last executing test programs: 10m35.349766106s ago: executing program 1 (id=1015): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_GET_VRING_BASE(r0, 0x4008af25, &(0x7f0000000180)) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=@newlink={0x54, 0x10, 0xffffffffffffffff, 0x703d2f, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x3}, @IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x42, {0x7fff0, 0xfffff2c3}}]}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x54}, 0x1, 0x0, 0x0, 0x41}, 0x8008002) 10m34.68665075s ago: executing program 1 (id=1017): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000008850000007600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000005c0)=@newtaction={0x8e0, 0x30, 0xffffffffffffffff, 0x0, 0x40002, {}, [{0x8cc, 0x1, [@m_bpf={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x64, 0x7, 0x8, 0x1}}, @TCA_ACT_BPF_FD={0x8, 0x5, r1}]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x87c, 0x2, 0x0, 0x0, {{0xb}, {0x850, 0x2, 0x0, 0x1, [[@TCA_POLICE_AVRATE={0x8, 0x4, 0x8}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x28, 0xfffffff8, 0x3, 0x4, 0xffffffc0, 0x6, 0x5, 0x5, 0x2, 0x117, 0x10000, 0x8001, 0x2, 0x1, 0x7, 0x9, 0x80000000, 0xaa, 0x3ff, 0x4, 0x9, 0x0, 0x51, 0xf, 0x2, 0x1, 0x10000, 0x200, 0x7, 0x2, 0x4, 0x8, 0x101, 0x8, 0x0, 0x3, 0xe, 0x66d, 0x80000000, 0x3, 0x1, 0x8, 0x2, 0x7fff, 0xd, 0x4, 0x1ff, 0xffff, 0x7f, 0xfffffffd, 0x40, 0x7, 0x3, 0x400, 0x6, 0x8, 0x2, 0x1, 0x7, 0x9, 0x594, 0x0, 0x2900, 0x100, 0x4, 0x305c000, 0x7, 0xfffffff7, 0x7, 0x800, 0x5, 0xf24, 0x5, 0x7fffffff, 0x923, 0x101, 0x1155, 0x3, 0x1, 0x0, 0xffffffff, 0xcd2, 0xfffffffa, 0x800, 0x4, 0x81, 0x3, 0x0, 0x3, 0xf, 0x1, 0x1, 0xe, 0x3b2, 0x6, 0x4, 0x1ff, 0x6, 0x5, 0x1000, 0xe6, 0x7fff, 0x1, 0x8c, 0x1, 0x80, 0xfffffffb, 0x5, 0x7f0, 0xfffffff0, 0xffff, 0xfffffff7, 0xcfb6, 0x6, 0x4, 0x1194, 0xaf, 0xa, 0x2, 0xe0, 0x0, 0x7f, 0x6, 0x0, 0x2, 0x9a7, 0x7a2, 0x5, 0x83f, 0xa36e58b, 0x100, 0x9, 0x7, 0x8, 0x2, 0x1, 0xfffffffe, 0x1242, 0x579, 0x3, 0x5, 0x7, 0x0, 0x4, 0x8d, 0x3, 0x4, 0x5, 0x8, 0xc, 0x6, 0xffffffff, 0xaebe, 0x9, 0x90a, 0x7, 0x3, 0x2, 0x80000000, 0x9, 0x9, 0x5, 0xfffffff1, 0x3cd, 0xc, 0x4, 0x2, 0x9, 0x6, 0x4, 0x4, 0x7, 0x0, 0x2, 0x1, 0x5, 0x7f, 0xe6ef, 0x9, 0x6, 0x1, 0x7, 0x0, 0x7fffffff, 0x7, 0x0, 0x8, 0x9, 0x5, 0x8, 0x0, 0x6, 0x7, 0x1, 0x401, 0x8762, 0x9, 0x0, 0x4, 0x4, 0xff, 0x3, 0xc, 0x8, 0xf, 0x2, 0x6, 0x80000000, 0x3, 0x7f, 0xfffffffc, 0x2, 0x61, 0x8, 0x100, 0x5, 0xc56, 0xe, 0x0, 0x8, 0x8, 0x6, 0x9, 0x5b0, 0x6, 0xffff, 0x5f3, 0xc5f8, 0x1000, 0x2, 0x9, 0x7, 0x1, 0x1, 0x3, 0x600, 0x2, 0x200, 0x253a, 0xb, 0x9, 0x3, 0x0, 0xf, 0x1, 0x4, 0x2, 0x1000, 0x7, 0xb96, 0x3, 0xff, 0x8, 0x9, 0xb]}], [@TCA_POLICE_RATE={0x3ca, 0x2, [0x6, 0x1ff, 0x4835, 0x4c30, 0x8, 0x8, 0xffffff68, 0x1000000, 0x7, 0x1d, 0x8000, 0xd3d9, 0x2, 0x82fd, 0x3, 0x8000, 0x7f, 0x401, 0x800, 0x2, 0xe3a2, 0x2, 0x9, 0x1, 0x401, 0x400, 0x1855af6b, 0xff, 0xfffffffa, 0xf5, 0xffff70f3, 0x8, 0xfff, 0x6, 0x8, 0x7, 0x0, 0xf61, 0x8, 0x80000000, 0x5, 0xc2, 0x14c6, 0x4, 0x2, 0xfffff800, 0x3d3, 0x4, 0x0, 0x1, 0x163af427, 0x6, 0xfffffff8, 0xffff5f90, 0x9, 0x5, 0x6, 0xca41, 0x4, 0xffffffff, 0x7, 0x80000001, 0x7, 0x6, 0x80, 0x3, 0x9, 0x9, 0x8, 0x40, 0xe5, 0x6, 0x0, 0x4, 0xe, 0x9, 0xc7f, 0x7, 0x7363, 0x3, 0xc0000000, 0x7d2, 0x200, 0x13e, 0x5, 0x4d, 0x10000, 0x2, 0x1e7, 0x8, 0x7fff, 0xfffffff8, 0xc, 0x6, 0x3, 0xfffffff9, 0xb, 0x8001, 0x7, 0xfffffffe, 0x7, 0x0, 0x954, 0x8, 0x3ff, 0x8, 0x0, 0xab2e, 0xaf, 0x7, 0x2, 0x4, 0x3, 0x3, 0x6, 0xe6, 0x8, 0x0, 0xfffffff8, 0x1, 0x2, 0xffffff52, 0x3, 0xf, 0x4, 0x2, 0x4, 0x6, 0x4, 0x3, 0x7, 0x7, 0xffffffff, 0x1, 0x9, 0x6, 0x4, 0x178, 0xbbfc, 0x8000, 0xc, 0x0, 0x7, 0x101, 0x9, 0xfff, 0x2, 0x4, 0x0, 0x2, 0x8, 0x0, 0x10, 0x8, 0x2, 0x62, 0x3, 0x6, 0x10000, 0x7, 0xe9, 0x6, 0x7f, 0x6, 0xfffffff8, 0x0, 0x0, 0x81, 0x2, 0x0, 0xd, 0x7f, 0x200000, 0x3, 0x2, 0x8839, 0x200, 0x80, 0xffff0000, 0x1ff, 0x6fc3eb4a, 0x8f, 0x2, 0x4, 0x6, 0x9, 0x7, 0x0, 0x1000, 0x7, 0x3, 0x8000, 0xb96, 0x200, 0x1, 0x80, 0xfff, 0xff, 0x400, 0xe7d, 0xd, 0x80000000, 0x9, 0xe122, 0x9, 0xffffff80, 0x2, 0x3, 0x3fffc000, 0x1ff, 0x6, 0x7, 0x0, 0x7, 0x7, 0x7, 0x6, 0x9000, 0xffffffff, 0x9, 0x800, 0x6, 0x1000, 0x0, 0xe, 0xcca, 0x7, 0x80, 0x0, 0x8, 0xef000000, 0x0, 0x3, 0x4, 0xba, 0x7ff, 0x1, 0x8, 0x5320, 0x7, 0xdd, 0x1, 0xfb, 0x1ff, 0x6, 0xc90, 0x40, 0xffffffff, 0x2, 0x7, 0xd, 0x1, 0x0, 0x1, 0x73be, 0x5]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0xfffffffffffffffa, 0xffff, 0x7, 0x401, {0x4, 0x2, 0x3ff, 0x5, 0x3ff, 0x2ddc}, {0xb, 0x0, 0x8, 0x6, 0x2, 0xc23}, 0x5, 0x800, 0xec3b}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}, 0x8e0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 10m34.44964519s ago: executing program 1 (id=1019): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4008890) listen(r1, 0x0) getsockopt$inet_mptcp_buf(r1, 0x11c, 0x4, &(0x7f00000000c0)=""/206, 0x0) ioctl$KVM_KVMCLOCK_CTRL(0xffffffffffffffff, 0xaead) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x2000c044) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00006dbffc), 0x4) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) landlock_restrict_self(0xffffffffffffffff, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@newtfilter={0x40, 0x2c, 0xf3f, 0x30bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_fw={{0x7}, {0xfffffd30, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0xfff2, 0x2}}, @TCA_FW_MASK={0x8, 0x5, 0xb08}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20041090}, 0x20040090) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_route(0x10, 0x3, 0x0) 10m33.6863762s ago: executing program 1 (id=1023): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000180)=0x105) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000b00)=@mangle={'mangle\x00', 0x1f, 0x6, 0x598, 0x420, 0x230, 0x0, 0x0, 0x118, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x6, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private0={0xfc, 0x0, '\x00', 0x3}, [0xff, 0xffffffff, 0xff000000, 0xff0000ff], [0xffffff00, 0xffffff00, 0xff000000, 0xff], 'veth0_to_hsr\x00', 'veth0_to_bond\x00', {0xff}, {0xff}, 0x67, 0x6, 0x1}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@hbh={{0x48}, {0xb, 0x3, 0x1, [0xfffd, 0x0, 0x1, 0x7, 0x38, 0x9, 0x3, 0x0, 0xfff7, 0x7f, 0xee, 0x9a, 0x3, 0x9, 0x9, 0x1], 0xc}}]}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0xb}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @multicast2}, [0xffffffff, 0x0, 0x0, 0xff], [0xff000000, 0xff000000], 'macvtap0\x00', 'veth0_vlan\x00', {}, {}, 0x29, 0x80, 0x2, 0x42}, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv4=@empty, 0x2d, 0x32, 0x8}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x8, 0x77}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@ipv6header={{0x28}, {0x46, 0x80, 0x1}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0x0, 0xffff00, 0xffffff00, 0xff000000], [0xffffff00, 0xffffff00, 0xff000000, 0xff], 'syzkaller0\x00', 'veth0_to_hsr\x00', {0xff}, {}, 0x7a, 0x78, 0x2, 0x42}, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x6, 0x40}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5f8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000036c0)=[{{&(0x7f0000000080)=@tipc=@name, 0x80, &(0x7f0000000900)=[{&(0x7f00000005c0)=""/210, 0xd2}, {&(0x7f00000006c0)=""/244, 0xf4}, {&(0x7f0000000500)=""/81, 0x51}, {&(0x7f0000000240)=""/18, 0x12}, {&(0x7f00000007c0)=""/68, 0x44}, {&(0x7f0000000840)=""/177, 0xb1}], 0x6, &(0x7f0000001100)=""/4096, 0x1000}, 0x6}, {{&(0x7f0000000980)=@ax25={{0x3, @netrom}, [@netrom, @rose, @remote, @remote, @rose, @bcast, @rose, @null]}, 0x80, &(0x7f0000003300)=[{&(0x7f0000000a00)=""/113, 0x71}, {&(0x7f0000002100)=""/79, 0x4f}, {&(0x7f0000000480)=""/43, 0x2b}, {&(0x7f0000002180)=""/132, 0x84}, {&(0x7f0000000a80)}, {&(0x7f0000002240)=""/4096, 0x1000}, {&(0x7f0000003240)=""/45, 0x2d}, {&(0x7f0000003280)=""/2, 0x2}, {&(0x7f00000032c0)=""/26, 0xffffffc9}], 0x9}, 0xe}, {{&(0x7f00000033c0)=@nl, 0x80, &(0x7f00000035c0)=[{&(0x7f0000003440)=""/145, 0x91}, {&(0x7f0000003500)=""/86, 0x56}, {&(0x7f0000003580)=""/7, 0x7}], 0x3, &(0x7f0000003600)=""/158, 0x9e}, 0x7}], 0x3, 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r6, 0x0, 0x487, 0x0, 0x0) sendmsg$netlink(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="180000005600010600000000020000000700000000000000"], 0x18}], 0x1, 0x0, 0x0, 0x4000005}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1e0000591bd4ce000700000000000001000000004dbffe6f87d9c0f859978e5b2ed9190ad10e1f3a1a504041db95d985d28c619ec2199181ab4114e62dc80edbaecac748d5a6af2d894e29845307000000a53dce3871c5994e27f04fcbebe192514b7ba134ab28dab99c57cf7fd56281c4b5063e3acded5b044fef32d380d38ec2ad376736ab3f82cadf570b5148c11be092cc9c0636f059e9e0862982502f55c0cfab0f86586eb0682511c7a6f6493aba813e19978d8045ee4f1c182a44c09a905f937ab95cf3cf5a13345916d6c1901062fa792961ff6683fadc1c1cc41c07b3c85c9c5dd9f154f264f7ec5f335649f365b36b48f41f826d5385cb51ef1f0f2d04579fdfa1ef0ba238f2068405fceef04a8d6d765366034b3233d3f88f2507749009b63d85f5f7edf043459f07e5c039f5c67d616d47ad3199193769064731cb17ad5798300f51d02beebe8aff75c953a1782388df0789ffd59fd2d2e20c38bb11a29c7bcb24d286", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000000000000002b0b0000000000000100000000000000", @ANYRES32=r1, @ANYBLOB="00e700000000000200"/28]) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="040100001000010400400000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="0000000000000000bc00128009000100766c616e00000000ac00028004000480280004800c000100000001000100000086fd010000080000080000000c0001000100000009fe0000100003800c00010000020000ff000000580003800c00010002000000020000000c000100ffffff7f000200000c000100ff0f0000040000000c00010009000000000001000c00010000000000070000000c000100ffffffff000200000c000104b90a0000ff07000006000500810000000c0002000a000000f7ffffff13000300766c616e30"], 0x104}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) 10m31.678901879s ago: executing program 1 (id=1030): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$HIDIOCSUSAGES(0xffffffffffffffff, 0x501c4814, &(0x7f0000000dc0)={{0x1, 0x3, 0x9, 0x800, 0x5, 0x5}, 0x8d, [0x7, 0x93b, 0x6, 0x1, 0x1, 0xb8a, 0x2f, 0x100, 0x5, 0x7, 0x7, 0x5, 0x41d4, 0x83, 0x4, 0xffffffff, 0x9, 0x1000, 0x77e4, 0xffff0c56, 0x3, 0x1, 0x0, 0x40, 0x9, 0x200, 0x69, 0x4, 0x0, 0x6, 0x3, 0x7, 0x8, 0x8, 0xa522, 0x100, 0xfffffff8, 0x80000001, 0x0, 0x40, 0x1, 0x6, 0x1, 0x7fffffff, 0x5eb9, 0x5, 0x9c05, 0x800000c, 0x401, 0x4, 0x75, 0x817, 0xb, 0x3, 0xda90, 0x7, 0xf, 0xbc4b, 0x106, 0xfd, 0x81, 0x6, 0x101, 0x39, 0xffffff7f, 0x6, 0x5, 0x7, 0x77, 0xfffffffd, 0x0, 0x9, 0x73f, 0x5, 0x8, 0x4, 0x3, 0xffffffff, 0x5, 0x26be23d3, 0x7, 0x2, 0x9, 0x8, 0xdd2, 0xdd2, 0x3, 0x4, 0x2, 0xfff, 0x80000001, 0x9, 0x4, 0x0, 0x3, 0x2, 0x2, 0x5, 0x6, 0x1, 0x80000001, 0x7, 0x0, 0x40, 0x5, 0x101, 0x8, 0x9, 0x334c230c, 0x6, 0x4, 0xfffffff9, 0x8, 0x3, 0xffff0000, 0x7, 0x2, 0xffffffff, 0x4, 0x3, 0x4, 0x4, 0x3f, 0x81, 0x3, 0x400, 0x4, 0x984, 0x1, 0x6, 0x7, 0x8001, 0x1ff, 0x2a3, 0x6d, 0x1, 0x10000, 0x5, 0x80000000, 0x1d01e, 0x1, 0x3, 0xfffffffb, 0x8, 0x63, 0x400, 0x5, 0x401, 0x4, 0xfff, 0x0, 0x9, 0x3, 0x8, 0xfffffff9, 0x2, 0x80000000, 0x3, 0xc, 0x1, 0xad, 0x100, 0x144, 0x2, 0xfffffffc, 0x2, 0x5, 0x0, 0x5, 0x9, 0x1, 0x4, 0x1000, 0x974, 0x5, 0x2, 0x8, 0x5, 0x88, 0x1000, 0x0, 0x1, 0x2, 0x5, 0x9, 0x0, 0x57a, 0x0, 0x0, 0x6, 0x9, 0x5c, 0x6, 0x9, 0xd22, 0x2, 0x7, 0x10, 0x8, 0xffffffff, 0x2149, 0xf, 0x66a02622, 0x7fff, 0x8, 0x8, 0x7ff, 0x5, 0x8, 0x81, 0x8, 0xff, 0x5, 0xfffffffa, 0x2, 0x2, 0xffff, 0xf, 0x5, 0x7, 0x5, 0x100, 0x1e06, 0xf, 0xdf2, 0x0, 0xbb, 0xfff, 0x400, 0x2, 0x80000000, 0x7, 0x8, 0xf9b, 0x8, 0x7ff, 0x7, 0x3ff, 0x630a, 0x5, 0xcff, 0x9, 0xb7, 0x1, 0xff, 0x4, 0x5, 0x10, 0x1, 0x92a, 0x3, 0x5, 0xd, 0x5, 0x101, 0x6, 0x7fff, 0x800, 0x3, 0x4, 0x0, 0x7f, 0x200, 0x20, 0x7, 0x1000000, 0x0, 0x7f, 0x53, 0x8, 0x8, 0x5, 0x2, 0xf, 0xd81c, 0x840, 0x1, 0x9, 0x2, 0x81, 0x9, 0x3, 0x5, 0x6, 0x8, 0x47, 0x94, 0x7, 0x8, 0x8001, 0x56f71053, 0x1, 0x867, 0x3ff, 0x40, 0x6, 0x3, 0xfff, 0x5, 0x197, 0x9, 0x6, 0x5, 0x6, 0x7, 0x0, 0x84, 0x3, 0x1ff, 0x400, 0x3, 0xd42, 0x9, 0x5, 0x1ff, 0x4, 0x9, 0xbec, 0x5, 0x7, 0x3, 0x5, 0x64000000, 0x2, 0x1e, 0x3a, 0x6, 0x5, 0x18000, 0x2, 0xffff, 0x9, 0x6, 0x9, 0x0, 0xe4f, 0x67c, 0x27b7, 0xe, 0x9, 0x9, 0x5, 0xd, 0x5, 0x7f, 0x76, 0x9, 0xc4fe, 0x9, 0x3, 0x4, 0x8, 0x87, 0x1, 0x4, 0x7, 0x40, 0x9, 0x8, 0x1, 0x6, 0x8, 0xc75e, 0x4, 0x6, 0x1b, 0xfd3, 0x2, 0x3, 0x9, 0x10, 0x4, 0x5d2f, 0x5, 0x1b, 0x3ff, 0x5, 0x8, 0x6, 0xc000000, 0x5c, 0x9, 0x541b, 0xce, 0x6, 0x4, 0x69f, 0x3, 0x5, 0x7, 0x4, 0x200, 0x7, 0x8, 0x2323, 0xfffffff7, 0xffff, 0x7ff, 0x4, 0xd, 0xffffff42, 0x89, 0x80000001, 0x3ff, 0x3, 0x554, 0xde, 0x0, 0x400, 0x3, 0x9, 0x800, 0x7cb3aca3, 0x6, 0x6, 0x8, 0xf8000000, 0x1, 0xfffffff9, 0x9, 0xffffffff, 0x0, 0x3, 0x10000, 0x4, 0x3, 0x8001, 0x8, 0xbb, 0x5, 0xf548, 0x3, 0x36c, 0xffffffff, 0x10, 0x676, 0xe67, 0x88, 0x808, 0x560, 0x6db5, 0xa7b, 0x2, 0x4, 0x9, 0x3, 0x4, 0xffffffff, 0x6, 0xed2, 0x24bdaad2, 0x9, 0x4, 0x3, 0x1, 0xd599, 0x2, 0x6c51, 0x2, 0x0, 0x0, 0x2, 0xfce6, 0xf, 0xcd0, 0x4, 0xf, 0x0, 0x9, 0x5, 0x200, 0x6, 0x5, 0x2, 0x7, 0x17, 0xc36, 0x0, 0x8fbb, 0x3, 0x5, 0x0, 0x8, 0x8, 0x1, 0x8, 0x1000001, 0x45d8, 0x9, 0x0, 0x60000, 0x7, 0x2, 0xfffffff1, 0x3, 0x2, 0xfffffd67, 0x2, 0x4, 0x5, 0x3, 0x800, 0x10, 0xa, 0xb12c, 0x5ce, 0x1, 0xfffffffd, 0xf9c8, 0x0, 0x80f4, 0x10000, 0x3, 0x8, 0x2, 0x7, 0x5, 0x8, 0x401, 0x7, 0x10, 0x0, 0x6b, 0x100, 0x8, 0x2, 0x2, 0x5273, 0xe45f, 0x10, 0x0, 0x8, 0x4, 0x7, 0x7, 0x6, 0x4, 0x8e8b, 0x5, 0x3, 0x7, 0x3, 0xe535, 0x80, 0x5, 0x6, 0x0, 0x3, 0xff, 0x7fffffff, 0x5, 0x1, 0xa, 0x4, 0x1, 0x31, 0x0, 0xee1, 0x10001, 0x3, 0xfffffffc, 0x4, 0x1, 0x6f9, 0x7, 0xb26c, 0xb, 0x0, 0xfffffff3, 0x4000008, 0x8, 0x3, 0x6, 0xfd, 0x3, 0x3d, 0x6, 0x80000001, 0x5, 0x5, 0x1, 0xffffffff, 0x6, 0x3d29, 0x4, 0x7, 0x8, 0xb04, 0x3, 0xea6, 0x9, 0x101, 0x4, 0x1400, 0xfffffeff, 0x7, 0x2, 0x4, 0x8, 0x7, 0xe, 0x2, 0xc, 0x2, 0x2, 0x64c1, 0x80000000, 0x200, 0x2, 0xfffffffd, 0x1, 0x91, 0x8001, 0x401, 0x781d, 0x80, 0xfffff5b0, 0x8, 0x3, 0x8, 0xfff, 0xcd800000, 0x9, 0x6, 0x0, 0x5b5, 0x7, 0x10, 0x2, 0x5, 0x10001, 0xc, 0x9e9, 0x53, 0xfffffdd5, 0xc, 0xc00, 0x40, 0x401, 0xf2a6, 0x7, 0x3, 0x2, 0x7, 0x3800000, 0x1, 0x3ff, 0x3, 0x7fffffff, 0x4, 0x0, 0x1, 0xf, 0x7, 0xa84d, 0x3, 0xaf, 0xaf72, 0x5f, 0x1, 0xe, 0x6, 0x9, 0x5, 0x7, 0x3, 0x5, 0x3, 0x40, 0x1000, 0x75f1, 0x4, 0x3, 0x1, 0xfffffffd, 0x4, 0x8, 0x10, 0x80, 0x2, 0x6, 0x0, 0xe, 0xc, 0x3, 0x2, 0xd, 0x5, 0xfffff3f2, 0x6, 0x8, 0x3, 0x6, 0x5, 0x3, 0x101, 0x8, 0xbd, 0xa, 0x8, 0xffffed34, 0x8000, 0x2, 0x7, 0xfffffff8, 0x55f4727b, 0xd, 0x3b, 0x5, 0x8, 0xffffffff, 0x4, 0x81, 0x6, 0xb, 0x2, 0xa53, 0xff, 0x0, 0x2, 0x5, 0x3233, 0xff, 0x6, 0x2, 0x9, 0x1, 0x0, 0x3ff, 0x5, 0x8, 0x40, 0x0, 0x40, 0x88, 0x5, 0x80, 0x4, 0xd0000000, 0x8, 0x4, 0x5, 0x5, 0x7, 0x0, 0x0, 0x76b, 0xbb, 0x2, 0x5, 0x7fff, 0x9, 0xa, 0x5, 0x80, 0x4, 0x8, 0x8, 0x1f, 0x1, 0x3, 0x4, 0xd126, 0x7, 0x5, 0x0, 0x0, 0x8, 0x4, 0x1, 0x5, 0xfffffffa, 0x8, 0x270b, 0x5, 0x7fff, 0x5, 0x5, 0x6, 0x3, 0x4, 0x13f, 0x0, 0xc906, 0x6, 0x100, 0x4, 0x3, 0x3, 0x7f, 0x2b, 0x4, 0x3, 0x3, 0x8001, 0x46f, 0x19f1, 0x6, 0x20, 0x2, 0x2, 0x6, 0x5, 0x5, 0x401, 0x5, 0x6, 0x2, 0x7, 0xb, 0x200, 0x6, 0x9, 0x7, 0x3, 0x1, 0x7f, 0x9, 0xc3b, 0xfdf5, 0x0, 0x3, 0x0, 0xf, 0x1, 0x800, 0x4f35, 0x1, 0x18, 0x5, 0x0, 0x6, 0xaa5, 0x800, 0xf, 0x7, 0x800, 0x8, 0xfffffffb, 0xff, 0x5, 0x1000, 0x8, 0x81, 0x6, 0x80, 0x9, 0x8, 0x5, 0x8, 0x8, 0x101, 0x5, 0x10, 0x3, 0x7, 0x82, 0x4, 0x40, 0xabde, 0x1, 0xb, 0x8, 0x5, 0x8, 0x7f, 0x100, 0x8, 0x9, 0x6, 0x80000001, 0x2, 0x8, 0x2, 0x7fff, 0x3, 0x6, 0x4, 0x5, 0x3, 0x0, 0x1, 0x8, 0x59, 0x1, 0x0, 0x48, 0xaa19, 0xc, 0x401, 0x1, 0x401, 0x8, 0xc11, 0x4, 0x0, 0x7, 0x2, 0x7f, 0x0, 0x1, 0xc0000, 0x7, 0x4, 0xef47, 0x3, 0x1, 0x0, 0x2, 0x1, 0x0, 0xe14f, 0x5, 0x7, 0x8, 0x7fffffff, 0x7f, 0xffffffff, 0xffffff88, 0x400, 0x7fffffff, 0x10, 0x5, 0x9, 0x5, 0x0, 0xfe, 0x0, 0x8, 0x3, 0x5, 0xfffffffc, 0x9, 0x11, 0x9, 0xfffffffe, 0x40, 0x3, 0x7, 0x0, 0x1, 0x2, 0x6, 0x81, 0x4, 0x401, 0x6, 0x5, 0x3, 0x0, 0xd, 0x6, 0xc, 0x2, 0x1, 0xfffffe5c, 0x40, 0x0, 0x9, 0x24, 0x1ff, 0x4, 0xe92, 0x5, 0x6e3, 0x4, 0xff, 0xa, 0xdf, 0x5, 0x7, 0x100, 0x3ac9, 0x10001, 0xae27, 0x80, 0x5, 0x7, 0x7fff, 0x0, 0xb, 0x4, 0x1, 0x1, 0x0, 0x9, 0x331d, 0x5, 0xb9, 0x7, 0x4, 0x4, 0x9, 0x6cf3, 0x8, 0x7, 0xf, 0x80, 0x9, 0xffff, 0x8000, 0x1, 0x2, 0x2, 0xdc0, 0x5, 0x100, 0x9, 0x1, 0xfffffff8, 0x800, 0x3, 0x0, 0x9, 0x644d, 0x93, 0xb0, 0x2, 0x3ff, 0x800, 0xfffffff7, 0x2, 0x0, 0xff]}) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9, 0x84, 0x144, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000dc0)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000d40), 0x21800, r4}, 0x38) (async) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, &(0x7f0000000840)=""/121, &(0x7f0000000680), &(0x7f0000000540), 0x6c, r4}, 0x38) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) r5 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x3}, &(0x7f0000000480)="99", 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r6, 0x5760, 0x1e) (async) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r6, 0x100000000000f7) keyctl$revoke(0x3, r5) socket$nl_route(0x10, 0x3, 0x0) close(0x3) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) r7 = io_uring_setup(0x3b44, &(0x7f00000002c0)={0x0, 0x86a1, 0x0, 0x0, 0x20000004}) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) (async) pipe2(0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x1) (async) socket$nl_netfilter(0x10, 0x3, 0xc) 10m30.848537464s ago: executing program 1 (id=1032): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000240)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x200000000180, 0x2000000001b0, 0x2000000001e0], 0x7fffffe, 0x0, &(0x7f0000000180)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108) 10m16.332203837s ago: executing program 32 (id=1032): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000240)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x200000000180, 0x2000000001b0, 0x2000000001e0], 0x7fffffe, 0x0, &(0x7f0000000180)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffc}]}, 0x108) 15.878025382s ago: executing program 3 (id=3039): syz_usb_connect$midi(0x0, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000300000020fd07010040000102030109023c0001011810040904000002010300ee65d2"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) socket$rxrpc(0x21, 0x2, 0x2) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000140)=@multiplanar_userptr={0x0, 0x8, 0x4, 0x0, 0x9, {0x0, 0x2710}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x0, "dd4291c0"}, 0x20000, 0x2, {0x0}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c081, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) listen(0xffffffffffffffff, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x10) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x141000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001880)={'bond_slave_0\x00'}) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000001f000000bca30000000000002403000020feffff620af0fff8ffffff71a4f2ff000000001f03000000000300e5000500000000002604fdffff02000014010000033800001d13f8ff000000007a0af0ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xfffffffffffffd27}, 0x48) syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc548, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xc, 0x0, 0xae, "", [{{0x9, 0x4, 0x0, 0xfb, 0x1, 0x3, 0x1, 0x2, 0x3, {0x9, 0x21, 0x400, 0x0, 0x1, {0x22, 0x438}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x8, 0xd0, 0x3}}, [{{0x9, 0x5, 0x2, 0x3, 0x3f7, 0x4, 0xa, 0x7f}}]}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x300, 0x8, 0x7, 0x7, 0x8}, 0x0, 0x0, 0x6, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x425}}, {0x59, &(0x7f0000000280)=@string={0x59, 0x3, "96804b1657c54b31997d1b93f5373fcaa8970fcf50748e3d972345703eeb4b07c811f1391b9fd6568aa871f3259b7d04312dcf7e386f49e8d2450932a3c18d9e4656bb07b202c9a7ef5a680ffe61d8e2b7e038c89b96ec"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x41f}}, {0x0, 0x0}, {0x4, &(0x7f0000000380)=@lang_id={0x4}}, {0xcc, &(0x7f00000003c0)=@string={0xcc, 0x3, "4dc1fabe8efddd4a5e962ced3bfc652671c49c9f438c01939cd94dc10bf10b54c344992a4b6b7ba951adaf0c114763cc7354b94e62bd3dc910d1a3c96fa0e9234c3a9d6abb11253fc403dfa6c76363e069e6898d8e312c564151d087459df3d1d6698508faf558d5e287cb17268bac7cff0f62c6cf17f83c064f8c5417ac1ad2d2d939a6729d13392448cecef13d2fa57b27e1f8a186011dfd3924572f7c84aca8269e32f4409a3fb33024fb05555554842dc2d1596266dd5c477116c87b6d7714c2065cb0374c558eec"}}]}) 13.990105802s ago: executing program 4 (id=3042): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x802) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prlimit64(0x0, 0xb, &(0x7f0000000180)={0x0, 0xfffffffffffffffd}, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) tkill(r1, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000005580)=""/102392, 0x18ff8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000080)) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x100) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x101) dup(r0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='blkio.bfq.sectors\x00', 0x275a, 0x0) fcntl$lock(r4, 0x25, &(0x7f0000000100)={0x0, 0x2, 0x7, 0x40000001}) fcntl$lock(r4, 0x24, &(0x7f00000000c0)={0x2, 0x2, 0x401, 0x401}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000840), 0x2, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') connect$vsock_stream(r5, 0x0, 0x0) read$FUSE(r5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000300)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x28, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) 12.728694808s ago: executing program 4 (id=3047): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f00020b, 0xc, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7", 