: ffff88805568b340 [ 1340.124005][ C1] R13: ffff88805568b37b R14: ffffffff898356f0 R15: 0000000000000001 [ 1340.124019][ C1] FS: 00007f3e675e76c0(0000) GS:ffff888125d65000(0000) knlGS:0000000000000000 [ 1340.124036][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1340.124049][ C1] CR2: 00007fc8d6b73f98 CR3: 00000000687b8000 CR4: 00000000003526f0 [ 1340.124066][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1340.124077][ C1] DR3: 0000000000001000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1340.124090][ C1] Call Trace: [ 1340.124100][ C1] [ 1340.124126][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 1340.124149][ C1] ? read_tsc+0x9/0x20 [ 1340.124173][ C1] hrtimer_interrupt+0x45b/0xaa0 [ 1340.124210][ C1] __sysvec_apic_timer_interrupt+0x10b/0x410 [ 1340.124237][ C1] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 1340.124268][ C1] [ 1340.124274][ C1] [ 1340.124282][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1340.124303][ C1] RIP: 0010:rcu_is_watching+0x3a/0xb0 [ 1340.124326][ C1] Code: e8 cb 89 bc 09 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 60 3c b9 8d 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 5c 53 7c 00 48 c7 c3 58 df 9c 92 49 03 1e 48 89 [ 1340.124341][ C1] RSP: 0018:ffffc90004b1f278 EFLAGS: 00000246 [ 1340.124357][ C1] RAX: 1ffffffff1b7278d RBX: 0000000000000001 RCX: 483ff96dd889e500 [ 1340.124371][ C1] RDX: 0000000000000000 RSI: ffffffff8be26560 RDI: ffffffff8be26520 [ 1340.124384][ C1] RBP: ffffffff81727865 R08: 0000000000000000 R09: 0000000000000000 [ 1340.124396][ C1] R10: ffffc90004b1f458 R11: ffffffff81acdbe0 R12: 0000000000000002 [ 1340.124426][ C1] R13: ffffffff8e13cc80 R14: ffffffff8db93c68 R15: dffffc0000000000 [ 1340.124443][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1340.124478][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1340.124511][ C1] ? rcu_is_watching+0x15/0xb0 [ 1340.124534][ C1] lock_acquire+0x5f/0x360 [ 1340.124557][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1340.124579][ C1] ? io_arm_poll_handler+0x726/0xb70 [ 1340.124602][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1340.124625][ C1] unwind_next_frame+0xc2/0x2390 [ 1340.124648][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1340.124674][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1340.124703][ C1] ? __io_arm_poll_handler+0x372/0xbb0 [ 1340.124727][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1340.124754][ C1] arch_stack_walk+0x11c/0x150 [ 1340.124783][ C1] ? io_arm_poll_handler+0x726/0xb70 [ 1340.124807][ C1] stack_trace_save+0x9c/0xe0 [ 1340.124840][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1340.124869][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 1340.124901][ C1] kasan_save_track+0x3e/0x80 [ 1340.124921][ C1] ? kasan_save_track+0x3e/0x80 [ 1340.124940][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 1340.124961][ C1] ? __kmalloc_cache_noprof+0x230/0x3d0 [ 1340.124984][ C1] ? __io_queue_proc+0x23a/0x4d0 [ 1340.125011][ C1] ? vb2_fop_poll+0x251/0x380 [ 1340.125040][ C1] ? v4l2_poll+0x147/0x2c0 [ 1340.125061][ C1] ? __io_arm_poll_handler+0x372/0xbb0 [ 1340.125081][ C1] ? io_arm_poll_handler+0x726/0xb70 [ 1340.125133][ C1] __kasan_kmalloc+0x93/0xb0 [ 1340.125165][ C1] __kmalloc_cache_noprof+0x230/0x3d0 [ 1340.125188][ C1] ? __io_queue_proc+0x23a/0x4d0 [ 1340.125212][ C1] __io_queue_proc+0x23a/0x4d0 [ 1340.125234][ C1] ? vb2_core_poll+0x4a9/0x840 [ 1340.125260][ C1] vb2_fop_poll+0x251/0x380 [ 1340.125291][ C1] ? __pfx_vb2_fop_poll+0x10/0x10 [ 1340.125314][ C1] v4l2_poll+0x147/0x2c0 [ 1340.125335][ C1] ? __pfx_v4l2_poll+0x10/0x10 [ 1340.125357][ C1] __io_arm_poll_handler+0x372/0xbb0 [ 1340.125386][ C1] io_arm_poll_handler+0x726/0xb70 [ 1340.125413][ C1] ? __pfx_io_arm_poll_handler+0x10/0x10 [ 1340.125434][ C1] ? __pfx_io_async_queue_proc+0x10/0x10 [ 1340.125458][ C1] ? io_issue_sqe+0x3bb/0xfd0 [ 1340.125478][ C1] io_queue_async+0x79/0x2f0 [ 1340.125500][ C1] ? __pfx_io_req_task_submit+0x10/0x10 [ 1340.125528][ C1] io_handle_tw_list+0x34d/0x4c0 [ 1340.125559][ C1] tctx_task_work_run+0x99/0x370 [ 1340.125588][ C1] tctx_task_work+0x3f/0x90 [ 1340.125615][ C1] task_work_run+0x1d1/0x260 [ 1340.125636][ C1] ? __pfx_task_work_run+0x10/0x10 [ 1340.125655][ C1] ? __pfx_futex_wake+0x10/0x10 [ 1340.125673][ C1] ? x64_setup_rt_frame+0x96b/0xd40 [ 1340.125695][ C1] get_signal+0x11ed/0x1340 [ 1340.125721][ C1] ? do_futex+0x395/0x420 [ 1340.125753][ C1] arch_do_signal_or_restart+0x9a/0x750 [ 1340.125776][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1340.125804][ C1] ? exit_to_user_mode_loop+0x40/0x110 [ 1340.125826][ C1] exit_to_user_mode_loop+0x75/0x110 [ 1340.125847][ C1] do_syscall_64+0x2bd/0x3b0 [ 1340.125866][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1340.125885][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1340.125909][ C1] ? clear_bhb_loop+0x60/0xb0 [ 1340.125931][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1340.125949][ C1] RIP: 0033:0x7f3e6678e969 [ 1340.125967][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1340.125983][ C1] RSP: 002b:00007f3e675e7038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1340.126001][ C1] RAX: 0000000000000800 RBX: 00007f3e669b6160 RCX: 00007f3e6678e969 [ 1340.126014][ C1] RDX: 0000000000000000 RSI: 0000000000003516 RDI: 0000000000000008 [ 1340.126025][ C1] RBP: 00007f3e66810ab1 R08: 0000000000000000 R09: 0000000000000000 [ 1340.126037][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1340.126048][ C1] R13: 0000000000000000 R14: 00007f3e669b6160 R15: 00007f3e66adfa28 [ 1340.126071][ C1] [ 1340.126825][ C0] task:syz.4.4436 state:R running task stack:25032 pid:20665 tgid:20664 ppid:19880 task_flags:0x40054c flags:0x00004000 [ 1340.778016][ C0] Call Trace: [ 1340.781321][ C0] [ 1340.784286][ C0] __schedule+0x16f5/0x4d00 [ 1340.788834][ C0] ? free_pages_and_swap_cache+0x4be/0x520 [ 1340.794672][ C0] ? __pfx_free_pages_and_swap_cache+0x10/0x10 [ 1340.800853][ C0] ? preempt_schedule_common+0x83/0xd0 [ 1340.806343][ C0] ? __pfx___schedule+0x10/0x10 [ 1340.811325][ C0] ? do_raw_spin_lock+0x121/0x290 [ 1340.816399][ C0] ? preempt_schedule+0xae/0xc0 [ 1340.821286][ C0] preempt_schedule_common+0x83/0xd0 [ 1340.826598][ C0] preempt_schedule+0xae/0xc0 [ 1340.831310][ C0] ? __pfx_preempt_schedule+0x10/0x10 [ 1340.836768][ C0] preempt_schedule_thunk+0x16/0x30 [ 1340.842016][ C0] _raw_spin_unlock+0x3f/0x50 [ 1340.846733][ C0] unmap_page_range+0x38e8/0x4580 [ 1340.851789][ C0] ? __pfx_flush_tlb_func+0x10/0x10 [ 1340.857082][ C0] ? __pfx_unmap_page_range+0x10/0x10 [ 1340.862499][ C0] ? unmap_single_vma+0x1b2/0x2a0 [ 1340.867564][ C0] unmap_vmas+0x25d/0x3c0 [ 1340.871938][ C0] ? __pfx_unmap_vmas+0x10/0x10 [ 1340.876873][ C0] exit_mmap+0x245/0xba0 [ 1340.881154][ C0] ? __pfx_exit_mmap+0x10/0x10 [ 1340.885944][ C0] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1340.891616][ C0] ? __pfx_exit_aio+0x10/0x10 [ 1340.896335][ C0] ? uprobe_clear_state+0x274/0x290 [ 1340.901570][ C0] __mmput+0x118/0x420 [ 1340.905671][ C0] exit_mm+0x1da/0x2c0 [ 1340.909765][ C0] ? __pfx_exit_mm+0x10/0x10 [ 1340.914383][ C0] ? rcu_is_watching+0x15/0xb0 [ 1340.919182][ C0] do_exit+0x864/0x2550 [ 1340.923359][ C0] ? __lock_acquire+0xab9/0xd20 [ 1340.928244][ C0] ? do_raw_spin_lock+0x121/0x290 [ 1340.933303][ C0] ? __pfx_do_exit+0x10/0x10 [ 1340.937913][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1340.943334][ C0] do_group_exit+0x21c/0x2d0 [ 1340.947945][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1340.953166][ C0] get_signal+0x1286/0x1340 [ 1340.957717][ C0] arch_do_signal_or_restart+0x9a/0x750 [ 1340.963292][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1340.969479][ C0] ? __fget_files+0x2a/0x420 [ 1340.974108][ C0] ? exit_to_user_mode_loop+0x40/0x110 [ 1340.979594][ C0] exit_to_user_mode_loop+0x75/0x110 [ 1340.984902][ C0] do_syscall_64+0x2bd/0x3b0 [ 1340.989515][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1340.994735][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1341.000828][ C0] ? clear_bhb_loop+0x60/0xb0 [ 1341.005533][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1341.011445][ C0] RIP: 0033:0x7f602df8e969 [ 1341.015878][ C0] RSP: 002b:00007f602edb90e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1341.024321][ C0] RAX: fffffffffffffe00 RBX: 00007f602e1b5fa8 RCX: 00007f602df8e969 [ 1341.032311][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f602e1b5fa8 [ 1341.040300][ C0] RBP: 00007f602e1b5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1341.048293][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f602e1b5fac [ 1341.056282][ C0] R13: 0000000000000000 R14: 00007f602e2df940 R15: 00007f602e2dfa28 [ 1341.064296][ C0] [ 1341.067347][ C0] rcu: rcu_preempt kthread starved for 9836 jiffies! g166713 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 1341.078575][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1341.088570][ C0] rcu: RCU grace-period kthread stack dump: [ 1341.094476][ C0] task:rcu_preempt state:R running task stack:26104 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00004000 [ 1341.108009][ C0] Call Trace: [ 1341.111308][ C0] [ 1341.114261][ C0] __schedule+0x16f5/0x4d00 [ 1341.118809][ C0] ? do_raw_spin_unlock+0x122/0x240 [ 1341.124059][ C0] ? schedule+0x165/0x360 [ 1341.128430][ C0] ? __lock_acquire+0xab9/0xd20 [ 1341.133305][ C0] ? __pfx___schedule+0x10/0x10 [ 1341.138226][ C0] ? schedule+0x91/0x360 [ 1341.142507][ C0] schedule+0x165/0x360 [ 1341.146702][ C0] schedule_timeout+0x12b/0x270 [ 1341.151581][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1341.156982][ C0] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1341.162910][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1341.168232][ C0] ? prepare_to_swait_event+0x341/0x380 [ 1341.173831][ C0] rcu_gp_fqs_loop+0x301/0x1540 [ 1341.178730][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1341.183962][ C0] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 1341.190140][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1341.195464][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1341.200721][ C0] ? finish_swait+0xcd/0x1f0 [ 1341.205364][ C0] rcu_gp_kthread+0x99/0x390 [ 1341.209995][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1341.215224][ C0] ? __kthread_parkme+0x7b/0x200 [ 1341.220198][ C0] ? __kthread_parkme+0x1a1/0x200 [ 1341.225260][ C0] kthread+0x70e/0x8a0 [ 1341.229388][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1341.234611][ C0] ? __pfx_kthread+0x10/0x10 [ 1341.239232][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1341.244459][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 1341.249673][ C0] ? __pfx_kthread+0x10/0x10 [ 1341.254294][ C0] ret_from_fork+0x3fc/0x770 [ 1341.258927][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1341.264083][ C0] ? __switch_to_asm+0x39/0x70 [ 1341.268881][ C0] ? __switch_to_asm+0x33/0x70 [ 1341.273674][ C0] ? __pfx_kthread+0x10/0x10 [ 1341.278304][ C0] ret_from_fork_asm+0x1a/0x30 [ 1341.283114][ C0] [ 1341.286158][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1341.292497][ C0] CPU: 0 UID: 0 PID: 19757 Comm: udevd Not tainted 6.15.0-syzkaller-09113-g8477ab143069 #0 PREEMPT(full) [ 