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x10, &(0x7f0000000100)=@framed={{}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3268}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xf00}, {}, {0x85, 0x0, 0x0, 0x76}}]}, &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r2, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, &(0x7f0000000000)={0x28, 0x4, r3, r2, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000ae26556f80000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = fsopen(&(0x7f0000000080)='ecryptfs\x00', 0x0) (fail_nth: 2) fsconfig$FSCONFIG_SET_BINARY(r5, 0x6, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = fsmount(r5, 0x0, 0x0) openat$cgroup(r6, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) mount(0x0, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000000)='rpc_pipefs\x00', 0x3000008, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f00000001c0)={0x0, 0x3, 0x0, 0xcf0, 0x9, 0xfffffffe}) mount(0x0, 0x0, &(0x7f0000000000)='devpts\x00', 0x0, 0x0) 10.266778024s ago: executing program 4 (id=3050): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() gettid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000003702000020febfff7a0af0fff8ff00f869a4f0ff00000000b70600001218d1fe2d640500000000002404000000ffffffd404000040000000b7040000100000206a07f0ff0000000085000000a4000000b70000000a00000095000000000000006458c2c62fca868f0399d909a63396c113943219aab9d607000000cb3924b611f5969f62c28b22edf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa8a23f1740637c48468766af54043000000ec44631ac2622cdcae18c3d14bfbe96dd87235b44174f7c034318508f49f09781dc7a2cfbb9a0f119e31975f551557f05dc2dc2739e2e735d0ab961dac07f4f6d8aa1c3f16765d427c0e01000000fe4c16737d50d2a4bfc463450d524eacf2b734b0289c7a3a16eeca71296746681d61af491e4fa734318e0d72b8dbbc2b2b869af2f87903000000b6ecc7de09a2257e908cd92e664fa7aba7f07474863333c460e34caf0806a7e2575a56fba3eadd8efbd5dae6c024585d972b1bf8c4e872bba38160be9e92b6ddb90fc51b894917b50876b5708e64e70f7d8225da90ce9bc019084873ed07c0c59c4ba053fe77e0d37ccc3318da2e9fefaf025527e734ed1de5d12b4c56ca3b03dc121086061d1f26821a428d28eefa22ead6a3dab9388da53263b81ebe6be197a48a63440000a356240c4e2df57457000100000000000000000000008d2516510b29804b3cc034c19cef0d773f01064709edd63a185cbab8456c25283b9514b220fe401503ff536478088eb9fd932a0703a7bf9ea40429b2d49177824f210a69f8e5227fd32e7d5a2c7ecf57ac64509224090000000000000096e5a55d2c805bf725b9d14756c8cfa292aae0872866cf9fe063317741a0db9081d4393a7f9bcc0917d60a11b4a9ece831660ce625de441cef915eba31255d163f7033045ceb97f8ea006efc5b84f75ca1fb74c9faef444eb12f46b435de87feb2f7f2d7fb659395e4b38178b5c67e6ac100000000000000001b2e77bd5de136fa1bec1a26c622bb9662d9ee70147acc5605aa2318855cb8b918000000c5f265dcb5dce05f94ea051c4e8dcdf37d01ad7aff64f84ce32b841c799f47c2949725285fc50f1dd3f5e264023082eec752704c1f598151aa7d29e0d79522df196278acf327a74777d1f658f50c27020198770ff8ebef9df1b750d56d4d195ad7a267c46b3348b0e03ed33b5bca13cafc304dc6da78d20f029742d8d2f36acfdd331081ca00c1d5c8b7bed2ef603d6e7f1764246aab2d7d531559a971939a038055ac28625ec837f824ff537cd67993a3589be73a18680da50287b9e962b1a0235c290346a21ca5de55c49c78e411c791617000ef8df75411a5d300000000000000e0ffffff004deb8d49806823655735bd6deb49edb2e42f4ed9e6e9080366660b847bf03c144f6796920726dcf29e9a6c808459e82cbb0000000000000000000000000000000000006b5530865aaa7aa6171f66f2bca881a4201588427bb65ed3d5e7a74e9b5ece44067d4a9875a310bc7ec42b844b9eb3c9083560ef5c92b8a01188d615efbf70893d2eaf76517e990021fa5020a71023bca1194ad87cade480ba3dce8f57294e31ca24a8d181210bb6d18ff2c58293c2e314a7447ed3a1c870908aa8e3b33e6a94c7381bce9fa71dcbb758451f247e38d80d66e03d7564a5cddfaf06574b05cefb2670f30c2d501ee625ce3ffc08f15b53d28ce552c1807bc6866f06098a0e5517068aa48f2a82496fe83ee85218fe7f52b48742c7055f2a144c13e9c54be60b0a4f979ef7eb216897875946dc6ca1571930b1cf7c93de103f5289f782ae538e02612c717a76c787a873936eb8dcf1bfe581cc8ef965a0424bc140939e3274e251e519d188f6af680402c49458065dccfcb4f0d4f2ec9cf6fb3cf0a1807e34fb8d0108007734c1d2bc6a9d32d2560a88bad976b6000100002b712e632eeca810fb73fc8aaef94acf8bde18b9149cadc688254eabbe91f943592ccf68e717bcc6852828bd621e3a9dcb1cc6f1a6d1915200d95087838c2dc0a002c3aa554f725b965714144652cdc14761b0236f1a05b7f50f4149057e63d713103b5a6c2919161efc165a2e6981d76d29c95ad9f180135fb8962f59495fd33be3a6d35274941790bc1bd9da5e9c67c39de2c9f6fe35b8f528edbd8ea2a77dccdc3fe247feb121d9440a3ea9012a9d23a7e3110b0f25c5f8bf803d688de4d92b5dfdbd69fb8b426b55c10ba01b5f18b10cce8de3369300000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff8d}, 0x48) 8.894345888s ago: executing program 4 (id=3053): r0 = socket$inet_tcp(0x2, 0x1, 0x0) mount(0x0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='sysfs\x00', 0x200013, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='htcp', 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000001f40)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4c8, 0x12d0, 0x1368, 0x1b8, 0x0, 0x1b8, 0x1460, 0x1460, 0x1460, 0x1460, 0x1460, 0x6, &(0x7f0000000380), {[{{@ip={@remote, @loopback, 0x0, 0xffffffff, 'macvtap0\x00', 'erspan0\x00', {0xff}, {}, 0x5e, 0x2, 0x1}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@devgroup={{0x38}, {0x1, 0x1, 0x8a, 0x387, 0xfffeffff}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0xe1}}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0x6a, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x2, 0x1, 0x2}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0x47}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, 0xff, 0xff0000ff, 'bond_slave_1\x00', 'macvlan1\x00', {0xff}, {0xff}, 0x16, 0x6, 0x22}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@empty, @loopback, 0x0, 0xffffff00, 'ip6erspan0\x00', 'lo\x00', {0xff}, {}, 0x5c, 0x1, 0x11}, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xa}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x1, 0x1, 0x0, 0x3, 0x7, 0x1], 0x2, 0x5}, {0x3, [0x7, 0x3, 0x2, 0x4, 0x1, 0xa], 0x5, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x528) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xc, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000050000000000000080000000850000007b0000001801000020646c2500000000002020207b1af8ff00000000bfa101000100000007010000f8ffffffb702000008000000b70300000600000085000000060000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x51}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5416, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001e80)={0x11, 0x3f, 0x0, &(0x7f0000000080)='GPL\x00', 0x6, 0x1000, &(0x7f0000000cc0)=""/4096, 0x40f00, 0x5, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x0, 0x3, 0x4, 0x80c}, 0x10}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)=ANY=[@ANYRES8], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x10, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xa}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x28}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$inet(0x2, 0x802, 0x1) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000000)=0x7ffff, 0x4) connect$inet(r5, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) write(r5, &(0x7f0000000080)="08008edf773c80", 0x7) recvmmsg(r5, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}], 0x1, 0x22, 0x0) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) 8.885529996s ago: executing program 3 (id=3054): r0 = socket$can_j1939(0x1d, 0x2, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61158800000000006113500000000000bfa000130000000007000000ee0016055e15010000000000160500000000000069163e0000000000bf07000000000000260507000fff07206706000020000000150600000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ace0600006e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc0da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000815266b2c9e1bfadc7498e9dda5d000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23480b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2334ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7149ea979cab2ee65cf7ffa29152b7a8fed89575e6e6fd77d4d9463d21775abac886ee6a1f2d7d8523840438a73d6307a87e2f525867fc3af7ab74520a773ae26bae74cdd405a211e8833e1ba523cde51d04a7ca6732"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4040850) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000280)=ANY=[], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) recvfrom(r0, 0x0, 0x0, 0x40000020, &(0x7f0000000240)=@ax25={{0x3, @null, 0x8}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @null]}, 0x80) syz_usb_connect$sierra_net(0x5, 0x0, 0x0, 0x0) 8.295309965s ago: executing program 0 (id=3056): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0x20000000}, {0x66, 0x0, 0x0, 0x2000000}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfff8, 0xa00}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3, 0x1, 0x0, 0x1f}, {}, {}, {0x15}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.946046806s ago: executing program 0 (id=3057): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) socket(0x2a, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xffffeffffffffffe) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000003c0)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) getrlimit(0x2, &(0x7f0000000200)) syz_genetlink_get_family_id$nl80211(&(0x7f0000001ec0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001f00)={'wlan1\x00'}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000300)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'netdevsim0\x00'}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014) recvmmsg(r3, &(0x7f0000000e00)=[{{&(0x7f0000000440)=@pppoe={0x18, 0x0, {0x0, @multicast}}, 0x80, 0x0}, 0x800}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000980)=""/255, 0xff}, {0x0}, {&(0x7f00000005c0)=""/18, 0x12}], 0x3, &(0x7f0000000ac0)=""/34, 0x22}, 0xb}, {{0x0, 0x0, 0x0}, 0x3}], 0x3, 0x162, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000006cd59db929c4b5ddcd3685fbd4adfb7ca222fe1ddcc06e9f3082fee59793c72d5f6c3779f47f6e12a871fd22e649d0f45b54fc894ab58aee4973bf842d891bf01b9b4858132d255f17beb3e9b59a", @ANYRES16=0x0, @ANYBLOB="200029bd7000fcffffff140000000500190001000000"], 0x1c}}, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f00000011c0)={0x0, 0x0, 0x0}, 0x44800) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000"], 0x50}}, 0x4000850) socket(0x2a, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) 7.496526303s ago: executing program 0 (id=3058): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="14000200811500"/20], 0x14}, 0x1, 0x0, 0x0, 0x20040001}, 0x4004004) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000022"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) readv(r1, &(0x7f0000000680)=[{0x0, 0xa}, {&(0x7f00000005c0)=""/43, 0x2b}], 0x2) sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@getneigh={0x14, 0x1e, 0x8, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4040801}, 0x4801) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000003880)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-ssse3\x00'}, 0x58) openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x1, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), r2) sendmsg$IEEE802154_SCAN_REQ(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x24, r4, 0x48334cf00147764d, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_CHANNELS={0x8, 0x14, 0xf}, @IEEE802154_ATTR_SCAN_TYPE={0x5, 0x13, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4044880}, 0x20000000) socket$inet_tcp(0x2, 0x1, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x406f413, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102384, 0x18ff0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$NFC_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0x1c}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x43, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x4, 0x0, @mcast2}}, 0x5c) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) 5.611294458s ago: executing program 4 (id=3060): syz_io_uring_setup(0x835, &(0x7f00000000c0)={0x0, 0x679b, 0x8, 0x2000006, 0x3cf}, &(0x7f0000000040)=0x0, &(0x7f0000000140)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket(0x10, 0x2, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r2, 0x118, 0x0, &(0x7f00000009c0)=0xd, 0x4) sendfile(r1, r1, 0x0, 0x8) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r5 = fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$kcm(0x21, 0x2, 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r7, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={0x34, r8, 0x400, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x80}, @ETHTOOL_A_BITSET_NOMASK={0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) epoll_create1(0x0) 5.282841027s ago: executing program 3 (id=3062): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = fcntl$dupfd(r0, 0x0, r0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x5, 0x1ff003, 0x81, 0x86f, 0x1}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x61, 0x8e}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB, @ANYRESDEC=0x0]) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r5, 0x5761, &(0x7f0000000540)=ANY=[@ANYBLOB="050000000000"]) read$FUSE(0xffffffffffffffff, &(0x7f0000008140)={0x2020}, 0x2020) clock_gettime(0x0, &(0x7f0000000240)) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd23, 0x25dfdbf8, {0x0, 0x0, 0x0, 0x0, 0x35a38, 0x4522f}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @erspan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @empty}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20040044) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) socket(0x10, 0x2, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000c80)='fdinfo/3\x00') read$FUSE(r7, &(0x7f00000040c0)={0x2020}, 0x2020) ioctl$TCFLSH(r1, 0x400455c8, 0x2) 5.272625959s ago: executing program 2 (id=3063): r0 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x800, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x800) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000000)={0x9, 0xfffffffe}, 0x10) write(r6, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r5, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) io_uring_enter(r1, 0x627, 0x4c1, 0x43, 0x0, 0x30) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000019340), 0x0, 0x0) read$msr(r7, &(0x7f0000000300)=""/102400, 0x19000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setuid(0x0) ioctl$CEC_TRANSMIT(r0, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffff7, 0xffffffffffffffff, 0x2, 0x9, 0x4, 0x7fff, "16b0bc450cfc47961ed5d8167d4f7865", 0x1, 0x52, 0x1, 0x4b, 0x9, 0x9, 0xd}) r8 = getpid() sched_setscheduler(r8, 0x3, &(0x7f0000000000)=0xfffffffe) r9 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r9, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 4.309351003s ago: executing program 0 (id=3064): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_xfrm(0x10, 0x3, 0x6) close(0x4) syz_io_uring_setup(0x110, 0x0, &(0x7f0000000100), 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x6101}) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000200)=0x40) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f00000000c0)=0x58, 0x5) syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r4, 0x4) socket$nl_route(0x10, 0x3, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000b86000/0x4000)=nil, &(0x7f0000813000/0x1000)=nil, 0x4000, 0x0, 0x2}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r5 = socket$inet(0x2, 0x3, 0x5) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) connect$inet(r5, &(0x7f0000000340)={0x2, 0x0, @multicast1}, 0x10) write$binfmt_elf64(r5, 0x0, 0x40) 4.198825594s ago: executing program 5 (id=3065): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@ipv6_newrule={0x38, 0x20, 0x1, 0x70bd2d, 0x25dfdbfc, {0xa, 0x0, 0x80, 0x0, 0x9, 0x0, 0x0, 0x5, 0x2801e}, [@FRA_SRC={0x14, 0x2, @private2}, @FIB_RULE_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e22, 0x4e22}}]}, 0x38}}, 0x480d0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000a00)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c00028014000300200100000000faffffffffffffff000114000200fc02"], 0x5c}, 0x1, 0x0, 0x0, 0x50}, 0x0) 4.150472831s ago: executing program 5 (id=3066): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) socket(0x2a, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xffffeffffffffffe) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000003c0)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) getrlimit(0x2, &(0x7f0000000200)) syz_genetlink_get_family_id$nl80211(&(0x7f0000001ec0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001f00)={'wlan1\x00'}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000300)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'netdevsim0\x00'}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014) recvmmsg(r3, &(0x7f0000000e00)=[{{&(0x7f0000000440)=@pppoe={0x18, 0x0, {0x0, @multicast}}, 0x80, 0x0}, 0x800}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000980)=""/255, 0xff}, {0x0}, {&(0x7f00000005c0)=""/18, 0x12}], 0x3, &(0x7f0000000ac0)=""/34, 0x22}, 0xb}, {{0x0, 0x0, 0x0}, 0x3}], 0x3, 0x162, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000006cd59db929c4b5ddcd3685fbd4adfb7ca222fe1ddcc06e9f3082fee59793c72d5f6c3779f47f6e12a871fd22e649d0f45b54fc894ab58aee4973bf842d891bf01b9b4858132d255f17beb3e9b59a", @ANYRES16=0x0, @ANYBLOB="200029bd7000fcffffff140000000500190001000000"], 0x1c}}, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f00000011c0)={0x0, 0x0, 0x0}, 0x44800) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000"], 0x50}}, 0x4000850) 4.075093531s ago: executing program 3 (id=3067): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x802) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prlimit64(0x0, 0xb, &(0x7f0000000180)={0x0, 0xfffffffffffffffd}, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r1 = gettid() tkill(r1, 0x12) tkill(r1, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}}, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000005580)=""/102392, 0x18ff8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000080)) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x100) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x101) dup(r0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='blkio.bfq.sectors\x00', 0x275a, 0x0) fcntl$lock(r4, 0x25, &(0x7f0000000100)={0x0, 0x2, 0x7, 0x40000001}) fcntl$lock(r4, 0x24, &(0x7f00000000c0)={0x2, 0x2, 0x401, 0x401}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000840), 0x2, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') connect$vsock_stream(r5, &(0x7f0000000240)={0x28, 0x0, 0x2710, @my=0x0}, 0x10) read$FUSE(r5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) 3.304683589s ago: executing program 5 (id=3068): syz_io_uring_setup(0x835, &(0x7f00000000c0)={0x0, 0x679b, 0x8, 0x2000006, 0x3cf}, &(0x7f0000000040)=0x0, &(0x7f0000000140)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket(0x10, 0x2, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r2, 0x118, 0x0, &(0x7f00000009c0)=0xd, 0x4) sendfile(r1, r1, 0x0, 0x8) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r5 = fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$kcm(0x21, 0x2, 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r7, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={0x34, r8, 0x400, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x80}, @ETHTOOL_A_BITSET_NOMASK={0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) epoll_create1(0x0) 3.300335027s ago: executing program 2 (id=3069): openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000080)='auxv\x00') fcntl$setstatus(r1, 0x4, 0x2400) 3.171054163s ago: executing program 4 (id=3070): r0 = socket$inet_tcp(0x2, 0x1, 0x0) mount(0x0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='sysfs\x00', 0x200013, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='htcp', 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000001f40)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4c8, 0x12d0, 0x1368, 0x1b8, 0x0, 0x1b8, 0x1460, 0x1460, 0x1460, 0x1460, 0x1460, 0x6, &(0x7f0000000380), {[{{@ip={@remote, @loopback, 0x0, 0xffffffff, 'macvtap0\x00', 'erspan0\x00', {0xff}, {}, 0x5e, 0x2, 0x1}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@devgroup={{0x38}, {0x1, 0x1, 0x8a, 0x387, 0xfffeffff}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0xe1}}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x5}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0x6a, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x2, 0x1, 0x2}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0x47}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, 0xff, 0xff0000ff, 'bond_slave_1\x00', 'macvlan1\x00', {0xff}, {0xff}, 0x16, 0x6, 0x22}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@empty, @loopback, 0x0, 0xffffff00, 'ip6erspan0\x00', 'lo\x00', {0xff}, {}, 0x5c, 0x1, 0x11}, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xa}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x1, 0x1, 0x0, 0x3, 0x7, 0x1], 0x2, 0x5}, {0x3, [0x7, 0x3, 0x2, 0x4, 0x1, 0xa], 0x5, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x528) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xc, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000050000000000000080000000850000007b0000001801000020646c2500000000002020207b1af8ff00000000bfa101000100000007010000f8ffffffb702000008000000b70300000600000085000000060000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x51}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5416, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e2e"], 0x0, 0x35, 0x0, 0x1}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001e80)={0x11, 0x3f, 0x0, &(0x7f0000000080)='GPL\x00', 0x6, 0x1000, &(0x7f0000000cc0)=""/4096, 0x40f00, 0x5, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x0, 0x3, 0x4, 0x80c}, 0x10}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)=ANY=[@ANYRES8], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x10, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xa}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x28}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$inet(0x2, 0x802, 0x1) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000000)=0x7ffff, 0x4) connect$inet(r5, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) write(r5, &(0x7f0000000080)="08008edf773c80", 0x7) recvmmsg(r5, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}], 0x1, 0x22, 0x0) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) 3.071020896s ago: executing program 2 (id=3071): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000280)={r0, &(0x7f0000000240)}, 0x20) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r2 = syz_io_uring_setup(0x292, &(0x7f0000000140)={0x0, 0xf7b7, 0x808, 0x1, 0x289}, &(0x7f00000001c0)=0x0, &(0x7f0000000580)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x18, 0x0, 0x0, 0x4, &(0x7f0000000280)={0x0, 0x989680}, 0x1, 0x4}) io_uring_enter(r2, 0x6e2, 0x3901, 0x1, 0x0, 0xe2c) r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r5, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x6, 0x81, 0x42}, 0x10) listen(r5, 0x2) accept4(r5, 0x0, 0x0, 0x80000) 2.728072825s ago: executing program 3 (id=3072): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000280)={r0, &(0x7f0000000240)}, 0x20) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r2 = syz_io_uring_setup(0x292, &(0x7f0000000140)={0x0, 0xf7b7, 0x808, 0x1, 0x289}, &(0x7f00000001c0)=0x0, &(0x7f0000000580)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x18, 0x0, 0x0, 0x4, &(0x7f0000000280)={0x0, 0x989680}, 0x1, 0x4}) io_uring_enter(r2, 0x6e2, 0x3901, 0x1, 0x0, 0xe2c) r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r5, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x6, 0x81, 0x42}, 0x10) listen(r5, 0x2) accept4(r5, 0x0, 0x0, 0x80000) 2.617848057s ago: executing program 3 (id=3073): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$sndseq(0xffffff9c, 0x0, 0x400) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000400)={0x4, 0x4, 0x1, 'queue0\x00', 0x2}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) unlink(0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="18000000e7000000000000000900000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000f0000065090100000000006600000020207025180100002020702500000000002020207b9a00fe000000005e9100000000000037010000f8ffffffb702000008000000b7030000ffffffff56000000060000002c93000000000000b5030000000000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) 2.220793622s ago: executing program 5 (id=3074): syz_io_uring_setup(0x835, &(0x7f00000000c0)={0x0, 0x679b, 0x8, 0x2000006, 0x3cf}, &(0x7f0000000040)=0x0, &(0x7f0000000140)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket(0x10, 0x2, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r2, 0x118, 0x0, &(0x7f00000009c0)=0xd, 0x4) sendfile(r1, r1, 0x0, 0x8) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r5 = fsopen(&(0x7f0000000180)='gfs2meta\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$kcm(0x21, 0x2, 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r7, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={0x34, r8, 0x400, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x80}, @ETHTOOL_A_BITSET_NOMASK={0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) epoll_create1(0x0) 1.684983121s ago: executing program 2 (id=3075): mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000018000000e5000300000000000600000000000000250000001000000006000000faffffff95"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) mount$overlay(0x0, 0x0, &(0x7f0000000000), 0x80, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1/file0'}}, {@xino_auto}]}) 1.506137457s ago: executing program 2 (id=3076): socket$netlink(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtaction={0x1458, 0x30, 0xffffffffffffffff, 0x70bd2b, 0x0, {}, [{0x5c, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x9}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x4}, {0xc}, {0xc}}}]}, {0x13e8, 0x1, [@m_police={0x11e8, 0xf, 0x0, 0x0, {{0xb}, {0x1108, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x3}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x4, 0xc5, 0x6, 0x7, 0x3, 0x200, 0x40, 0x9, 0x5ccf, 0x6, 0x401, 0x6, 0x6, 0x7, 0x3d, 0x4a, 0x5, 0x5, 0x0, 0x10001, 0x3, 0xffffffff, 0x2, 0x48000000, 0x3, 0x3, 0xfffffffb, 0xd, 0x8, 0x49d9, 0x4, 0x4c80000, 0xffffffff, 0x0, 0x3, 0x3, 0x4, 0x100, 0x401, 0x0, 0x28c, 0x80, 0x9, 0x7e5c, 0x7, 0xffff, 0x10000000, 0x1, 0x8, 0x5, 0x6, 0x0, 0x66, 0xffff, 0x0, 0x10, 0x9, 0x0, 0x3, 0x5, 0x80000001, 0x4, 0x4, 0x2, 0x5, 0x9, 0x7, 0x80000001, 0x1, 0x2, 0x4, 0x80, 0x7966, 0x3, 0x100, 0x7, 0xd0400000, 0x68, 0x0, 0xd, 0x2, 0x4, 0x7, 0xfff, 0x8, 0x2, 0x9, 0x4, 0x3, 0x4, 0x3, 0x2, 0x4, 0xfffffffb, 0x5, 0x9, 0x6, 0x8, 0x2, 0xfffffc00, 0xffffffff, 0x10001, 0xe9e4, 0x0, 0xa, 0x5, 0x1, 0x8, 0x80000000, 0xa1, 0x8000, 0x649d, 0xa, 0x139a5f57, 0x0, 0x7, 0x9, 0xa7, 0x7, 0x3, 0x8, 0x71c, 0xffffffff, 0x56, 0x8, 0x5, 0x6, 0xd, 0x7, 0xffffffff, 0x3, 0x5, 0x5, 0xb7bcb6f, 0x7, 0x2, 0x2, 0x1, 0x8cf, 0x6, 0x3, 0x4, 0x3, 0x101, 0x6, 0x200, 0x1, 0x0, 0x29, 0x729a, 0x90cc, 0x3ff, 0x2, 0x4, 0x9, 0x9, 0x69d, 0x6, 0x10001, 0xc0, 0x4, 0x3, 0x1, 0x7, 0x2, 0xfffffffc, 0x1, 0x25, 0x3, 0x0, 0xffff, 0x2, 0x7, 0x3, 0x1, 0x1000, 0x1, 0x7fffffff, 0xfffff800, 0x7f, 0x8, 0x3, 0xffff, 0x67, 0x6, 0x1, 0x2835, 0xff, 0xc8, 0x2, 0x5, 0x2, 0x2ea7, 0x9, 0x6, 0x8, 0x4, 0xf, 0x9, 0x4, 0xff, 0x0, 0x80000001, 0xfffffff3, 0x2, 0x5, 0x9, 0x40, 0x1bc, 0x2, 0xd, 0x7, 0x0, 0x3, 0x8, 0x3, 0xd9b2, 0x5, 0xfffffff7, 0x9, 0x0, 0x10, 0xf, 0x7, 0x5, 0x55fb, 0xfffff801, 0x0, 0xed, 0x7ff, 0x2, 0x9, 0x4, 0x9, 0x2, 0x0, 0x9, 0x77, 0x3, 0x5, 0x9, 0x4, 0x5, 0x2, 0x8, 0x8, 0xfffffffd, 0x1, 0x1000c, 0x0, 0xff2, 0x5, 0xe, 0x6, 0x6, 0x7fff]}, @TCA_POLICE_RATE={0x404, 0x2, [0x7f, 0x14000, 0x80000000, 0x6, 0x0, 0x2, 0x101, 0x3c000, 0x8, 0x773, 0xa, 0xfffffffd, 0x37c, 0x4, 0xfffffff9, 0x3, 0x1, 0xa, 0x0, 0x6, 0x23f, 0x6, 0x7, 0x1ad0000, 0x0, 0x8, 0x8, 0x9, 0x1, 0xffff, 0xfc7f, 0xc1c, 0x7, 0x7f, 0x4, 0x4, 0x74b5a7e3, 0x9, 0x7, 0xe9, 0x9, 0x6, 0x0, 0x7ff, 0x5, 0x5, 0x7ff, 0x3, 0x5, 0x0, 0x5, 0xffffffff, 0xfffffff6, 0xffff, 0x101, 0xdf01, 0x8000, 0xfffffff8, 0x2, 0x1, 0x7, 0xfffffff9, 0x573, 0x0, 0xad19, 0x2f, 0x7, 0x8001, 0x4, 0x10001, 0x288, 0x7, 0xf, 0x3ff, 0xa3c, 0x8a6, 0x8, 0x2, 0xdf16, 0x8ddf, 0x7, 0xb, 0x1, 0x1, 0x0, 0x2, 0x4, 0xb16d, 0x7, 0x6, 0x5bbb5f41, 0x2ef0, 0x200, 0x1, 0x10001, 0x1, 0x1cadf88b, 0x3, 0x5, 0x30f, 0x5, 0x1, 0x7, 0xb4d9, 0x5, 0x0, 0x5e9, 0x7b3, 0xc630, 0x7, 0x4, 0x8ee9, 0x10001, 0xfffffff9, 0x19f40, 0x8, 0x3, 0x7, 0x5, 0x3, 0x2, 0x7, 0x7f, 0x3, 0x2, 0x5927, 0x2dfb, 0x8, 0xac5, 0x401, 0x81, 0x33, 0x6, 0x1ff, 0xfffffff7, 0x0, 0xe60, 0x0, 0x4, 0xffff7254, 0x3, 0x1, 0x6, 0x6f, 0x6, 0x1, 0x5, 0xfaf, 0x100, 0x200, 0x9, 0x3, 0x2, 0x7869, 0x8, 0x4, 0x9, 0x100, 0x8001, 0x3, 0x6, 0x3, 0x3, 0x5, 0x4, 0x5, 0x80, 0x10001, 0x0, 0x40, 0x1, 0x4, 0xfffffc01, 0xf0000000, 0xfff, 0x2, 0xf8, 0x7, 0xf, 0x80, 0x8, 0x0, 0x3, 0x3, 0xffff, 0x5a, 0x5, 0x40, 0x2, 0xffff, 0x400, 0xd, 0x6b2, 0x80, 0x7ff, 0x5, 0xe272, 0x25f, 0xb4, 0x9, 0x9, 0x40, 0x7, 0xff, 0x19, 0x6, 0x5, 0x4, 0x0, 0x101, 0x2, 0x7, 0x400, 0x104, 0x85, 0x5, 0xffffffff, 0xd, 0xf6, 0x9, 0x2, 0x1, 0x4, 0x9, 0x3, 0x0, 0x7, 0x85, 0x4e, 0x7f, 0x9, 0x9, 0xffffff47, 0xfffffff8, 0xfffff007, 0x5, 0x7f, 0x214e5781, 0x1b, 0x80000000, 0x7fffffff, 0x7, 0x3, 0x0, 0x0, 0x2, 0x8, 0x9, 0x5, 0x9, 0x2, 0x354f, 0x3, 0x1000, 0x1, 0x9]}, @TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x200, 0xbe7, 0x3, 0x4, 0x8, 0x2, 0x6c, 0x0, 0x8, 0x2, 0x1, 0x8, 0x9156, 0x7ff, 0x0, 0x7, 0x8, 0x1e, 0x7fff, 0x1, 0x2, 0x3, 0x4, 0x6, 0xb, 0x9, 0x200, 0x3ff, 0x7ff, 0x400, 0x3, 0x3ff, 0x4, 0x3, 0x1000, 0x0, 0x9, 0x8001, 0xfffffffc, 0x4, 0xdaa, 0x8, 0x401, 0x7, 0xde0, 0x8, 0x0, 0xce2, 0xd5f, 0x8000, 0x9, 0x5, 0xbf35, 0x35c8, 0x8, 0x4, 0x3, 0x40, 0x5, 0x4b6, 0x8, 0x899, 0x631d, 0x80000000, 0x0, 0x800, 0x0, 0xb6, 0x6, 0x7, 0x3, 0xffff, 0x4, 0xfff, 0x40, 0x1, 0x2, 0xfffffffc, 0x5, 0x5, 0x2, 0x0, 0x5, 0x7, 0x5, 0x3, 0x7fffffff, 0xbf20, 0x4, 0xffffff5d, 0xa49, 0xc1, 0xdfa, 0xd15a85a, 0x40, 0xfffffff8, 0xa, 0x40, 0xf90c, 0x8001, 0x3, 0x9, 0x3b67, 0x2663, 0xffffffe8, 0x8001, 0x8001, 0x6, 0x8, 0x1, 0x7, 0x101, 0xc8, 0x401, 0x9, 0x6, 0x28, 0x6, 0x100, 0x9, 0x4, 0x4, 0x5, 0x4, 0x4, 0x1, 0x4, 0x0, 0xb, 0x4, 0x6, 0x0, 0x0, 0x6, 0x1, 0xc54, 0x6, 0xfffffffa, 0x9fb, 0x5, 0x8, 0x7, 0xdf, 0x7, 0x5, 0x8, 0x9, 0x9, 0x6, 0x8, 0x2, 0x6, 0x1, 0xfffff800, 0x4, 0x0, 0x9, 0x3, 0xb, 0x9, 0x0, 0x3ff, 0x40, 0x8, 0x4b8d, 0x4, 0xd2, 0x1ff, 0x3, 0x4000005, 0x6, 0x6, 0x4, 0x1, 0xb2, 0x5, 0x0, 0x8, 0x4000000, 0x3, 0x5, 0x9, 0x3, 0xffffffe6, 0x800, 0x0, 0x1000, 0x8000, 0x5, 0x3, 0xb, 0x80000000, 0xfe, 0x9, 0x4e1, 0x5, 0x60, 0x6, 0x61a9, 0x12, 0x7, 0x3, 0x2, 0x7502, 0x5, 0x4, 0x9, 0x3, 0x2, 0x3, 0x2, 0x8455, 0xfffffffb, 0x2, 0x6, 0x4, 0x5, 0x2, 0x0, 0x1, 0x0, 0x9, 0x952, 0x0, 0xd, 0x6, 0x8, 0x4, 0x6, 0xeb56, 0x5, 0x4, 0x200, 0x69, 0xd, 0x2, 0xffff, 0x3, 0x9, 0x4, 0x7fffffff, 0x8, 0x4, 0x0, 0x8000, 0x6d2, 0x4, 0x4, 0x9, 0x7fffffff, 0x9, 0x2, 0x8, 0x5, 0x101]}], [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x72}], [@TCA_POLICE_RESULT={0x8, 0x5, 0x7}], [@TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}], [@TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x10000000, 0x13e, 0xb, 0xfffffffb, {0xfb, 0x1, 0x6, 0x1, 0x1ff, 0x80000001}, {0x4, 0x2, 0x401, 0x1004, 0x4, 0x3}, 0xfffffff8, 0x6, 0x80000000}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x2}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x8001}], [@TCA_POLICE_RESULT={0x8, 0x5, 0x97d9}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x3}, @TCA_POLICE_RATE={0x404, 0x2, [0xfe4, 0x4, 0x6, 0x4a, 0x7, 0x0, 0x7ff, 0x4, 0x9, 0x3, 0x4, 0xe2a, 0x9, 0x2, 0xfffffff9, 0x7, 0xffffffff, 0x9, 0x7, 0x8, 0xe, 0xff, 0x8, 0x10, 0x3, 0x6, 0x4, 0x8, 0x5, 0x4, 0x4, 0x6, 0x6e, 0x1, 0x80000000, 0x5, 0x4, 0x6, 0xc3, 0xfffffff8, 0x7, 0x1, 0x6551, 0x80000001, 0x3, 0x1, 0x80000001, 0x9, 0x4, 0x1, 0x7, 0x3, 0x6, 0x5, 0x800, 0x0, 0x6bd, 0xeca, 0x9, 0x100, 0x8, 0x1, 0x2, 0xfd, 0x8, 0x8, 0x3, 0x1, 0x6, 0xfa20, 0x5, 0x82, 0xffff7f0b, 0x101, 0x4, 0x8b6, 0x7, 0x9e4, 0x4, 0x7, 0xc36, 0xffff, 0xd7, 0x8, 0x8, 0x13d42, 0x40005, 0x0, 0x1000, 0xfffff867, 0x5, 0x6, 0x3, 0xfffffff7, 0x100, 0x4, 0x4, 0x68, 0x0, 0x1, 0xe84, 0x2b7, 0x5ed, 0xffffffff, 0x0, 0x10, 0x4fb, 0xfa, 0xf, 0x8, 0x5, 0x7, 0x1, 0xec9, 0x9, 0x8, 0x6, 0x5, 0x9, 0x2, 0x6, 0x7, 0x5, 0x4, 0xe, 0x5, 0x6, 0xfffffffd, 0x400, 0x1, 0x2, 0x2, 0x0, 0x0, 0x1, 0xffffffff, 0x0, 0x55, 0x6, 0x7fff, 0xe99, 0x3, 0x97, 0x4, 0x3, 0x101, 0x9, 0x7a8e, 0xfffffffb, 0x7, 0x9350, 0x2, 0x7f, 0x80000000, 0xb22, 0x0, 0x2, 0x1e6, 0x0, 0x5, 0x8, 0x5, 0x44, 0xfffffd33, 0x5, 0x8, 0x3, 0x5, 0x6, 0x7, 0x4, 0xfffffffd, 0x9, 0x9, 0x6, 0x5, 0xd4ff128, 0x7ff, 0x3, 0x3ff, 0x193, 0x19, 0xffffff81, 0x3, 0x3, 0x8, 0xf0a, 0x6, 0x7, 0xd93c, 0x0, 0x2, 0xd3e00000, 0x6, 0x7b, 0x8001, 0x5, 0x7, 0x3795, 0x59, 0x2b, 0x3, 0x40, 0x6, 0x2, 0x7dd, 0x3, 0x8, 0x0, 0x5, 0x5, 0x800, 0x19ffeaca, 0xf, 0x200, 0xd, 0x1ff, 0x5, 0x3, 0x9, 0x4, 0x9, 0x9, 0x0, 0xe5a1, 0xba, 0x5, 0x5, 0x7fc, 0x5, 0x40, 0x28, 0x0, 0x2, 0x200040, 0x7, 0x5, 0x6, 0x3, 0x5, 0x100000, 0x10000, 0x800, 0x8001, 0x3, 0x62, 0x46, 0x4, 0xdb, 0x7fffffff, 0x3, 0x1, 0x8, 0x5, 0x9, 0x8001]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x7, 0xad5, 0x6, 0x7, {0x3, 0x0, 0x800, 0x0, 0xfff3, 0xfffffffb}, {0x40, 0x2, 0xff, 0x5, 0xff, 0xf}, 0x1, 0x39, 0x6}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x9}]]}, {0xb7, 0x6, "95920cf6536598950ad566c97408bc85f3747471ff0915a143c45f7e14af8bc80d476ec1f6a81ad3e1e1736950482ce8d21f60b4e3bd0a53e6c2a9673f20d4db34413338ec18ba9643799c8f7519095e047192ec615f554dbe4d8aa2c933813f05b7a96d2d1a0fabe53fd3ac991312724597e5dc5c14b51f8da27ffc1b867f4252889d9a3673c615608dbb43f0981f9923e9979e5e2558548df31dc25e13ee59d0adc2b546e8764f2b76a0a5e61001af996549"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_sample={0xfc, 0x1d, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x2000}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x4, 0x2, 0x0, 0x6}}]}, {0xaf, 0x6, "bf8c9ca36e139cf5535d9710eec9414e5d13ad22ce40e33c18e55f16b966704be7a402f9f3c31f3991c837be17c2294e365edf66dd785dc9eebaa5e23a81e250026b45255569ef10d6247590584b1a31e72b236185fe488bfe0eab7fe44054c9a1918d9eace5857ce27b846edabb6d342a07abad33e399c2f9cc0904e966a0f97bd924f6b31bce325871144b3a5151e12ddd155c411df0faec091f6419e7ad78035252b541c32b6c84cfc2"}, {0xc, 0x7, {0x0, 0xf928536b8cb9746e}}, {0xc, 0x8, {0x3}}}}, @m_skbmod={0x100, 0x9, 0x0, 0x0, {{0xb}, {0x30, 0x2, 0x0, 0x1, [@TCA_SKBMOD_ETYPE={0x6, 0x5, 0x6}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x7, 0x2, 0x10000000, 0xe921, 0x8}, 0xc}}]}, {0xa5, 0x6, "969a6c00b3165b45f9f5db7c29d6dfa59422b1383bb62e103a574626b133611e4dec54a82cc1bba5bbe5e788936f74e7f5f4b3a428dc153e0a9c9e11576252acda258f73e4e23210c15fd83bc515842b266f72a2a669316ce3bee3af3bbd91edd68ebbce7e73831d7eee55f60d66f00bb25b704e8a2aea466582d640150b7a14fd7b0f8294182dbde8a770f3df3e828c35d4f0a96799a44c38520ce725a779a4d1"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x1458}}, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x100000da}, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r7 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x20000804}], 0x1, 0x2ede8ec33678cf20) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x50, 0x0, r1, &(0x7f0000000300)={0x22080, 0x8, 0x9}, &(0x7f0000000380)='./file0\x00', 0x18, 0x0, 0x12345}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) io_uring_enter(r4, 0x623, 0x4c1, 0x4, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_freezer_state(r9, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r10, &(0x7f0000000040)='FREEZING\x00', 0x9) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x40400, 0x0) 1.423831541s ago: executing program 2 (id=3077): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mprotect(&(0x7f000061f000/0x3000)=nil, 0x3000, 0x5000001) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x1e, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = eventfd(0xfffffffc) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000240)=r0) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000040)={0x2, r0}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000580)={0x1, 0x800000, 0x0, &(0x7f0000000080)=""/55, 0x0, 0x8000000}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/62, 0x100000}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x7dc05000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x1310, 0x9dd8, 0x1, &(0x7f0000000940)={[0x5]}, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0xdc, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs$namespace(r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000000c00078008000640"], 0x5c}}, 0x20084884) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(0xffffffffffffffff, 0x4008af22, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfd, 0x1}, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) 1.081546312s ago: executing program 5 (id=3078): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f00020b, 0xc, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7", 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x10, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000030000008000000000000000b7080000000000007b8af8ff00000000b7080000683200007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRESOCT=r0, @ANYBLOB="00000000000f0000b70500000800000085000000760000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, 0x0, 0x0) socket$inet6(0xa, 0x4, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r3, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) r5 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$lock(r5, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) ioctl$IOMMU_HWPT_ALLOC$NONE(r5, 0x3b89, &(0x7f00000003c0)={0xffffffffffffff53, 0x0, r4, r3, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000ae26556f80000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = fsopen(&(0x7f0000000080)='ecryptfs\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r7, 0x6, 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r8 = fsmount(r7, 0x0, 0x0) openat$cgroup(r8, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) mount(0x0, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000000)='rpc_pipefs\x00', 0x3000008, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f00000001c0)={0xff, 0x3, 0x0, 0xcf0, 0x9, 0xfffffffe}) mount(0x0, 0x0, &(0x7f0000000000)='devpts\x00', 0x0, 0x0) 918.782406ms ago: executing program 0 (id=3079): openat$kvm(0x0, 0x0, 0x0, 0x0) openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) add_key$user(&(0x7f0000000000), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x4, 0xfff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) lseek(0xffffffffffffffff, 0x8, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000001b2c0)=""/102400, 0x19000) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) writev(r1, &(0x7f0000000400)=[{&(0x7f0000000200)="813e923255ee1cbfbbd042a1a927f17b37ea7d25b5d3c1f3cf4bf905fd7a84d67a0f30032bf961b36237698941c3658ed409e731e4093c24", 0x38}, {0x0}], 0x2) 774.860664ms ago: executing program 0 (id=3080): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000006380)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000380)="c56fe394ac12e55f24541663cfb3bddc8b4e4a925df5b85c07f37d640525a6b02a312f783cd78d3e9b92aea9d23fb884fed45050e263abbb57d96c1ced1d6915047e166c87fe64066b9e239980e4f2de6e5a05142813e15bcb4635dfe5a4865bcd8a481f751b3c99337f341ab72d398589fc6e5910ef5d1543133729f2dec152b1ad74e0d9642d", 0x87}, {&(0x7f0000000440)="f0a0983ac7e1e96bbc6f9c95f24ac31b4e5eddaa6cacc81858047ed7c8abfd53ab0c6abf9509f3832b8118706dfaa2e4a54fe29df7d72eaee152db7757583c208747dd68cc9323530e26c5ffcd1eed46b8ff04889cbcd570bf95189f39d1be4f498dafb071875c559b184108c8f9cdbf3f3b6f97fc420c8da63c0322997d2673fae5b13eb78461ad1f17aa848d264ff20cd73fb383b3744acf99365440ffd30a06ec7228c11d70001a62fdc9fe", 0xad}, {&(0x7f0000000500)="347db75505e670d3dc9db5c815b1c8b292b25f33444a27b7422b0da062f496154cb298837bd53ac7a9a4daac0d7f2d41ad223561cb923aa9b81e389db957396120bbda0d16703562daa8269ee6f6631a50d4886f505d91114475b7afc8dcc037d9fd4bd9ffaabd3f00d095a6276af3374a19923825370679cf69dcb0ad7562f7f2e2bc223f82053a16de01e81c8b00f54f", 0x91}, {&(0x7f00000006c0)="9a7ef9336013d072ca2ad73db374c48169627937030c0b33a662435720617c212c6e14df2d233731b9ec2f9134082f032cc939ffa33582671a50f2b66a86dc0c1280c7eaa3e0430061b1a82df5f491490774269d84fbe9d29602a1a199166bfa2b9067904348fc792d97d558948b95b4127248aa81ceeaad897d89d0f469d2c88a5ac7fb29427489b86b2a58705e4889ba09ba0b4bef3df2008748ad781b6556600623855a079a92091573aba6b247db11f5c46a22f5f5c5dc55e9e70af3fb9292144485b3bd", 0xc6}, {&(0x7f00000005c0)="3ed0cf373df2f18554dca87dcc731cb6347ae3d159e13eb76e04c35429e47601f2b129162fbe1993f2c14f984584184ae0f59712aa10f5a7c97e739327ce5ffe609f381e417d3a194c2b6d133977fe3a5ad8c7dd4caf8b6252cd", 