1341.303792][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1341.313861][ C0] RIP: 0010:smp_call_function_many_cond+0xe69/0x11c0 [ 1341.320569][ C0] Code: 00 45 8b 2f 44 89 ee 83 e6 01 31 ff e8 b0 77 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 5b 73 0b 00 eb 37 f3 90 <43> 0f b6 04 2c 84 c0 75 10 41 f7 07 01 00 00 00 74 1e e8 40 73 0b [ 1341.340196][ C0] RSP: 0000:ffffc90004687720 EFLAGS: 00000293 [ 1341.346288][ C0] RAX: ffffffff81b4ca70 RBX: ffff8880b863cc00 RCX: ffff88802b393c00 [ 1341.354279][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1341.362272][ C0] RBP: ffffc90004687880 R08: ffffffff8fa0a8f7 R09: 1ffffffff1f4151e [ 1341.370266][ C0] R10: dffffc0000000000 R11: fffffbfff1f4151f R12: 1ffff110170e826d [ 1341.378258][ C0] R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8880b8741368 [ 1341.386245][ C0] FS: 00007f9901547880(0000) GS:ffff888125c65000(0000) knlGS:0000000000000000 [ 1341.395191][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1341.401793][ C0] CR2: 000055c7baffa0e8 CR3: 0000000036de6000 CR4: 00000000003526f0 [ 1341.409790][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1341.417781][ C0] DR3: 0000000000001000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1341.425779][ C0] Call Trace: [ 1341.429075][ C0] [ 1341.432039][ C0] ? __pfx_should_flush_tlb+0x10/0x10 [ 1341.437463][ C0] ? __pfx_flush_tlb_func+0x10/0x10 [ 1341.442695][ C0] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 1341.449063][ C0] ? rcu_is_watching+0x15/0xb0 [ 1341.453881][ C0] ? __pfx_should_flush_tlb+0x10/0x10 [ 1341.459291][ C0] ? __pfx_flush_tlb_func+0x10/0x10 [ 1341.464522][ C0] on_each_cpu_cond_mask+0x3f/0x80 [ 1341.469668][ C0] flush_tlb_mm_range+0x6b1/0x12c0 [ 1341.474821][ C0] ? page_table_check_clear+0x187/0x700 [ 1341.480409][ C0] ? __pfx_flush_tlb_mm_range+0x10/0x10 [ 1341.485988][ C0] ? page_table_check_clear+0x187/0x700 [ 1341.491567][ C0] ? page_table_check_clear+0x4f3/0x700 [ 1341.497138][ C0] ? page_table_check_clear+0x187/0x700 [ 1341.502718][ C0] ptep_clear_flush+0x120/0x170 [ 1341.507602][ C0] do_wp_page+0x1bd6/0x57e0 [ 1341.512130][ C0] ? __lock_acquire+0xab9/0xd20 [ 1341.517022][ C0] ? do_wp_page+0x1650/0x57e0 [ 1341.521736][ C0] ? __pfx_do_wp_page+0x10/0x10 [ 1341.526614][ C0] ? do_raw_spin_lock+0x121/0x290 [ 1341.531673][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1341.537089][ C0] __handle_mm_fault+0x1144/0x55e0 [ 1341.542225][ C0] ? __lock_acquire+0xab9/0xd20 [ 1341.547147][ C0] ? __pfx___handle_mm_fault+0x10/0x10 [ 1341.552649][ C0] ? lock_vma_under_rcu+0xf8/0x710 [ 1341.557815][ C0] ? lock_vma_under_rcu+0xf8/0x710 [ 1341.562959][ C0] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 1341.568541][ C0] handle_mm_fault+0x40a/0x8e0 [ 1341.573350][ C0] do_user_addr_fault+0xa81/0x1390 [ 1341.578496][ C0] ? rcu_is_watching+0x15/0xb0 [ 1341.583289][ C0] ? trace_page_fault_user+0x84/0x1e0 [ 1341.588685][ C0] exc_page_fault+0x76/0xf0 [ 1341.593212][ C0] asm_exc_page_fault+0x26/0x30 [ 1341.598079][ C0] RIP: 0033:0x7f9900eb5b69 [ 1341.602520][ C0] Code: 10 48 81 f9 ff 03 00 00 76 28 48 8b 57 20 48 85 d2 74 1f 48 3b 7a 28 75 76 48 8b 4f 28 48 3b 79 20 75 6c 48 83 78 20 00 74 17 <48> 89 4a 28 48 89 51 20 48 83 c4 08 c3 66 2e 0f 1f 84 00 00 00 00 [ 1341.622147][ C0] RSP: 002b:00007ffc65709640 EFLAGS: 00010206 [ 1341.628245][ C0] RAX: 00007f9900ff20e0 RBX: 000055c7baffa0c0 RCX: 000055c7baffa0c0 [ 1341.636239][ C0] RDX: 000055c7baffa0c0 RSI: 00007f9900ff20e0 RDI: 000055c7baffa0c0 [ 1341.644230][ C0] RBP: 00007f9900ff1ac0 R08: 0000000000002760 R09: 0000000000000000 [ 1341.652224][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 00000000000032b0 [ 1341.660209][ C0] R13: 000055c7baffd370 R14: 0000000000003aa0 R15: 00007f9900ff1ac0 [ 1341.668215][ C0]