0x5a}, {&(0x7f0000001900)="a2fe7d6a7e92b6fd0ce9cef5876de4abfb00ddb73fda9d9ec7c40d204d6580bca6f062bc3497054d23d4e3402fa93c7e589a599ed13075d35d5ddc2ac835c34afbb7f183485aa09e9e08b6000026255be8354bece71ee6433b073b6ec7e3c2c2d6b3a7563dc80c6300cf0a97e76d382c650d07dede243e219c000d1cb7da23f574cb1950795584b8cfe80ad450f21f905cda92dc20799719db09f882f5decd1fbef4e45de61e64c248007802e821226886218322f063829671363cac0c1fd38b6dd5104c49c69569dd5d13f235ae672fd5f1f62f335e4b4b9189abce9b7a6dd0e23e7084421652ecb72765dd2b581cbac5b555617aef0ca6b1cd97aa5d70e2cae940dbfb92b1c42925ae362092ce053c46c96971a1c8ab49353120d46f56d6c05ca87640ae32bd5ac00746135a634481a4c37b62b184367e14be52dc738fbc0df022c530db85a53955c7c05562cb42cf7da21935db68bc1dbfcb77cbe02d4a5d8da2227a7d1b27154668d0756d6b19452af004990ca84ee86f134fd2818a4e7b2dc7beb00cd319cf6aa47534b93cd60dc80acdbbf1136bf0b2fa787164933b1b0a8a716735b4042ccdee7b402c76adb7cd48716d2dda88378ad35b40fe116397f13e8cad7b61c1cb1f2b40f7b8570e107e6e5c59fac2e2fac03d6336778fb501c1de0769dada119327a37e7039be6f6396be935a6b4c094e7e493caa62de15288c20f32631b22dfe9836227452da3c55e69f7456de630ba667dc1c3be3e7f7eab348bb1a9ab7f86a62c924e223079b5ad9a7886bd7c0dcce5068d0c487ee8a12e1a3231a9bd0c6b3b82d0a7d4a87c8340c2b7d9ef7b9d154c5b7198d8a0a6ae4cdfb0c98c79265c8078dc1fe38c4d9455e6a5961551bb9eeda54881ddaed27bf358cad393112f572bc53547e7bbe09a616866590e081a6762d47cf3d697d86d1c4b98e151692b20af869fb79988aef2451557658861cf84033095d4324ee39836b759eaf363a3e8806956b42ad363ec9a4f91c6ad2ba825dcc2d47f8d1dc4d83dc97bed6ae7e7ab1e2cb12b429962012dc54bb27e372f3ec9c2025744e06dd2e577a1c7a78d00f524ef74b24cb85469c4a1043e489b4489e35d5e32e932566aa2bf7ecbe1d74cde8037ace52e94a16cddbaa77ef78e50389f30e98c05d91d87e98492bca822aac94f5b646fc1da3a950c837059e0aa77777814fd867ee2d51b174e7270f50bce2f702fbd8ac5c9047b1ae366cad6173db9bfa286230550f8435edd4aa089313757af62067e3811f6fcc82b0ef5fbd68900a300f30c70d38ccfac9dbb6401585bbfc3ded9c3108ac4c0473deee697ed2af71d66f35dba6e2e87cc673cff474ad313fa8047ecbae3d3464746f0fab578422ae9c5567edcdfcb26b9063a9293eec8aed0141610134a7e9168da953afea1a6e2dac5b3d774865b22a9c4ebcf1dce79ec1db186152ebfbbeab76c9e84a5400079925a9374a362f1c38dad6bebe454a7f68ca76cd9b86a136e4188850e680ff6e8d2667b046e29f4cd8ace31352ca89792a2c727ed27eccf46e3d2ca397178b782bdd3260a8da33cc3671bb5d365038a610ada4c42a422b823851e93e05725b6349d31e37bb94547afaf96951066559dd3e651e0a8638f1695edd764081c970e1c5e3c6e5eed20b32516fa5cb8a30841c48373b8c7a4fd56cd8254679aef9e7d980b3577b263c73901aff8076b6fbe39bb7ff986d6d9f802846e71fd4250f2d9c0b93312259b8d6fc69f122a940bd4df7df01f0d3e3abd7a3c8f2f5f489abe562b734d07ecb7ebb79add01bbf69419c246697a8d4d5013889037f12a7430dd427d2ca385c8541257f292115781e8493890e2e90ece58074f8c132f7419078c8a84b96116e9e77d424137cd65ffe65fbb15159381cdadd03b1292d680af6c4bd76164b52e6cdd85cfb4ce95aa61b6826ddc62229562c2d21cf1646b49fe6eb99d6dce690d25750a8d5ae2f3ea75b793f4467c4a2712105aa2156a57159c9ec68e3d14dfdde6718107002a70841c2ac7604d77c29c203927b5cfa887443d532a7fb9d980fa37ba7a087e1c04c55c96bdcdedb7c8c04d8b783243f516c2dd829d77f95df62c9c37d24b6151a9128683885a8922cfb14a37928a27f1ae18167a94e5727ee32b8e01b78d16ca3a836090e66e1a0a5d0028677cac0ed8cbe853d3cf10efbd5cc837bb8eab450764f061bf13e13d0d749030bc37589f49930c0d0a3a7412563967dbae132e08825db217f7c03b6a98df812a34661eab2bccf864918d4285eac96b0643f8f2d4d77e959e6de637f512faca5d1c997087215d2a4fb1c70c003705a738c5b4a5aa9ec0472e5316b01a052b32c59f9878ded377f25275be8cd6bcf74e953c05283ce39b8c3235266930f43cbd05d340c7fad2e4b9f594e24a1e209dcd29d365eb1cdb5e6ab940ed9b8a8415c3ae5a62ad9d9cafe52c725ce26b2fab347982c317e1ea8a27292310715e4b4e9e901b5e682938c5b13f1d8194b8c5911eae7afab7a1125e56bb1ebc5978f627bac07b68751f6b21c572ff1e7e795f821f73ffa08e4c06d03758121d7a80e93433a23fbe0309c704b7416498d4aa601f9a3bce1c0df7b1643717e1e9a8743163779299184fbd27d1964cc64dfbaea7a0bc3905fbf0fbace7c39c8e53d3abf06806cb19cc992ad5f1f2d66bb0636498a8b31e6f749c129878df1298ea57eef945c3ff401530c8ca12d95ebadd9b797b2c052a32e1e9a09c4967e8a220d3926a4eb4fc656727bb03643af88e1c97cde622999a9b930586807d567087f2cebc40c5f0800be0675f78155cd962de5b59e3814b48b8e7bd80917715acc066a36ea546cd44d434e87238f016b5ffb14d862e29351011225e92a9cce1ec067dcf0c7b61b147c620ba5028669bb9e59e663309e05f654a83e68114307e6c20ccfc36421fcf9aec21f47362c9adb9f58a06d87705d07b747b2f64b2e98b4ac9cf22076a1169d1ce5833ff95c98aa1acd75c27675ce1895a162f09e7bb3237333468060bb7d923b5b1fad9b7954b975b9f338108b8afc249b511909fd663a1ea5ced60e938d96f45c803d5b59485e94d0d0cbe28512162127e1dc3167c2ad11ee6383448fc564990519d057d84adf965e4b6be5bd544f8e5584bff39a8f2a8eec601bab8a07fb6240c1a26e3aacd08378402f5b1e80ec644a18b062fcf43afe012f860752646ead121b690f883c98b5b4d4d5055f3dbf959fc71cc1dc5325bec58e241b2eb2f0860e91d218753c276ce508bef9a488b94bdb14d95be931fdc977128ea48cd9eb9c7e8117321096cf0b913281be17689525e0413ef0d89e2d0da66e852171595ebc9eca4683a6428a8cc6e77e7a888bfd4cc75f9565dec84a95df640525f222d6cf1df359a3bbd2e3145b1bdb7881b3bc8c4440df1a9eefd5db4c6202cc54c6adf805cced8a55727c83acf074d808374a77b43bfc539ecac67c2f5714e119ff3ba7a622b45a4acc8e12f1a94efd4f5355c35814d49fd31113c5d3990a71662906eb57e8321f12c8f6e59423aaa537bceef2ab01ea29fc2cd55e28f62fc3b85e74edb857a5519091dfe8d7b9c738c8a4089ccbad242da606c7bbc2edfa79f0ae0416071b7853058bdc0688426c8745c75ba9b667fadaeddc44a798d0cdcb59ad887851500c5bb0b6c82bae2cb0c7b941647a18578b2fa46a62d675c71cd62aecb5d8736864cdf244fe28227fd167b4c35a71e187f4e251c402f169b6af34969d0860586d621bce9a66a37c4294a42be8767e0d86059caba294f0e31f7ffd757a627fac8c760bb57a8e2e7bbaea722a5b7df5aafb171b23091f1976cc6616eea5532ffbf43458ec48e493f2f1ce8ab03194dd0997c12f0d6e40c25872090a7be28fb1e305af4df38d86cdb90caa96fb634da13d71f230864de69cb46a313d33cdb14b73e85c44715ac0a52ff4d8b5d5ce7f9ccf94880c133da3ce4c5afd57fd2d3d0db69c05fd78859d25062dd3b7cd3f3c5a9bc70f12e22f19c866a3edf78f412a9c6b58d53586bd60bce7c82ceb4b4511d39101b3084feab4ca5a3434022c28ee77958166136c3d2016aa4bcc7b14ea8255a0902940211703c4b7479bff1aa5496803b49f6a1e7831e7fa28b054bd4fe9e47432c84b4dcc63ddb50be7217d1685f40025b916327aad262265dd96650a9f43c0ea7d4faae387359c01dc5bcc89181bbff07ebe5ead95e500f447efa2ecf21b8f9159132036dec4f8f716c0ac8600b1d0623a7c02f1829bdd34ea8bbd386fd3f1c2204e3cc869d32fbbd9fe5da95b536e2bfc47a203d1928c294239747d4565866f3cfa0e38d6effd43d5f1b4117625be83eed3d9a24f94779a584daa53f096228a3bd80e8b4b71be119f3ae1d32b9442cde722dbd915aeeb104824b37e34d59d5581d1615b1c89b3178ce44abf32c92a3653439a2fd38b83226dfda735c5ba25baaf0d1a33f8e204a5c4bc2918008a7118e32eccfe1d8b0624cee1c7764fffcffd8e8d476320cab8c7f3090145c73a35818d780115f7120a66d2a162e2919e4b8b555d81955023ed3f3b07831be313ab24b86f93a90baab46d68911f27faf9a3b4d3d083609eff9bb029dd8cab4c4b88f1ac27ad86d95b078c9b42a823050e37d6ffe51e97e266ba5c31600520b71b6068ced5c9cbf7e58e192e035ada9e064e85471f50c11c475ff33f31dec8ad415abbc82843f3ccc8e1cbcd852349ef7fbc7fb3fc411964a80681a5d32f3a05d39cd1d82f669558047e69a89b9d2f75690635fd6d6fc176c9181d4e7bf264c9a8befa9af32b22014c7d8bcc62b3c95c015eb34366813dfd1fe680796a2ae5437b562ab72893b758ff10d75c92fc66729b51802bc65ee6c7842ef41b5e22f112ba58a532144ba71f0893e4b33e4e1218583ce88adc63b6df52463e69ffc9515a261fb29fc19aa1acfb6eb9bb50f1057083a3d565da87976dc3f1506c83366890fdae431ef148b44799274c04e62c768fc17d503cfaf411648f66efae18582e170634f0ec3260ccbd04cb97f3966aa5637706ddb779b8510093e66a75fa8c73f65ef6cd43a5cde6a61d3ca6e3e21ed1e33cd2b3cfe85e22b8c4c0f88c7a0b23fac0e2f7fcb5eec4b542dcf10c620b9e0df696bc2014f8cf6988c057680544f982e394027c9f71415403f25b56c3f938ca4f17fbf5a82c0212ff8f527d817429ef1a854d861c08d0d274b93ece24be1a7b65059203c6b3de281710b0123d6628fbb56939a3069f7394b3957719cfdc57c7b010d97694706730d21f1fc9fdfe81dc438e8f2b240b36416374b43c10358f0b7fe1cfc0baf49283b0a03376e568f28fe19c870332d8a52274e7c03134f985685ffb3cd06554697f00601a55052cf3b1c4430bc83e0feb236ef6399111fbeacc6392894d6dc7b0f0aa44079f76b24eb90f9cbe4c4b22c4fbb5014ffb9422876d9a12ca9dc7056be542ce6583708d6a1c6c2e7edb7c6f387dc0515b3a359d11323296e2dc1b4cd02a709e0e511183c3b96d5f6592e9e0efb4f7a2ef5bc3dfe3ffd169db22cd618d88b4f7328d358ba679240be024399cf8cbf3cb5dd8a0ca63a9ac9a3849c8366d79d9f55e12fd5ec3ee1737ddc26a5c0ce3a680b84baf6cdb9101ea67a613c7163dadd0e3f30b33a5ff86aaaacda2b671b3ae5eec827cc75a833bf6d1f6ac61085528e4ed1e66f5780a62aa99f753714d919488fdc5734bdb8ee162c74d62189f295168021e54250b3fc0052d511b0c747112e41459a318454cedaccde72c", 0x1000}, {&(0x7f00000002c0)="6aad5f395b625511ec16324ae80e73ac5e64ff57917c22d25ce40198d4e29087ec056ed231fdb2841bdd31bbe67b4d040c8ed24cb0e61d2c9abc6b78cf", 0x3d}, {&(0x7f00000007c0)="e4afff749363b517662382143ce709d5f50792a4bcb7e73abf4b17df4b3ae0829b6117eae836d642f69ead80efb307abc55ada15ab066fe34bd8dac8835b54bd8beb57d8e3c4c5238ba396ed388cecaf56ca01c11e9b6cba85d457f2ba39c595a4fee8bd90a8efbf2504670718541c19300826a6ec44fef516819f53f9a4c8714300db6df6a5b77508887deeff7d347d0f66b211dd8171de0ff5ad5fab319a64a2449a3b2b9b4690f71a05cdedd6ad52bec881d1faabecbb509a7bc2c1833d479132ad125824f588", 0xc8}, {&(0x7f00000008c0)="f1f3623653b21ee9706eea6dd5f2bcd6ec3f7b92244c91dae4c0840c046ee3e833707905046ead36a2cbb765128057ae96104ffb4d6527e3d878a497e16fa585a988bbb243be1d40116f7d3019a9ef71efdcedd8b319fda709570b70f6d67e9862020f359584ea5cac0c70a37054c03c74865b994a792bde4aa21523db11cab45738bcd9140fe6268c75f5f6f7ba6d80b13908b75c4d641c1345e155d919eb6740d2a9eebc37935aac9d74a8c02901273568a5ddd01063965c3293bd2301f7a6d8eff270bb3ca1d97c37594e630f41d146256cf70d736e79", 0xd8}, {&(0x7f00000009c0)="708915edb717bbb71541e55b904aa8072c487b5ec1189503135a22a2bb8d05a0aa7366fa681d783337eba57db429dab3a7307eac748453fcb75f379f3d5066e7f4d07f8bb32a5e8c0d26ac49574d309b12ed6735314a4c0fa3566d71cb8bc7d7f62517ada9c9a385c10d327a8187f1bdf0858d3d8db19e78f91df01e569b73c48e1d30dc3a59fd50993617195439857addcddad8166c449297229bf2bc8ea9be", 0xa0}], 0xa, &(0x7f0000001080)=[@rights={{0x24, 0x1, 0x1, [r1, r1, r1, 0xffffffffffffffff, r0]}}, @rights={{0x30, 0x1, 0x1, [r2, r1, 0xffffffffffffffff, 0xffffffffffffffff, r1, r0, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [r0, r0, r2, 0xffffffffffffffff, r1]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}], 0xc0, 0x4}}, {{&(0x7f0000001140)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000001280)=[{&(0x7f00000011c0)="8dae5bd5f7d06385010e2eb10c30f82e011d6542f4541e5fd3ca53cde3d5aeecf4f072800bc93f8826b3aaa6dafc2adf9adab3c1561fb5e1a0b07114bd9dd10a28083a15f45de9a609f3d82211a6f7276635edcea296d78af90563219052e915297aa6e92c907ed3a77238925f455527e486e5f0f21965e57dc6b904eef95a4356520a7cc987cb4d17b0c8f425fabc27f5209caed48c3c0466f743", 0x9b}], 0x1, &(0x7f0000001300)=[@rights={{0x14, 0x1, 0x1, [r0]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40, 0x4}}, {{&(0x7f0000001340)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001600)=[{&(0x7f00000013c0)="992221e231214480c1168e2803ecb19d2992f8001d821ab241ba9b6cdd4efbc1db1be01711a7821c2496b91b784a4312f1fbb254d87abc6421c59e29e0", 0x3d}, {&(0x7f0000001400)="7bb672b77613d96362be7ca658d7ec1a274b69f20a5e6a43122c03747d9a080ffbe1793aef2153eb92aa5f55b0468266ad2abfa1b510a3331fd65ea154608ddf565ceec4a026925a9e84f155cbc7aff6faea1a2fcd181b462f1506b31aacc39b982398e90a654bdafce782bd800872db5a17741d26ecba5d355ef382d4d57462a3cfbdd0aa492d14c0a0df17a9956e440c683c43b9fcc5002d3009a383299cc4629d3048e087efd719d0bb29546cafd74efc4345f0612aeef274a3c73265cc40713bdb39ec039f26cd2122e6451419818f5aad1f79ec9279e20c74ddaeab868434fdf33ebb11e6b22eaa06ae000f4e76a31d660e2dd68006ec4769a276", 0xfd}, {&(0x7f0000001500)="677b605a427b963ef43254222060ad506ab41164e52497bf6831177932c13a71db02e6f6a16534611375b20483ac4c1540f40f7a575464483fb10932200313653c5c16b3922790affd5e5f8555fe0668db813c889f54e7e87a536692063cdb6d94cbf44337072e10a419bc0fa6f2cfd5428f4afe1ef734ee71d4727bc2e429032d432c9e97ccd6e6eeb4329bf50d67d3a7f8f7a1568f39202e26865ddd629a5c3e66ab9396c4788f88f87d21544c1ec1bf1ec525697d35c36356", 0xba}, {&(0x7f00000015c0)="97c8c89d9b821097154937cec397b6f87628c4613af2be01f7b6cbce850d151c", 0x20}], 0x4, 0x0, 0x0, 0x4000}}, {{&(0x7f0000001640)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000006300), 0x0, &(0x7f0000006340), 0x0, 0x8008040}}], 0x4, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3c) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0xc40, 0x0) r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x0, 0x1, 0x83}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x4007, @fd=r3, 0x1, &(0x7f0000000080)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1, 0x0, 0x1}) io_uring_enter(r4, 0xc86, 0x0, 0xe, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) r7 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x1000, 0x2, 0x1f8}, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) writev(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000100)=@IORING_OP_SEND={0x1a, 0x61, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x20000850, 0x1}) r10 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x88000, 0x48, 0x2d}, 0x18) symlinkat(&(0x7f00000000c0)='./file0\x00', r10, &(0x7f0000000340)='./file0\x00') io_uring_enter(r7, 0x47b7, 0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) ftruncate(0xffffffffffffffff, 0x8008976) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x88}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 0s ago: executing program 5 (id=3081): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x6, 0x9, 0x0, 0x0, 0x4}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5416, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) close(0xffffffffffffffff) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) r3 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_VOLTAGE(r3, 0x6f43, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r2, 0x1, 0x31, &(0x7f0000001600), 0x4) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r5, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) close(0xffffffffffffffff) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x2, 0x9, 0x6, 0x6, 0x20000, 0x5150, 0x8}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x14, 0x38, 0x301, 0x270bd26, 0x25dfdc03, {0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x20000004}, 0x20004814) kernel console output (not intermixed with test programs): setting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 829.771864][ T9] usb 6-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 829.781188][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.820366][T15581] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 829.848058][ T10] usb usb1-port1: unable to enumerate USB device [ 829.857432][ T5861] usb 3-1: Using ep0 maxpacket: 32 [ 829.865421][ T5861] usb 3-1: unable to get BOS descriptor or descriptor too short [ 829.876407][T10945] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 829.887371][ T5861] usb 3-1: config 1 has an invalid descriptor of length 101, skipping remainder of the config [ 829.904782][ T5861] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 829.905690][T10945] usb 5-1: device descriptor read/8, error -71 [ 829.940999][ T5861] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 829.962346][ T5861] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 829.970374][ T5861] usb 3-1: Product: syz [ 829.987428][ T5861] usb 3-1: Manufacturer: syz [ 829.997175][ T5861] usb 3-1: SerialNumber: syz [ 830.032668][T15581] netlink: 'syz.5.2555': attribute type 1 has an invalid length. [ 830.048879][T15581] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2555'. [ 830.088958][ T9] usb 6-1: string descriptor 0 read error: -71 [ 830.102591][ T9] hub 6-1:32.0: USB hub found [ 830.117397][ T9] hub 6-1:32.0: config failed, can't read hub descriptor (err -22) [ 830.143192][T10945] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 830.182013][T10945] usb 5-1: device descriptor read/8, error -71 [ 830.231661][ T9] usb 6-1: USB disconnect, device number 41 [ 830.305476][T10945] usb usb5-port1: unable to enumerate USB device [ 830.375340][T15588] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 830.384540][T15588] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 830.730547][T13781] Bluetooth: (null): Invalid header checksum [ 830.831477][T13783] Bluetooth: (null): Invalid header checksum [ 830.943463][T13783] Bluetooth: (null): Invalid header checksum [ 831.048350][T13783] Bluetooth: (null): Invalid header checksum [ 831.117025][ T9] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 831.162917][ T1093] Bluetooth: (null): Invalid header checksum [ 831.267159][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 831.272492][T13781] Bluetooth: (null): Invalid header checksum [ 831.281191][ T9] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 831.291191][ T9] usb 6-1: config 0 has no interface number 0 [ 831.300490][ T9] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 831.310169][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 831.319117][ T9] usb 6-1: Product: syz [ 831.326249][ T9] usb 6-1: Manufacturer: syz [ 831.346333][ T9] usb 6-1: SerialNumber: syz [ 831.393917][ T9] usb 6-1: config 0 descriptor?? [ 832.484184][ T9] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 832.507870][ T9] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 832.733269][ T9] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 832.746946][ T9] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -61 [ 833.623406][ T5891] usb 4-1: unable to get BOS descriptor or descriptor too short [ 833.660061][ T5891] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 833.694923][ T5891] usb 4-1: can't read configurations, error -71 [ 833.823428][ T5861] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 833.855286][ T5861] usb 3-1: MIDIStreaming interface descriptor not found [ 833.988611][T15634] ip6t_rpfilter: unknown options [ 834.020887][ T5861] usb 3-1: USB disconnect, device number 76 [ 834.138253][T13795] udevd[13795]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 834.162268][T15638] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 834.307440][ T29] audit: type=1400 audit(2000000263.751:980): avc: denied { ioctl } for pid=15629 comm="syz.4.2572" path="/dev/ptyqc" dev="devtmpfs" ino=131 ioctlcmd=0x5436 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 834.540870][ T5861] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 834.636610][ T24] usb 6-1: USB disconnect, device number 42 [ 834.754606][ T5861] usb 3-1: Using ep0 maxpacket: 16 [ 834.772661][ T5861] usb 3-1: no configurations [ 834.782524][ T5861] usb 3-1: can't read configurations, error -22 [ 834.925069][ T5861] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 835.359311][T15645] netlink: 'syz.0.2574': attribute type 4 has an invalid length. [ 835.367578][T15645] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2574'. [ 835.393767][T15645] wlan1: mtu less than device minimum [ 835.763624][ T5861] usb 3-1: Using ep0 maxpacket: 16 [ 835.774473][ T5861] usb 3-1: no configurations [ 835.779103][ T5861] usb 3-1: can't read configurations, error -22 [ 835.811879][ T5861] usb usb3-port1: attempt power cycle [ 835.989115][T15655] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2578'. [ 836.018785][T15655] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2578'. [ 836.048991][ T9] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 836.135681][ T5861] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 836.165119][ T5861] usb 3-1: Using ep0 maxpacket: 16 [ 836.170696][ T5861] usb 3-1: no configurations [ 836.189380][ T5861] usb 3-1: can't read configurations, error -22 [ 836.211244][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 836.222656][ T9] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 836.326362][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 836.344711][ T5861] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 836.348019][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 836.390968][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 836.426771][ T5861] usb 3-1: Using ep0 maxpacket: 16 [ 836.433103][ T5861] usb 3-1: no configurations [ 836.444161][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 836.444332][ T5861] usb 3-1: can't read configurations, error -22 [ 836.525192][ T5861] usb usb3-port1: unable to enumerate USB device [ 836.587037][ T9] usb 6-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 836.601983][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.659148][ T5891] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 836.734858][ T9] usb 6-1: Product: syz [ 836.819889][ T5891] usb 5-1: Using ep0 maxpacket: 32 [ 836.886486][ T5891] usb 5-1: unable to get BOS descriptor or descriptor too short [ 836.898408][ T5891] usb 5-1: config 1 has an invalid descriptor of length 101, skipping remainder of the config [ 836.911412][ T5891] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 836.928106][ T5891] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 836.969452][ T9] usb 6-1: Manufacturer: syz [ 836.978655][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.995390][ T5891] usb 5-1: Product: syz [ 837.001017][ T5891] usb 5-1: Manufacturer: syz [ 837.007089][ T5891] usb 5-1: SerialNumber: syz [ 837.047826][ T9] usb 6-1: SerialNumber: syz [ 837.074572][ T9] usb 6-1: config 0 descriptor?? [ 837.555763][T15683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 837.565158][T15683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 837.749393][ T5861] usb 3-1: new full-speed USB device number 81 using dummy_hcd [ 837.793253][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 837.817016][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 837.827992][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 838.026308][T15688] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 838.053719][T15688] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 839.002275][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 839.325188][ T5861] usb 3-1: device descriptor read/64, error -71 [ 839.355268][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 839.384098][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 839.435443][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 839.442717][T15696] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2589'. [ 839.669891][ T5861] usb 3-1: new full-speed USB device number 82 using dummy_hcd [ 840.447691][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.545384][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.590656][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.630568][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.664949][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.699259][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.727150][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.746413][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.776644][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.803731][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.836980][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.879914][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.917621][ T9] iforce 6-1:0.0: usb_submit_urb failed: -71 [ 840.937464][ T9] input input60: Timeout waiting for response from device. [ 841.459705][ T9] usb 6-1: USB disconnect, device number 43 [ 841.774316][ T9] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 841.873591][T15716] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2595'. [ 842.107309][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 842.136263][ T9] usb 6-1: no configurations [ 842.155295][ T9] usb 6-1: can't read configurations, error -22 [ 842.198205][ T5891] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 842.235401][ T5891] usb 5-1: MIDIStreaming interface descriptor not found [ 842.307759][ T9] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 842.479166][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 842.499930][ T9] usb 6-1: no configurations [ 842.504522][ T9] usb 6-1: can't read configurations, error -22 [ 842.534763][ T9] usb usb6-port1: attempt power cycle [ 843.080622][T15729] ip6t_rpfilter: unknown options [ 843.174239][ T9] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 843.263418][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 843.279628][T15733] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3482940618 (6965881236 ns) > initial count (504378442 ns). Using initial count to start timer. [ 843.308472][ T9] usb 6-1: no configurations [ 843.313110][ T9] usb 6-1: can't read configurations, error -22 [ 843.425892][T15733] input: syz1 as /devices/virtual/input/input61 [ 843.450862][ T9] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 843.511652][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 843.535191][ T9] usb 6-1: no configurations [ 843.550159][ T9] usb 6-1: can't read configurations, error -22 [ 843.575798][ T9] usb usb6-port1: unable to enumerate USB device [ 843.660305][ T10] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 843.781069][T15746] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2602'. [ 843.918766][ T10] usb 4-1: config 7 descriptor has 1 excess byte, ignoring [ 844.104598][T15748] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2603'. [ 844.708714][ T10] usb 4-1: config 7 has 1 interface, different from the descriptor's value: 2 [ 844.797931][T15748] hsr_slave_1 (unregistering): left promiscuous mode [ 844.811617][ T10] usb 4-1: New USB device found, idVendor=19d2, idProduct=1275, bcdDevice= 7.84 [ 844.854796][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.898583][ T10] usb 4-1: Product: syz [ 844.936582][ T10] usb 4-1: Manufacturer: syz [ 844.964815][ T5861] usb 5-1: USB disconnect, device number 66 [ 844.972353][ T10] usb 4-1: SerialNumber: syz [ 845.052729][T15759] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2606'. [ 845.088371][ T10] rndis_host 4-1:7.0: skipping garbage [ 845.180453][ T10] usb 4-1: bad CDC descriptors [ 845.223834][ T10] option 4-1:7.0: GSM modem (1-port) converter detected [ 845.316279][T15738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.363712][T15738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 845.422378][ T5861] usb 4-1: USB disconnect, device number 73 [ 845.487152][T15769] xt_TCPMSS: Only works on TCP SYN packets [ 845.569523][ T5861] option 4-1:7.0: device disconnected [ 846.605219][ T51] block nbd30: Receive control failed (result -32) [ 846.679979][ T5861] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 846.852059][ T5861] usb 4-1: Using ep0 maxpacket: 32 [ 846.870881][T15789] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2615'. [ 846.898962][ T5861] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 846.924716][ T5861] usb 4-1: config 0 has no interface number 0 [ 847.044504][ T5861] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 847.056070][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.071815][ T5861] usb 4-1: Product: syz [ 847.077050][ T5861] usb 4-1: Manufacturer: syz [ 847.085052][ T5861] usb 4-1: SerialNumber: syz [ 847.496514][ T5861] usb 4-1: config 0 descriptor?? [ 848.565491][T15804] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2605'. [ 848.651850][ T9] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 848.975434][ T5861] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 849.013752][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 849.105597][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 849.147967][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 849.188995][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 849.221550][ T9] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 849.260083][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 849.324776][ T9] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 849.370438][ T9] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 849.401742][ T9] usb 5-1: Manufacturer: syz [ 849.552450][ T9] usb 5-1: config 0 descriptor?? [ 849.627167][ T5861] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 849.653614][ T5861] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 849.676642][ T5861] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -61 [ 849.880342][ T10] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 850.014569][ T9] rc_core: IR keymap rc-hauppauge not found [ 850.032684][ T9] Registered IR keymap rc-empty [ 850.057862][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 850.063188][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.081363][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 850.089848][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.101540][ T10] usb 1-1: config 1 has an invalid descriptor of length 101, skipping remainder of the config [ 850.119029][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 850.132724][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 850.138074][ T5861] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 850.148022][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input62 [ 850.169943][ T10] usb 1-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 850.181827][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 850.190689][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.198591][ T10] usb 1-1: Product: syz [ 850.203638][ T10] usb 1-1: Manufacturer: syz [ 850.208494][ T10] usb 1-1: SerialNumber: syz [ 850.214246][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.242173][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.275755][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.318731][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.356453][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.394501][ T5861] usb 3-1: config index 0 descriptor too short (expected 64874, got 72) [ 850.404130][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.434225][ T5861] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 850.456600][ T5861] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 850.484467][ T5861] usb 3-1: Product: syz [ 850.491145][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.518826][ T5861] usb 3-1: Manufacturer: syz [ 850.523728][ T5861] usb 3-1: SerialNumber: syz [ 850.537619][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.564031][ T5861] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 850.587286][ T24] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 850.610276][ T5891] usb 4-1: USB disconnect, device number 74 [ 850.669758][ T9] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 850.683908][T15817] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 850.750717][T15820] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2620'. [ 850.772679][T15820] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2620'. [ 850.844497][T15817] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 850.867663][ T9] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 850.931939][ T9] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 851.006322][ T9] usb 5-1: USB disconnect, device number 67 [ 851.607257][ T1210] usb 3-1: USB disconnect, device number 83 [ 851.871691][ T24] usb 3-1: Service connection timeout for: 256 [ 851.888866][ T24] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 851.934240][ T24] ath9k_htc: Failed to initialize the device [ 851.960860][ T1210] usb 3-1: ath9k_htc: USB layer deinitialized [ 852.355179][T15835] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2623'. [ 853.058905][ T51] block nbd31: Receive control failed (result -32) [ 853.072675][T15829] gfs2: gfs2 mount does not exist [ 853.157852][ T29] audit: type=1400 audit(2000000283.582:981): avc: denied { ioctl } for pid=15841 comm="syz.3.2625" path="socket:[57810]" dev="sockfs" ino=57810 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 853.497063][T15849] sock: sock_timestamping_bind_phc: sock not bind to device [ 853.701914][ T10] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 853.724479][ T10] usb 1-1: MIDIStreaming interface descriptor not found [ 853.736073][T15853] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2626'. [ 853.798857][T15856] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 853.948125][ T24] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 854.835533][T15856] Device name cannot be null; rc = [-22] [ 854.929591][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 855.034921][ T24] usb 4-1: config 0 has an invalid descriptor of length 37, skipping remainder of the config [ 855.184144][ T10] usb 1-1: USB disconnect, device number 53 [ 855.219620][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 855.242665][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 855.258238][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 855.287576][T13795] udevd[13795]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 855.316144][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 855.371289][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 855.398815][ T24] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 855.418467][ T24] usb 4-1: Manufacturer: syz [ 855.434583][ T24] usb 4-1: config 0 descriptor?? [ 855.504170][T15871] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2634'. [ 855.563049][T15871] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2634'. [ 856.262730][ T24] rc_core: IR keymap rc-hauppauge not found [ 856.275391][ T24] Registered IR keymap rc-empty [ 856.317822][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 856.437063][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 856.493281][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 856.676454][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input63 [ 856.886285][T15884] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2637'. [ 858.595773][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 858.897263][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 858.933028][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 858.986741][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 859.065552][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 859.112051][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 859.229556][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 859.253966][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 859.266153][ T51] block nbd32: Receive control failed (result -32) [ 859.273380][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 859.311534][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 859.756643][T15911] sock: sock_timestamping_bind_phc: sock not bind to device [ 859.997678][ T24] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 860.032530][ T24] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 860.045584][T15910] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 860.054651][ T24] usb 4-1: USB disconnect, device number 75 [ 860.073836][T15914] Device name cannot be null; rc = [-22] [ 860.587239][ T24] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 860.881840][T15918] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 861.144660][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 861.185737][T15928] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2648'. [ 861.419632][ T24] usb 4-1: New USB device found, idVendor=046d, idProduct=08b3, bcdDevice=6d.2a [ 861.531028][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 861.555023][ T24] usb 4-1: config 0 descriptor?? [ 861.570871][ T24] pwc: Logitech QuickCam Zoom USB webcam detected. [ 861.700183][ T24] pwc: Warning: more than 1 configuration available. [ 861.715175][T13781] Bluetooth: (null): Invalid header checksum [ 861.749901][T13775] Bluetooth: (null): Invalid header checksum [ 861.867238][T13775] Bluetooth: (null): Invalid header checksum [ 862.112573][T13775] Bluetooth: (null): Invalid header checksum [ 862.171380][T13775] Bluetooth: (null): Invalid header checksum [ 862.769732][T15952] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2654'. [ 862.778810][ T10] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 862.941400][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 862.950827][ T10] usb 5-1: config 0 has an invalid descriptor of length 37, skipping remainder of the config [ 862.975033][T15957] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 862.982331][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 863.002390][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 863.012993][T15957] Device name cannot be null; rc = [-22] [ 863.037950][ T10] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 863.053781][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 863.113677][ T10] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 863.283029][T15962] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2659'. [ 863.421570][ T10] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 863.477992][ T10] usb 5-1: Manufacturer: syz [ 863.537402][ T10] usb 5-1: config 0 descriptor?? [ 863.578891][T15965] syzkaller1: entered promiscuous mode [ 863.596981][T15965] syzkaller1: entered allmulticast mode [ 863.968699][ T10] rc_core: IR keymap rc-hauppauge not found [ 863.984389][ T10] Registered IR keymap rc-empty [ 864.006724][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.058458][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.077097][ T24] pwc: Failed to set LED on/off time (-71) [ 864.103218][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 864.114940][ T24] pwc: send_video_command error -71 [ 864.114959][ T24] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 864.115041][ T24] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 864.139531][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input64 [ 864.150472][ T24] usb 4-1: USB disconnect, device number 76 [ 864.209900][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.264413][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.283114][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.295197][T15978] afs: Unknown parameter 'dyn[¨Aòµu¨½x$Ž¾Mš€' [ 864.321422][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.359591][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.381130][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.416608][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.445987][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.483056][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.512656][ T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 864.546453][ T10] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 864.556255][ T10] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 864.596078][ T10] usb 5-1: USB disconnect, device number 68 [ 864.656583][ T24] usb 4-1: new full-speed USB device number 77 using dummy_hcd [ 864.845552][ T24] usb 4-1: device descriptor read/64, error -71 [ 865.806326][T16036] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 866.117976][T16036] Device name cannot be null; rc = [-22] [ 866.190361][ T10] libceph: connect (1)[c::]:6789 error -22 [ 866.225520][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 866.452898][T16037] ceph: No mds server is up or the cluster is laggy [ 866.737586][ T10] libceph: connect (1)[c::]:6789 error -22 [ 866.756429][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 867.710231][T16070] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2680'. [ 868.569521][ T29] audit: type=1400 audit(2000000299.759:982): avc: denied { listen } for pid=16071 comm="syz.2.2682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 868.955294][ T29] audit: type=1400 audit(2000000299.885:983): avc: denied { accept } for pid=16071 comm="syz.2.2682" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 869.052451][T16080] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 869.089625][T16080] Device name cannot be null; rc = [-22] [ 869.370395][ T24] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 869.550778][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 869.578617][ T24] usb 4-1: config 0 has an invalid descriptor of length 40, skipping remainder of the config [ 869.607822][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 869.643652][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 869.667209][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 869.693507][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 869.744014][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 869.770553][ T24] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 869.800381][ T24] usb 4-1: Manufacturer: syz [ 869.828706][ T24] usb 4-1: config 0 descriptor?? [ 870.003465][T16095] xt_TCPMSS: Only works on TCP SYN packets [ 870.316163][T16096] overlayfs: failed to clone lowerpath [ 870.330759][T16096] 9p: Bad value for 'rfdno' [ 870.351044][ T24] rc_core: IR keymap rc-hauppauge not found [ 870.447668][ T24] Registered IR keymap rc-empty [ 870.471603][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 870.571430][ T10] libceph: connect (1)[c::]:6789 error -22 [ 870.589592][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 870.608323][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 870.660963][T16113] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2693'. [ 870.734667][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 870.788773][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input65 [ 870.846793][ T10] libceph: connect (1)[c::]:6789 error -22 [ 870.867848][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 870.894873][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 870.922405][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 870.961667][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 870.991140][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 871.019470][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 871.046130][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 871.074721][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 871.103498][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 871.131939][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 871.143192][T16107] ceph: No mds server is up or the cluster is laggy [ 871.272705][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 871.762285][ T10] libceph: connect (1)[c::]:6789 error -22 [ 871.783280][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 871.788604][ T24] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 871.818076][ T24] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 871.908936][ T24] usb 4-1: USB disconnect, device number 79 [ 873.609020][ T1210] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 873.767549][ T24] hid (null): unknown global tag 0xe [ 873.814794][ T24] hid-generic 0004:A35D:0000.001F: unknown main item tag 0x7 [ 873.844843][ T24] hid-generic 0004:A35D:0000.001F: unknown main item tag 0x7 [ 874.107551][ T24] hid-generic 0004:A35D:0000.001F: unknown global tag 0xe [ 874.124961][ T1210] usb 3-1: Using ep0 maxpacket: 16 [ 874.127142][ T24] hid-generic 0004:A35D:0000.001F: item 0 4 1 14 parsing failed [ 874.147749][ T1210] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 874.147868][ T24] hid-generic 0004:A35D:0000.001F: probe with driver hid-generic failed with error -22 [ 874.202464][ T1210] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 874.223196][ T1210] usb 3-1: config 0 interface 0 has no altsetting 0 [ 874.236951][ T1210] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 874.246356][ T10] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 874.332560][T16162] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2706'. [ 874.353724][T16162] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2706'. [ 874.383372][ T1210] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 874.440540][ T1210] usb 3-1: config 0 descriptor?? [ 874.956479][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 874.964569][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 874.979299][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 874.994881][ T29] audit: type=1400 audit(2000000306.352:984): avc: denied { ioctl } for pid=16161 comm="syz.3.2707" path="socket:[59949]" dev="sockfs" ino=59949 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 875.020855][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 875.246137][ T1210] hid (null): unknown global tag 0xd [ 875.286754][ T9] libceph: connect (1)[c::]:6789 error -22 [ 875.341697][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 875.347673][ T1210] hid (null): unknown global tag 0xe [ 875.353252][ T1210] hid (null): report_id 49262 is invalid [ 875.360185][ T10] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 875.373657][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 875.413272][ T10] usb 1-1: config 0 descriptor?? [ 875.464165][T16171] ceph: No mds server is up or the cluster is laggy [ 875.518235][T16139] xt_CT: You must specify a L4 protocol and not use inversions on it [ 875.601553][T10945] libceph: connect (1)[c::]:6789 error -22 [ 875.961525][T10945] libceph: mon0 (1)[c::]:6789 connect error [ 875.976596][T10945] usb 3-1: USB disconnect, device number 84 [ 876.273273][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 876.295214][ T29] audit: type=1400 audit(2000000307.843:985): avc: denied { write } for pid=16152 comm="syz.0.2704" path="socket:[60655]" dev="sockfs" ino=60655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 876.326837][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0021/input/input66 [ 876.408272][ T10] microsoft 0003:045E:07DA.0021: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 877.427623][ T24] usb 1-1: USB disconnect, device number 54 [ 877.565541][T16187] fido_id[16187]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 879.532549][T16210] xt_hashlimit: size too large, truncated to 1048576 [ 879.582596][T16220] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 880.109927][T16229] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2718'. [ 880.221106][ T24] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 880.254573][ T5861] libceph: connect (1)[c::]:6789 error -22 [ 880.277269][ T5861] libceph: mon0 (1)[c::]:6789 connect error [ 880.372425][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 880.389780][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 880.440095][ T24] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 880.473502][T16223] ceph: No mds server is up or the cluster is laggy [ 880.501215][ T24] usb 1-1: New USB device found, idVendor=12d1, idProduct=fae2, bcdDevice=70.8b [ 880.549220][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.558043][ T5861] libceph: connect (1)[c::]:6789 error -22 [ 880.582160][ T5861] libceph: mon0 (1)[c::]:6789 connect error [ 880.599784][ T24] usb 1-1: Product: syz [ 880.621146][ T24] usb 1-1: Manufacturer: syz [ 880.630389][ T24] usb 1-1: SerialNumber: syz [ 880.653412][ T24] usb 1-1: config 0 descriptor?? [ 880.975598][T16236] batadv_slave_1: entered promiscuous mode [ 881.456567][T16210] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2719'. [ 881.940353][ T10] usb 1-1: USB disconnect, device number 55 [ 882.629523][ T1210] usb 4-1: new full-speed USB device number 80 using dummy_hcd [ 882.784216][ T1210] usb 4-1: config 0 has an invalid interface number: 231 but max is 0 [ 882.792724][ T1210] usb 4-1: config 0 has no interface number 0 [ 882.800986][ T1210] usb 4-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 882.843901][ T1210] usb 4-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 883.005467][ T1210] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 883.106099][ T1210] usb 4-1: Product: syz [ 883.123874][ T1210] usb 4-1: Manufacturer: syz [ 883.130768][ T1210] usb 4-1: SerialNumber: syz [ 883.140940][ T1210] usb 4-1: config 0 descriptor?? [ 883.161739][T16253] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 883.493566][ T1210] plusb 4-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.3-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, b6:70:be:bd:c2:fa [ 883.526089][T16253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 883.551847][T16253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 883.584100][ T1210] usb 4-1: USB disconnect, device number 80 [ 883.600308][ T1210] plusb 4-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.3-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 884.249058][ T24] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 884.490593][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 884.504274][ T24] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 884.518923][ T24] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 884.528891][ T24] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 884.538390][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 885.103078][ T24] usb 6-1: config 0 descriptor?? [ 885.287195][T16305] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2741'. [ 885.925055][T16319] netlink: 512 bytes leftover after parsing attributes in process `syz.4.2745'. [ 885.992998][ T1210] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 886.239716][ T51] block nbd33: Receive control failed (result -32) [ 886.311087][T16325] ip6t_rpfilter: unknown options [ 886.393010][ T1210] usb 1-1: Using ep0 maxpacket: 32 [ 886.399532][ T1210] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 886.428038][ T1210] usb 1-1: config 0 has no interface number 0 [ 886.473226][ T1210] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 886.492502][ T1210] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 886.506351][ T1210] usb 1-1: Product: syz [ 886.513335][ T1210] usb 1-1: Manufacturer: syz [ 886.526303][ T1210] usb 1-1: SerialNumber: syz [ 886.536047][ T1210] usb 1-1: config 0 descriptor?? [ 886.801629][ T24] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 886.947461][T16343] netlink: 256 bytes leftover after parsing attributes in process `syz.3.2749'. [ 887.760832][ T5861] usb 6-1: USB disconnect, device number 48 [ 887.929068][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 888.119243][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 888.190704][ T24] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 888.229384][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 888.368812][ T24] usb 3-1: config 0 descriptor?? [ 888.387501][ T24] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 889.324257][ T1210] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 889.348820][ T1210] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 889.426800][ T29] audit: type=1400 audit(2000000321.658:986): avc: denied { setopt } for pid=16358 comm="syz.5.2754" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 889.539198][T16361] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 889.558693][T16361] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 889.569434][ T1210] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 889.597167][ T1210] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -61 [ 890.283296][ T1210] usb 1-1: USB disconnect, device number 56 [ 890.445840][T16367] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2755'. [ 890.908823][ T10] libceph: connect (1)[c::]:6789 error -22 [ 890.955278][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 891.275361][ T10] libceph: connect (1)[c::]:6789 error -22 [ 891.340207][T16370] ceph: No mds server is up or the cluster is laggy [ 891.438596][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 891.460885][ T24] usb 3-1: USB disconnect, device number 85 [ 891.624418][T16383] wg2: Caught tx_queue_len zero misconfig [ 891.691828][ T51] block nbd34: Receive control failed (result -32) [ 891.713805][T16385] ip6t_rpfilter: unknown options [ 891.793231][T13780] Bluetooth: (null): Invalid header checksum [ 891.901412][T13780] Bluetooth: (null): Invalid header checksum [ 892.072176][T13780] Bluetooth: (null): Invalid header checksum [ 892.124826][T13780] Bluetooth: (null): Invalid header checksum [ 893.505306][T16411] sock: sock_timestamping_bind_phc: sock not bind to device [ 894.239719][T16414] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 894.429178][T16420] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 894.489906][T14086] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 894.512637][T16426] Device name cannot be null; rc = [-22] [ 894.788628][T14086] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 894.844119][T14086] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 894.882560][T14086] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 894.894312][T14086] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 894.922070][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 894.931437][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 894.939934][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 894.957468][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 894.968621][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 895.175743][T16414] Device name cannot be null; rc = [-22] [ 895.279923][ T10] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 895.433263][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 895.465792][ T10] usb 6-1: config 0 has an invalid descriptor of length 42, skipping remainder of the config [ 895.513303][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 895.533073][T16424] chnl_net:caif_netlink_parms(): no params data found [ 895.568809][ T1210] IPVS: starting estimator thread 0... [ 895.588917][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 895.629401][ T10] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 895.668612][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 895.682311][T16444] IPVS: using max 55 ests per chain, 132000 per kthread [ 895.752681][ T10] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 895.768983][T16424] bridge0: port 1(bridge_slave_0) entered blocking state [ 895.782112][ T10] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 895.792989][T16424] bridge0: port 1(bridge_slave_0) entered disabled state [ 895.807034][ T10] usb 6-1: Manufacturer: syz [ 895.812384][T16424] bridge_slave_0: entered allmulticast mode [ 895.826496][ T10] usb 6-1: config 0 descriptor?? [ 895.844988][T16424] bridge_slave_0: entered promiscuous mode [ 895.871349][T16424] bridge0: port 2(bridge_slave_1) entered blocking state [ 895.878720][T16424] bridge0: port 2(bridge_slave_1) entered disabled state [ 895.886076][T16424] bridge_slave_1: entered allmulticast mode [ 895.897776][T16424] bridge_slave_1: entered promiscuous mode [ 896.214251][T16424] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 896.290729][T16454] overlayfs: failed to clone upperpath [ 896.368101][T16455] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2774'. [ 896.910784][T14086] Bluetooth: hci0: command tx timeout [ 897.110021][T16424] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 897.342852][ T10] rc_core: IR keymap rc-hauppauge not found [ 897.375249][ T10] Registered IR keymap rc-empty [ 897.387732][T16424] team0: Port device team_slave_0 added [ 897.414153][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 897.444822][T16424] team0: Port device team_slave_1 added [ 897.464304][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 897.531011][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 897.741593][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 897.779159][T16458] sock: sock_timestamping_bind_phc: sock not bind to device [ 897.797937][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input67 [ 897.814941][T16424] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 897.828691][T16424] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 897.864315][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 897.881170][T16424] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 897.892022][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 897.917971][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 897.936972][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 897.948543][T16424] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 897.956080][T16424] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 897.983105][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 898.029467][T16424] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 898.040501][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 898.061114][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 898.100408][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 898.175365][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 898.204070][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 898.234494][ T10] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 898.340341][ T10] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 898.448215][ T10] usb 6-1: USB disconnect, device number 49 [ 898.465446][T16424] hsr_slave_0: entered promiscuous mode [ 898.535080][ T1210] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 898.537929][T16424] hsr_slave_1: entered promiscuous mode [ 898.803712][T16424] debugfs: 'hsr0' already exists in 'hsr' [ 898.819557][T16424] Cannot create hsr debugfs directory [ 898.892217][T14086] Bluetooth: hci0: command tx timeout [ 898.928056][ T1210] usb 1-1: Using ep0 maxpacket: 32 [ 898.936731][ T1210] usb 1-1: unable to get BOS descriptor or descriptor too short [ 898.946501][ T1210] usb 1-1: config 1 has an invalid descriptor of length 101, skipping remainder of the config [ 898.972975][ T1210] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 898.998924][ T1210] usb 1-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 899.013555][ T1210] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.023474][ T1210] usb 1-1: Product: syz [ 899.029020][ T1210] usb 1-1: Manufacturer: syz [ 899.045259][ T1210] usb 1-1: SerialNumber: syz [ 899.470832][ T24] libceph: connect (1)[c::]:6789 error -22 [ 899.480423][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 899.632301][T16424] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 899.723469][T16487] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 899.735957][T16487] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 899.746805][ T24] libceph: connect (1)[c::]:6789 error -22 [ 899.765363][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 899.967954][T16482] ceph: No mds server is up or the cluster is laggy [ 900.000560][ T24] libceph: connect (1)[c::]:6789 error -22 [ 900.010205][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 900.240708][T16424] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 900.273665][ T5861] libceph: connect (1)[c::]:6789 error -22 [ 900.279765][ T5861] libceph: mon0 (1)[c::]:6789 connect error [ 900.381511][T16424] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 900.526571][T16491] ceph: No mds server is up or the cluster is laggy [ 900.550613][T16424] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 900.872981][T14086] Bluetooth: hci0: command tx timeout [ 900.926656][T16504] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 901.298172][T16424] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 901.410169][T16424] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 901.556271][T16424] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 901.614291][T16511] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2788'. [ 901.709230][ T24] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 902.000255][T16424] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 902.043045][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 902.061649][ T1210] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 902.083568][ T24] usb 4-1: config 0 has an invalid descriptor of length 42, skipping remainder of the config [ 902.122272][ T1210] usb 1-1: MIDIStreaming interface descriptor not found [ 902.124535][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 902.244756][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 902.310907][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 902.312600][ T1210] usb 1-1: USB disconnect, device number 57 [ 902.443217][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 902.475856][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 902.506253][ T24] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 902.516365][T16424] 8021q: adding VLAN 0 to HW filter on device bond0 [ 902.537916][ T24] usb 4-1: Manufacturer: syz [ 902.597252][ T24] usb 4-1: config 0 descriptor?? [ 902.620619][T16424] 8021q: adding VLAN 0 to HW filter on device team0 [ 902.627837][ T58] Bluetooth: (null): Invalid header checksum [ 902.721237][T13780] Bluetooth: (null): Invalid header checksum [ 902.749128][ T29] audit: type=1400 audit(2000000335.652:987): avc: denied { write } for pid=16532 comm="syz.4.2793" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 902.824675][ T7380] Bluetooth: (null): Invalid header checksum [ 902.838707][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 902.845883][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 902.863953][T14086] Bluetooth: hci0: command tx timeout [ 902.867615][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 902.876481][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 902.930317][T13774] Bluetooth: (null): Invalid header checksum [ 902.936629][ T24] rc_core: IR keymap rc-hauppauge not found [ 902.954121][ T24] Registered IR keymap rc-empty [ 902.989584][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.023877][ T1210] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 903.052555][ T1135] Bluetooth: (null): Invalid header checksum [ 903.064646][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.139337][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 903.204363][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input68 [ 903.231505][ T1210] usb 5-1: Using ep0 maxpacket: 32 [ 903.266147][ T1210] usb 5-1: config 0 has an invalid interface number: 172 but max is 0 [ 903.267099][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.312074][ T1210] usb 5-1: config 0 has no interface number 0 [ 903.337700][ T1210] usb 5-1: config 0 interface 172 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 903.382614][ T1210] usb 5-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 903.387264][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.438073][ T1210] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.452597][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.488398][ T1210] usb 5-1: Product: syz [ 903.491193][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.538650][ T1210] usb 5-1: Manufacturer: syz [ 903.550773][ T1210] usb 5-1: SerialNumber: syz [ 903.568551][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.572325][ T1210] usb 5-1: config 0 descriptor?? [ 903.611140][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.642039][ T1210] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 903.668507][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.710631][T16424] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 903.720722][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.758871][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.788403][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 903.833542][ T24] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 903.860964][ T24] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 903.930445][T16424] veth0_vlan: entered promiscuous mode [ 903.974950][ T24] usb 4-1: USB disconnect, device number 81 [ 904.018755][T16424] veth1_vlan: entered promiscuous mode [ 904.110783][T16543] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2794'. [ 904.253428][T16424] veth0_macvtap: entered promiscuous mode [ 904.316105][T16424] veth1_macvtap: entered promiscuous mode [ 904.435310][T16551] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 904.437791][ T1210] input: gspca_pac7302 as /devices/platform/dummy_hcd.4/usb5/5-1/input/input69 [ 904.701113][T16533] netlink: 'syz.4.2793': attribute type 1 has an invalid length. [ 904.992131][ T5861] libceph: connect (1)[c::]:6789 error -22 [ 905.000402][ T29] audit: type=1400 audit(2000000337.993:988): avc: denied { mount } for pid=16550 comm="syz.5.2797" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 905.056813][ T5861] libceph: mon0 (1)[c::]:6789 connect error [ 905.258302][T16424] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 905.313270][T16552] ceph: No mds server is up or the cluster is laggy [ 905.320571][ T5891] libceph: connect (1)[c::]:6789 error -22 [ 905.324663][T16424] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 905.326551][ T5891] libceph: mon0 (1)[c::]:6789 connect error [ 905.370428][ C0] gspca_pac7302 5-1:0.172: URB error -71, resubmitting [ 905.377871][ C0] gspca_pac7302 5-1:0.172: URB error -71, resubmitting [ 905.385100][ C0] gspca_pac7302 5-1:0.172: URB error -71, resubmitting [ 905.392163][ C0] gspca_pac7302 5-1:0.172: URB error -71, resubmitting [ 905.399228][ C0] gspca_pac7302 5-1:0.172: URB error -71, resubmitting [ 905.406081][ C0] gspca_main: Resubmit URB failed with error -19 [ 905.412475][ T1210] usb 5-1: USB disconnect, device number 69 [ 905.453103][ T82] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.477378][ T82] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.521662][ T82] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.597361][ T82] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.867458][T16573] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2800'. [ 906.143708][ T1107] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 906.191182][ T1107] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 906.414926][T13780] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 906.467610][T13780] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 907.055036][T16583] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 907.549526][ T5891] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 908.222100][T16599] netlink: 256 bytes leftover after parsing attributes in process `syz.3.2804'. [ 908.476077][T16600] netlink: 256 bytes leftover after parsing attributes in process `syz.5.2805'. [ 908.894925][ T5891] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 909.882110][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 909.890134][ T5891] usb 5-1: Product: syz [ 909.977537][ T5891] usb 5-1: Manufacturer: syz [ 909.993521][ T5891] usb 5-1: SerialNumber: syz [ 910.012446][ T5891] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 910.107819][ T24] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 910.166934][T16606] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2807'. [ 910.292860][T16609] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2808'. [ 910.740087][ T1210] usb 5-1: USB disconnect, device number 70 [ 910.920937][T16613] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2809'. [ 911.168758][ T24] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 911.206679][ T24] ath9k_htc: Failed to initialize the device [ 911.225618][ T1210] usb 5-1: ath9k_htc: USB layer deinitialized [ 911.587265][T16621] sock: sock_timestamping_bind_phc: sock not bind to device [ 911.993004][T16625] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2812'. [ 912.183784][T16629] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 912.324317][T16629] batadv1: entered allmulticast mode [ 912.759072][T16629] team0: Port device batadv1 added [ 912.951116][T16643] FAULT_INJECTION: forcing a failure. [ 912.951116][T16643] name failslab, interval 1, probability 0, space 0, times 0 [ 912.963806][T16643] CPU: 0 UID: 0 PID: 16643 Comm: syz.5.2814 Tainted: G L syzkaller #0 PREEMPT(full) [ 912.963824][T16643] Tainted: [L]=SOFTLOCKUP [ 912.963828][T16643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 912.963834][T16643] Call Trace: [ 912.963839][T16643] [ 912.963843][T16643] dump_stack_lvl+0x100/0x190 [ 912.963865][T16643] should_fail_ex.cold+0x5/0xa [ 912.963880][T16643] should_failslab+0xc2/0x120 [ 912.963891][T16643] __kmalloc_cache_node_noprof+0x7d/0x770 [ 912.963909][T16643] ? __get_vm_area_node+0x101/0x330 [ 912.963924][T16643] __get_vm_area_node+0x101/0x330 [ 912.963935][T16643] ? __lock_acquire+0x4a5/0x2630 [ 912.963947][T16643] __vmalloc_node_range_noprof+0x213/0x1530 [ 912.963961][T16643] ? sel_write_load+0x230/0x560 [ 912.963983][T16643] ? sel_write_load+0x230/0x560 [ 912.963997][T16643] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 912.964010][T16643] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 912.964023][T16643] ? avc_has_perm_noaudit+0x145/0x3b0 [ 912.964037][T16643] ? __pfx_avc_has_perm+0x10/0x10 [ 912.964049][T16643] ? sel_write_load+0x230/0x560 [ 912.964061][T16643] __vmalloc_node_noprof+0xad/0xf0 [ 912.964074][T16643] ? sel_write_load+0x230/0x560 [ 912.964088][T16643] sel_write_load+0x230/0x560 [ 912.964101][T16643] ? __pfx_sel_write_load+0x10/0x10 [ 912.964117][T16643] ? __pfx_sel_write_load+0x10/0x10 [ 912.964129][T16643] vfs_writev+0x5ea/0xe10 [ 912.964145][T16643] ? rcu_is_watching+0x12/0xc0 [ 912.964162][T16643] ? __pfx_vfs_writev+0x10/0x10 [ 912.964177][T16643] ? fdget_pos+0x2aa/0x380 [ 912.964190][T16643] ? find_held_lock+0x2b/0x80 [ 912.964213][T16643] ? __fget_files+0x21f/0x3d0 [ 912.964228][T16643] ? do_writev+0x13e/0x340 [ 912.964243][T16643] do_writev+0x13e/0x340 [ 912.964259][T16643] ? __pfx_do_writev+0x10/0x10 [ 912.964280][T16643] do_syscall_64+0x106/0xf80 [ 912.964294][T16643] ? clear_bhb_loop+0x40/0x90 [ 912.964308][T16643] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.964320][T16643] RIP: 0033:0x7f7621f9c799 [ 912.964330][T16643] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 912.964341][T16643] RSP: 002b:00007f76201f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 912.964353][T16643] RAX: ffffffffffffffda RBX: 00007f7622215fa0 RCX: 00007f7621f9c799 [ 912.964360][T16643] RDX: 0000000000000002 RSI: 0000200000000400 RDI: 0000000000000005 [ 912.964366][T16643] RBP: 00007f76201f6090 R08: 0000000000000000 R09: 0000000000000000 [ 912.964373][T16643] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 912.964379][T16643] R13: 00007f7622216038 R14: 00007f7622215fa0 R15: 00007ffdabef46f8 [ 912.964394][T16643] [ 912.964545][T16643] syz.5.2814: vmalloc error: size 56, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz5,mems_allowed=0-1 [ 913.244898][T16643] CPU: 0 UID: 0 PID: 16643 Comm: syz.5.2814 Tainted: G L syzkaller #0 PREEMPT(full) [ 913.244918][T16643] Tainted: [L]=SOFTLOCKUP [ 913.244922][T16643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 913.244929][T16643] Call Trace: [ 913.244933][T16643] [ 913.244938][T16643] dump_stack_lvl+0x100/0x190 [ 913.244960][T16643] warn_alloc.cold+0x95/0x1c1 [ 913.244986][T16643] ? __pfx_warn_alloc+0x10/0x10 [ 913.245001][T16643] ? trace_kmalloc+0x101/0x130 [ 913.245013][T16643] ? __kmalloc_cache_node_noprof+0x2d9/0x770 [ 913.245032][T16643] ? __kasan_kmalloc+0x8a/0xb0 [ 913.245050][T16643] ? __get_vm_area_node+0x208/0x330 [ 913.245069][T16643] __vmalloc_node_range_noprof+0xbf4/0x1530 [ 913.245087][T16643] ? sel_write_load+0x230/0x560 [ 913.245102][T16643] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 913.245115][T16643] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 913.245128][T16643] ? avc_has_perm_noaudit+0x145/0x3b0 [ 913.245142][T16643] ? __pfx_avc_has_perm+0x10/0x10 [ 913.245154][T16643] ? sel_write_load+0x230/0x560 [ 913.245166][T16643] __vmalloc_node_noprof+0xad/0xf0 [ 913.245179][T16643] ? sel_write_load+0x230/0x560 [ 913.245192][T16643] sel_write_load+0x230/0x560 [ 913.245205][T16643] ? __pfx_sel_write_load+0x10/0x10 [ 913.245222][T16643] ? __pfx_sel_write_load+0x10/0x10 [ 913.245233][T16643] vfs_writev+0x5ea/0xe10 [ 913.245249][T16643] ? rcu_is_watching+0x12/0xc0 [ 913.245266][T16643] ? __pfx_vfs_writev+0x10/0x10 [ 913.245281][T16643] ? fdget_pos+0x2aa/0x380 [ 913.245295][T16643] ? find_held_lock+0x2b/0x80 [ 913.245318][T16643] ? __fget_files+0x21f/0x3d0 [ 913.245333][T16643] ? do_writev+0x13e/0x340 [ 913.245348][T16643] do_writev+0x13e/0x340 [ 913.245365][T16643] ? __pfx_do_writev+0x10/0x10 [ 913.245385][T16643] do_syscall_64+0x106/0xf80 [ 913.245400][T16643] ? clear_bhb_loop+0x40/0x90 [ 913.245414][T16643] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.245426][T16643] RIP: 0033:0x7f7621f9c799 [ 913.245436][T16643] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 913.245446][T16643] RSP: 002b:00007f76201f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 913.245461][T16643] RAX: ffffffffffffffda RBX: 00007f7622215fa0 RCX: 00007f7621f9c799 [ 913.245470][T16643] RDX: 0000000000000002 RSI: 0000200000000400 RDI: 0000000000000005 [ 913.245476][T16643] RBP: 00007f76201f6090 R08: 0000000000000000 R09: 0000000000000000 [ 913.245482][T16643] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 913.245489][T16643] R13: 00007f7622216038 R14: 00007f7622215fa0 R15: 00007ffdabef46f8 [ 913.245503][T16643] [ 913.245507][T16643] Mem-Info: [ 913.510161][T16643] active_anon:64662 inactive_anon:0 isolated_anon:0 [ 913.510161][T16643] active_file:11925 inactive_file:51275 isolated_file:0 [ 913.510161][T16643] unevictable:768 dirty:293 writeback:0 [ 913.510161][T16643] slab_reclaimable:11058 slab_unreclaimable:119329 [ 913.510161][T16643] mapped:37062 shmem:55828 pagetables:2490 [ 913.510161][T16643] sec_pagetables:0 bounce:0 [ 913.510161][T16643] kernel_misc_reclaimable:0 [ 913.510161][T16643] free:1200996 free_pcp:19511 free_cma:0 [ 913.555744][T16643] Node 0 active_anon:258648kB inactive_anon:0kB active_file:47648kB inactive_file:204796kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:148128kB dirty:1164kB writeback:0kB shmem:221776kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15024kB pagetables:9828kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 913.587857][T16643] Node 1 active_anon:0kB inactive_anon:0kB active_file:52kB inactive_file:304kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120kB dirty:8kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 913.618255][T16643] Node 0 DMA free:15352kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 913.648106][T16643] lowmem_reserve[]: 0 2477 2478 2478 2478 [ 913.653829][T16643] Node 0 DMA32 free:846688kB boost:0kB min:34056kB low:42568kB high:51080kB reserved_highatomic:0KB free_highatomic:0KB active_anon:258648kB inactive_anon:0kB active_file:47648kB inactive_file:204796kB unevictable:1536kB writepending:1164kB zspages:0kB present:3129332kB managed:2537156kB mlocked:0kB bounce:0kB free_pcp:67640kB local_pcp:31344kB free_cma:0kB [ 913.687396][T16643] lowmem_reserve[]: 0 0 1 1 1 [ 913.692092][T16643] Node 0 Normal free:4kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1048kB mlocked:0kB bounce:0kB free_pcp:28kB local_pcp:4kB free_cma:0kB [ 913.721759][T16643] lowmem_reserve[]: 0 0 0 0 0 [ 913.726544][T16643] Node 1 Normal free:3941940kB boost:0kB min:55832kB low:69788kB high:83744kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:52kB inactive_file:304kB unevictable:1536kB writepending:8kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:10352kB local_pcp:6120kB free_cma:0kB [ 913.760412][T16643] lowmem_reserve[]: 0 0 0 0 0 [ 913.765121][T16643] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 2*4096kB (M) = 15352kB [ 913.780267][T16643] Node 0 DMA32: 4253*4kB (UM) 4338*8kB (UME) 2157*16kB (UME) 168*32kB (UME) 623*64kB (UME) 516*128kB (UME) 524*256kB (UME) 344*512kB (UME) 193*1024kB (UM) 49*2048kB (UM) 10*4096kB (UM) = 846740kB [ 913.799692][T16643] Node 0 Normal: 1*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 913.811497][T16643] Node 1 Normal: 8*4kB (UM) 11*8kB (UM) 13*16kB (UM) 3*32kB (UM) 11*64kB (UM) 10*128kB (UM) 11*256kB (UM) 7*512kB (UM) 7*1024kB (UM) 3*2048kB (UM) 957*4096kB (UM) = 3941992kB [ 913.828949][T16643] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 913.838519][T16643] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 913.847801][T16643] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 913.857347][T16643] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 913.918571][T16643] 118531 total pagecache pages [ 913.923382][T16643] 0 pages in swap cache [ 913.927517][T16643] Free swap = 124996kB [ 913.931705][T16643] Total swap = 124996kB [ 913.935836][T16643] 2097051 pages RAM [ 913.939622][T16643] 0 pages HighMem/MovableOnly [ 913.944381][T16643] 430885 pages reserved [ 913.948512][T16643] 0 pages cma reserved [ 914.341655][T16655] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2820'. [ 916.673786][T16668] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2823'. [ 917.319067][T16666] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2823'. [ 917.560338][ T24] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 918.236741][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 918.266749][ T24] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 918.312214][ T24] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 918.336292][ T24] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 918.348304][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 918.445708][ T24] usb 1-1: config 0 descriptor?? [ 918.780014][T13774] Bluetooth: (null): Invalid header checksum [ 918.887461][ T58] Bluetooth: (null): Invalid header checksum [ 919.084418][ T58] Bluetooth: (null): Invalid header checksum [ 919.129315][ T58] Bluetooth: (null): Invalid header checksum [ 919.213468][ T1107] Bluetooth: (null): Invalid header checksum [ 919.949665][ T29] audit: type=1400 audit(2000000353.341:989): avc: denied { relabelfrom } for pid=16708 comm="syz.5.2835" name="" dev="pipefs" ino=63156 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 920.217962][ T5861] usb 1-1: USB disconnect, device number 58 [ 920.963085][T16726] netlink: 84 bytes leftover after parsing attributes in process `syz.5.2838'. [ 921.076202][T16726] vlan0: entered promiscuous mode [ 921.676919][ T10] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 921.686710][T16741] netlink: 'syz.4.2845': attribute type 33 has an invalid length. [ 921.725902][T16741] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2845'. [ 921.856186][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 922.793890][ T10] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 922.829766][ T10] usb 4-1: config 179 has no interface number 0 [ 922.857436][ T10] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 922.904371][ T10] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 922.951667][ T10] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 922.971153][ T10] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 923.019155][ T10] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 923.037393][T10945] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 923.098590][ T10] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 923.132688][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 923.154662][T16735] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 923.428758][T10945] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 923.438453][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input70 [ 923.471153][T10945] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.680540][T10945] usb 3-1: Product: syz [ 923.692425][T16761] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2849'. [ 924.046933][T10945] usb 3-1: Manufacturer: syz [ 924.132518][T10945] usb 3-1: SerialNumber: syz [ 924.138135][ T29] audit: type=1400 audit(2000000358.076:990): avc: denied { connect } for pid=16734 comm="syz.3.2843" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 924.158795][T16751] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2848'. [ 924.360795][T16771] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 924.845753][T16776] Device name cannot be null; rc = [-22] [ 925.145609][T10945] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 925.206627][T10945] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 925.267497][T10945] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 925.395583][T10945] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 925.582148][T10945] usb 3-1: USB disconnect, device number 86 [ 926.402472][T16791] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 926.540900][T16794] Device name cannot be null; rc = [-22] [ 926.950049][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 926.950050][ T5861] usb 4-1: USB disconnect, device number 82 [ 926.964531][ C0] dummy_hcd dummy_hcd.3: timer fired with no URBs pending? [ 927.905727][T14086] block nbd35: Receive control failed (result -32) [ 929.819746][ T24] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 929.997321][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 930.031469][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 930.076780][ T24] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 930.126956][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.235635][ T24] usb 3-1: config 0 descriptor?? [ 930.261504][ T24] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 931.383046][T16844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 931.423915][T16844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 931.445156][T16846] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 931.786854][T16855] input: syz1 as /devices/virtual/input/input72 [ 933.417731][ T5861] usb 3-1: USB disconnect, device number 87 [ 933.576836][ T29] audit: type=1400 audit(2000000368.007:991): avc: denied { mounton } for pid=16881 comm="syz.5.2881" path="/syzcgroup/unified/syz5" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:devpts_t tclass=dir permissive=1 [ 934.270280][T16894] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2885'. [ 934.302503][T16894] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2885'. [ 934.321013][T16895] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2885'. [ 934.443206][T14086] block nbd36: Receive control failed (result -32) [ 936.025010][T16912] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2889'. [ 938.288246][T16942] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 939.416627][T16944] Device name cannot be null; rc = [-22] [ 940.911625][T16965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 940.947224][T16965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 941.052402][T16965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 941.094819][T16965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 941.109065][T16965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 941.122652][T16965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 941.135965][ T24] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 941.138692][T16965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 941.189484][T16965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 941.208103][T16965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 941.304842][T16965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 941.406216][ T24] usb 4-1: device descriptor read/64, error -71 [ 941.850657][T16977] nfs: Unknown parameter 'ÿÿÿÿ' [ 941.873184][T16977] comedi comedi0: comedi_config --init_data is deprecated [ 941.917460][ T24] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 942.194775][ T24] usb 4-1: device descriptor read/64, error -71 [ 942.298601][ T24] usb usb4-port1: attempt power cycle [ 942.669558][ T24] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 942.756975][ T82] Bluetooth: (null): Invalid header checksum [ 942.832584][ T24] usb 4-1: device descriptor read/8, error -71 [ 942.874232][T13779] Bluetooth: (null): Invalid header checksum [ 943.069957][ T24] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 943.117566][ T24] usb 4-1: device descriptor read/8, error -71 [ 943.222249][ T24] usb usb4-port1: unable to enumerate USB device [ 943.358895][T16990] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2913'. [ 944.390930][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 944.408962][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 944.417844][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 944.426825][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 944.446292][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 945.646372][T17023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2921'. [ 945.664969][T17023] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2921'. [ 945.705097][ T29] audit: type=1400 audit(2000000380.741:992): avc: denied { ioctl } for pid=17022 comm="syz.3.2921" path="socket:[64956]" dev="sockfs" ino=64956 ioctlcmd=0x89e3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 945.705533][T17026] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 945.759038][T17005] chnl_net:caif_netlink_parms(): no params data found [ 945.836951][T17025] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1710750076 (109488004864 ns) > initial count (85602871552 ns). Using initial count to start timer. [ 945.864568][ T29] audit: type=1400 audit(2000000380.741:993): avc: denied { read } for pid=17022 comm="syz.3.2921" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 946.361295][T17005] bridge0: port 1(bridge_slave_0) entered blocking state [ 946.386148][T17005] bridge0: port 1(bridge_slave_0) entered disabled state [ 946.414738][T17005] bridge_slave_0: entered allmulticast mode [ 946.434471][T17005] bridge_slave_0: entered promiscuous mode [ 946.444402][ T5891] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 946.453094][ T51] Bluetooth: hci2: command tx timeout [ 946.463437][T17005] bridge0: port 2(bridge_slave_1) entered blocking state [ 946.481749][T17005] bridge0: port 2(bridge_slave_1) entered disabled state [ 946.498858][ T5861] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 946.508942][T17005] bridge_slave_1: entered allmulticast mode [ 946.525951][T17005] bridge_slave_1: entered promiscuous mode [ 946.587058][T17005] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 946.614124][T17005] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 946.632739][ T5891] usb 6-1: Using ep0 maxpacket: 16 [ 946.651967][ T5891] usb 6-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=ba.be [ 946.665735][ T5861] usb 4-1: unable to get BOS descriptor or descriptor too short [ 946.683398][ T5891] usb 6-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 946.703230][ T5861] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 946.718079][ T5891] usb 6-1: Product: syz [ 946.722268][ T5891] usb 6-1: Manufacturer: syz [ 946.737171][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 946.738888][T17005] team0: Port device team_slave_0 added [ 946.745196][ T5861] usb 4-1: Product: syz [ 946.765866][ T5891] usb 6-1: SerialNumber: syz [ 946.793276][ T5891] usb 6-1: config 0 descriptor?? [ 946.803418][ T5861] usb 4-1: Manufacturer: syz [ 946.810168][T17005] team0: Port device team_slave_1 added [ 946.828540][ T5861] usb 4-1: SerialNumber: syz [ 946.901503][T17005] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 946.926006][T17005] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 946.981155][T17005] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 946.995533][T17005] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 947.015577][T17005] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 947.041636][ T5891] peak_usb 6-1:0.0: PEAK-System PCAN-Chip USB v0 fw v0.0.0 (1 channels) [ 947.042014][T17005] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 947.079020][T17034] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 947.086774][T17034] IPv6: NLM_F_CREATE should be set when creating new route [ 947.129553][T17050] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51 sclass=netlink_route_socket pid=17050 comm=syz.3.2924 [ 947.139835][T17005] hsr_slave_0: entered promiscuous mode [ 947.152289][T17005] hsr_slave_1: entered promiscuous mode [ 947.177652][T17005] debugfs: 'hsr0' already exists in 'hsr' [ 947.192665][T17005] Cannot create hsr debugfs directory [ 947.214875][ T5861] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 947.233023][ T5891] peak_usb 6-1:0.0 can0: sending command failure: -22 [ 947.239854][ T5891] peak_usb 6-1:0.0 can0: sending command failure: -22 [ 947.251672][ T5861] usb 4-1: unit 13 not found! [ 947.278883][ T5891] peak_usb 6-1:0.0 can0: sending command failure: -22 [ 947.346763][ T1210] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 947.347923][ T5891] peak_usb 6-1:0.0: probe with driver peak_usb failed with error -22 [ 947.366260][ T5861] usb 4-1: USB disconnect, device number 87 [ 947.372182][T17053] xt_hashlimit: size too large, truncated to 1048576 [ 947.429161][T10945] usb 6-1: USB disconnect, device number 51 [ 947.500333][ T1210] usb 3-1: Using ep0 maxpacket: 16 [ 947.520201][ T1210] usb 3-1: unable to get BOS descriptor or descriptor too short [ 947.533248][ T1210] usb 3-1: config 198 has an invalid descriptor of length 0, skipping remainder of the config [ 947.550467][ T1210] usb 3-1: New USB device found, idVendor=0867, idProduct=9812, bcdDevice=58.84 [ 947.585960][T13702] udevd[13702]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 947.615585][ T1210] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.638944][ T1210] usb 3-1: Product: syz [ 947.665654][ T1210] usb 3-1: Manufacturer: syz [ 947.670297][ T1210] usb 3-1: SerialNumber: syz [ 947.687088][T17005] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 947.815999][T17005] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 947.886650][T17005] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 947.925982][ T1210] comedi comedi5: Wrong number of endpoints [ 947.935663][ T1210] dt9812 3-1:198.0: driver 'dt9812' failed to auto-configure device. [ 947.971702][ T1210] usb 3-1: USB disconnect, device number 88 [ 947.999271][T17005] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 948.436514][ T51] Bluetooth: hci2: command tx timeout [ 948.499461][ T29] audit: type=1400 audit(2000000383.649:994): avc: denied { getopt } for pid=17060 comm="syz.5.2931" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 948.862359][T17005] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 948.926602][T17005] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 948.952269][T17005] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 948.984495][T17005] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 949.091593][T17076] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2936'. [ 949.100749][ T5891] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 949.442442][ T5891] usb 4-1: Using ep0 maxpacket: 8 [ 949.454915][ T5891] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 949.466101][ T5891] usb 4-1: config 179 has no interface number 0 [ 949.486655][ T51] block nbd37: Receive control failed (result -32) [ 949.514275][ T5891] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 949.537765][ T5891] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 949.550640][ T5891] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 949.563486][ T5891] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 949.581798][ T5891] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 949.595610][ T5891] usb 4-1: config 179 interface 65 has no altsetting 0 [ 949.615455][ T5891] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 949.641539][ T5891] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 949.703049][T17005] 8021q: adding VLAN 0 to HW filter on device bond0 [ 949.758788][ T5891] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input73 [ 949.779096][T17005] 8021q: adding VLAN 0 to HW filter on device team0 [ 949.840388][ T1107] bridge0: port 1(bridge_slave_0) entered blocking state [ 949.847562][ T1107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 949.963715][ T82] bridge0: port 2(bridge_slave_1) entered blocking state [ 949.970955][ T82] bridge0: port 2(bridge_slave_1) entered forwarding state [ 950.390355][T17094] netlink: 256 bytes leftover after parsing attributes in process `syz.5.2940'. [ 950.419481][ T51] Bluetooth: hci2: command tx timeout [ 951.886813][T17005] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 952.020237][T17005] veth0_vlan: entered promiscuous mode [ 952.084457][T17005] veth1_vlan: entered promiscuous mode [ 952.130701][T17005] veth0_macvtap: entered promiscuous mode [ 952.148509][ T1210] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 952.232167][T17005] veth1_macvtap: entered promiscuous mode [ 952.246113][T17104] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2943'. [ 952.300998][ T1210] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 952.324516][ T1210] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 952.344352][T17005] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 952.345908][ T1210] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 952.363337][ T1210] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 952.371028][T17005] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 952.396283][ T51] Bluetooth: hci2: command tx timeout [ 952.522325][ T1210] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 952.533947][ T1210] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 952.543458][ T1107] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 952.553254][ T1107] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 952.937651][ T1210] usb 6-1: Product: syz [ 952.944398][ T1135] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 952.948370][ T1210] usb 6-1: Manufacturer: syz [ 952.955471][ T1135] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 952.976637][ T1210] cdc_wdm 6-1:1.0: skipping garbage [ 952.981969][ T1210] cdc_wdm 6-1:1.0: probe with driver cdc_wdm failed with error -22 [ 953.074947][T13774] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 953.098031][T13774] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 953.123869][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 953.133014][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 953.393324][T17100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 953.541925][T17100] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 953.682159][ T5921] usb 6-1: USB disconnect, device number 52 [ 953.830372][T17113] SELinux: failed to load policy [ 954.416118][ T29] audit: type=1326 audit(2000000389.885:995): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17128 comm="syz.5.2949" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7621f9c799 code=0x0 [ 954.470874][T17126] IPv6: sit1: Disabled Multicast RS [ 954.691078][T17135] fuse: Bad value for 'group_id' [ 954.696184][T17135] fuse: Bad value for 'group_id' [ 954.866855][ T5861] usb 4-1: USB disconnect, device number 88 [ 954.872932][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 955.040684][ T5921] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 955.616938][ T5921] usb 6-1: Using ep0 maxpacket: 8 [ 955.694369][ T5921] usb 6-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=30.62 [ 955.710571][ T5921] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 955.748379][ T5921] usb 6-1: Product: syz [ 955.758168][ T5921] usb 6-1: Manufacturer: syz [ 955.776793][ T5921] usb 6-1: SerialNumber: syz [ 955.803043][ T5921] usb 6-1: config 0 descriptor?? [ 955.830991][ T5921] usb 6-1: selecting invalid altsetting 3 [ 955.859763][ T5921] comedi comedi5: could not set alternate setting 3 in high speed [ 955.872525][ T5921] usbdux 6-1:0.0: driver 'usbdux' failed to auto-configure device. [ 955.914061][ T5921] usbdux 6-1:0.0: probe with driver usbdux failed with error -22 [ 956.049236][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 956.219847][T17158] ./cgroup: Can't lookup blockdev [ 956.794610][ T1210] usb 3-1: new full-speed USB device number 89 using dummy_hcd [ 957.137430][ T1210] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 957.156392][ T1210] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 957.177849][ T1210] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 957.207469][ T1210] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 957.287727][ T5921] usb 6-1: USB disconnect, device number 53 [ 957.441741][ T1210] usb 3-1: usb_control_msg returned -32 [ 957.533327][ T1210] usbtmc 3-1:16.0: can't read capabilities [ 957.773928][T17163] SELinux: Context system_u:object_r:systemd_logger_exec_t:s0 is not valid (left unmapped). [ 957.860198][ T29] audit: type=1400 audit(2000000393.412:996): avc: denied { relabelto } for pid=17157 comm="syz.2.2957" name="38" dev="tmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_logger_exec_t:s0" [ 957.932391][ T29] audit: type=1400 audit(2000000393.412:997): avc: denied { associate } for pid=17157 comm="syz.2.2957" name="38" dev="tmpfs" ino=208 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:systemd_logger_exec_t:s0" [ 957.960657][T17185] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2961'. [ 958.832259][ T29] audit: type=1400 audit(2000000394.514:998): avc: denied { getopt } for pid=17175 comm="syz.3.2960" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 958.972529][T17189] program syz.3.2964 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 959.053761][ T24] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 959.095611][ T5891] usb 3-1: USB disconnect, device number 89 [ 959.205929][ T29] audit: type=1400 audit(2000000394.903:999): avc: denied { remove_name } for pid=16424 comm="syz-executor" name="binderfs" dev="tmpfs" ino=212 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_logger_exec_t:s0" [ 959.215726][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 959.256904][ T24] usb 1-1: config 0 has an invalid descriptor of length 222, skipping remainder of the config [ 959.271244][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 959.282114][ T29] audit: type=1400 audit(2000000394.945:1000): avc: denied { rmdir } for pid=16424 comm="syz-executor" name="38" dev="tmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:systemd_logger_exec_t:s0" [ 959.356220][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 959.366350][ T24] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 959.410567][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 959.683519][ T24] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 959.728936][ T24] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 959.782992][ T24] usb 1-1: Manufacturer: syz [ 959.858042][ T24] usb 1-1: config 0 descriptor?? [ 960.301483][ T24] rc_core: IR keymap rc-hauppauge not found [ 960.307502][ T24] Registered IR keymap rc-empty [ 960.808775][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 960.877505][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 960.881736][T17224] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2972'. [ 961.013408][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 961.207080][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input74 [ 961.368965][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 961.643663][T17236] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2978'. [ 962.380214][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 962.769029][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 962.791584][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 962.831010][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 962.873218][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 962.887024][ T29] audit: type=1400 audit(2000000398.777:1001): avc: denied { view } for pid=17263 comm="syz.0.2987" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 962.930764][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 962.991290][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 963.285957][T17272] xt_cgroup: path and classid specified [ 963.294908][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 963.332274][ T24] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 963.374382][ T24] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 963.398083][T17272] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 963.419731][ T24] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 963.487258][ T24] usb 1-1: USB disconnect, device number 59 [ 963.549634][ T47] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 963.694319][ T47] usb 6-1: device descriptor read/64, error -71 [ 963.861636][T17292] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(12) [ 963.868277][T17292] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 963.877714][T17292] vhci_hcd vhci_hcd.0: Device attached [ 963.922348][T17140] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 963.940289][ T47] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 963.948018][ T24] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 964.073832][ T47] usb 6-1: device descriptor read/64, error -71 [ 964.082805][T17140] usb 3-1: device descriptor read/64, error -71 [ 964.092424][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 964.099288][ T24] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 964.111772][ T5861] usb 33-1: new low-speed USB device number 3 using vhci_hcd [ 964.292211][ T47] usb usb6-port1: attempt power cycle [ 964.321397][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 964.490912][T17140] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 964.499618][ T24] usb 4-1: config 0 has no interface number 0 [ 964.511210][T17293] vhci_hcd: connection reset by peer [ 964.540606][T13780] vhci_hcd vhci_hcd.0: stop threads [ 964.557310][T13780] vhci_hcd vhci_hcd.0: release socket [ 964.578907][ T24] usb 4-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.17 [ 964.595536][T13780] vhci_hcd vhci_hcd.0: disconnect device [ 964.605864][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 964.625891][ T24] usb 4-1: Product: syz [ 964.626191][T17140] usb 3-1: device descriptor read/64, error -71 [ 964.630071][ T24] usb 4-1: Manufacturer: syz [ 964.691123][ T24] usb 4-1: SerialNumber: syz [ 964.751189][ T24] usb 4-1: config 0 descriptor?? [ 964.767090][T17140] usb usb3-port1: attempt power cycle [ 964.778906][ T24] uvcvideo 4-1:0.105: Found UVC 0.00 device syz (046d:08d3) [ 964.796433][ T24] uvcvideo 4-1:0.105: No valid video chain found. [ 964.817864][ T47] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 964.846995][ T47] usb 6-1: device descriptor read/8, error -71 [ 965.130656][T17140] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 965.151740][T17140] usb 3-1: device descriptor read/8, error -71 [ 965.206603][T17301] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 965.377979][ T47] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 965.397433][T17140] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 965.408918][ T47] usb 6-1: device descriptor read/8, error -71 [ 965.431609][T17301] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 965.468544][T17140] usb 3-1: device descriptor read/8, error -71 [ 965.512367][ T47] usb usb6-port1: unable to enumerate USB device [ 965.620515][T17140] usb usb3-port1: unable to enumerate USB device [ 966.006356][T17312] netlink: 'syz.5.2999': attribute type 1 has an invalid length. [ 966.321443][T17140] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 966.606349][ T47] usb 4-1: USB disconnect, device number 89 [ 968.369679][T17140] usb 5-1: config 0 has no interfaces? [ 968.375387][T17140] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 968.446994][T17140] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 968.572920][T17140] usb 5-1: config 0 descriptor?? [ 969.201594][ T5861] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 970.779076][ T1210] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 970.952580][T17350] x_tables: ip_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 971.065915][ T1210] usb 6-1: Using ep0 maxpacket: 16 [ 971.102677][ T1210] usb 6-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=dd.d4 [ 971.124891][ T1210] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.170337][ T1210] usb 6-1: Product: syz [ 971.174519][ T1210] usb 6-1: Manufacturer: syz [ 971.190312][ T1210] usb 6-1: SerialNumber: syz [ 971.207105][ T1210] usb 6-1: config 0 descriptor?? [ 971.281006][ T1210] usb_ehset_test 6-1:0.0: probe with driver usb_ehset_test failed with error -32 [ 971.477637][T17347] xt_hashlimit: size too large, truncated to 1048576 [ 971.545027][ T29] audit: type=1400 audit(2000000407.868:1002): avc: denied { ioctl } for pid=17345 comm="syz.5.3007" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x7040 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 971.635625][ T1210] usb 6-1: USB disconnect, device number 58 [ 971.833251][T17363] sock: sock_timestamping_bind_phc: sock not bind to device [ 972.313042][T17365] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3011'. [ 972.395258][ T29] audit: type=1400 audit(2000000408.760:1003): avc: denied { listen } for pid=17366 comm="syz.5.3012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 972.430126][ T29] audit: type=1400 audit(2000000408.802:1004): avc: denied { accept } for pid=17366 comm="syz.5.3012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 972.460137][T17365] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 972.469897][T17140] usb 5-1: can't set config #0, error -71 [ 972.526939][T17140] usb 5-1: USB disconnect, device number 71 [ 972.616996][T17365] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 972.618551][T17371] netlink: 348 bytes leftover after parsing attributes in process `syz.4.3013'. [ 973.081493][T17370] ALSA: mixer_oss: invalid OSS volume '' [ 973.240290][T17378] sock: sock_timestamping_bind_phc: sock not bind to device [ 973.764663][ T29] audit: type=1326 audit(2000000410.198:1005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17385 comm="syz.4.3016" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5555b9c799 code=0x0 [ 974.528009][T17408] netlink: 256 bytes leftover after parsing attributes in process `syz.5.3027'. [ 975.360920][T17140] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 975.581719][T17140] usb 3-1: Using ep0 maxpacket: 8 [ 975.600546][T17140] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 975.647351][T17140] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 975.681194][T17140] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 39456, setting to 1024 [ 975.704838][T17140] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 975.738525][T17140] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 975.771549][T17140] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 975.790438][T17140] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 976.894435][T17421] overlayfs: failed to clone upperpath [ 976.914721][T17140] usb 3-1: GET_CAPABILITIES returned 0 [ 976.933779][T17140] usbtmc 3-1:16.0: can't read capabilities [ 976.957804][T17421] netlink: 256 bytes leftover after parsing attributes in process `syz.4.3029'. [ 977.787765][T17140] usb 3-1: USB disconnect, device number 94 [ 977.882535][T17424] tap0: tun_chr_ioctl cmd 1074025678 [ 977.900694][T17424] tap0: group set to 0 [ 978.161744][ T1210] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 978.161957][ T47] usb 1-1: new full-speed USB device number 60 using dummy_hcd [ 978.334097][ T1210] usb 5-1: Using ep0 maxpacket: 32 [ 978.374730][ T47] usb 1-1: not running at top speed; connect to a high speed hub [ 978.657838][ T47] usb 1-1: config 6 has an invalid interface number: 103 but max is 3 [ 978.677731][ T47] usb 1-1: config 6 has an invalid interface number: 20 but max is 3 [ 978.682971][ T1210] usb 5-1: unable to get BOS descriptor or descriptor too short [ 978.723930][ T47] usb 1-1: config 6 has an invalid interface number: 8 but max is 3 [ 978.969210][T17432] FAULT_INJECTION: forcing a failure. [ 978.969210][T17432] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 978.982572][T17432] CPU: 1 UID: 0 PID: 17432 Comm: syz.3.3034 Tainted: G L syzkaller #0 PREEMPT(full) [ 978.982592][T17432] Tainted: [L]=SOFTLOCKUP [ 978.982596][T17432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 978.982603][T17432] Call Trace: [ 978.982607][T17432] [ 978.982611][T17432] dump_stack_lvl+0x100/0x190 [ 978.982634][T17432] should_fail_ex.cold+0x5/0xa [ 978.982649][T17432] _copy_from_user+0x2e/0xd0 [ 978.982661][T17432] copy_msghdr_from_user+0x9f/0x4f0 [ 978.982680][T17432] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 978.982705][T17432] ___sys_sendmsg+0x106/0x1e0 [ 978.982723][T17432] ? __pfx____sys_sendmsg+0x10/0x10 [ 978.982757][T17432] __sys_sendmsg+0x170/0x220 [ 978.982771][T17432] ? __pfx___sys_sendmsg+0x10/0x10 [ 978.982793][T17432] do_syscall_64+0x106/0xf80 [ 978.982808][T17432] ? clear_bhb_loop+0x40/0x90 [ 978.982823][T17432] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 978.982834][T17432] RIP: 0033:0x7f11a059c799 [ 978.982845][T17432] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 978.982856][T17432] RSP: 002b:00007f11a153c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 978.982867][T17432] RAX: ffffffffffffffda RBX: 00007f11a0815fa0 RCX: 00007f11a059c799 [ 978.982875][T17432] RDX: 0000000020004814 RSI: 00002000000003c0 RDI: 0000000000000005 [ 978.982881][T17432] RBP: 00007f11a153c090 R08: 0000000000000000 R09: 0000000000000000 [ 978.982888][T17432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 978.982894][T17432] R13: 00007f11a0816038 R14: 00007f11a0815fa0 R15: 00007ffd3a0743d8 [ 978.982907][T17432] [ 979.163888][ T1210] usb 5-1: config 1 has an invalid descriptor of length 101, skipping remainder of the config [ 979.185989][ T1210] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 979.238697][ T1210] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 979.264959][ T1210] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 979.273239][ T47] usb 1-1: config 6 has an invalid interface number: 38 but max is 3 [ 979.283498][ T47] usb 1-1: config 6 has an invalid interface number: 228 but max is 3 [ 979.291823][ T47] usb 1-1: config 6 contains an unexpected descriptor of type 0x2, skipping [ 979.300617][ T47] usb 1-1: config 6 has 5 interfaces, different from the descriptor's value: 4 [ 979.310313][ T47] usb 1-1: config 6 has no interface number 0 [ 979.316982][ T47] usb 1-1: config 6 has no interface number 1 [ 979.329384][ T47] usb 1-1: config 6 has no interface number 2 [ 979.336527][ T47] usb 1-1: config 6 has no interface number 3 [ 979.339041][ T1210] usb 5-1: Product: syz [ 979.343113][ T47] usb 1-1: config 6 has no interface number 4 [ 979.358601][ T47] usb 1-1: config 6 interface 20 altsetting 15 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 979.372315][ T47] usb 1-1: config 6 interface 20 altsetting 15 has a duplicate endpoint with address 0x1, skipping [ 979.387131][ T1210] usb 5-1: Manufacturer: syz [ 979.391047][ T47] usb 1-1: config 6 interface 20 altsetting 15 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 979.409849][ T47] usb 1-1: config 6 interface 20 altsetting 15 endpoint 0x9 has invalid maxpacket 1024, setting to 64 [ 979.428623][ T1210] usb 5-1: SerialNumber: syz [ 979.452367][ T47] usb 1-1: config 6 interface 20 altsetting 15 endpoint 0xB has invalid wMaxPacketSize 0 [ 979.548984][ T47] usb 1-1: config 6 interface 20 altsetting 15 endpoint 0xC has invalid maxpacket 2047, setting to 64 [ 979.560765][ T47] usb 1-1: config 6 interface 20 altsetting 15 has a duplicate endpoint with address 0x1, skipping [ 979.572783][ T47] usb 1-1: config 6 interface 20 altsetting 15 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 979.584015][ T47] usb 1-1: config 6 interface 8 altsetting 4 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 979.595250][ T47] usb 1-1: config 6 interface 8 altsetting 4 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 979.609583][ T47] usb 1-1: config 6 interface 8 altsetting 4 has a duplicate endpoint with address 0x1, skipping [ 979.633246][ T47] usb 1-1: config 6 interface 38 altsetting 8 has a duplicate endpoint with address 0x9, skipping [ 979.647152][ T47] usb 1-1: config 6 interface 38 altsetting 8 has a duplicate endpoint with address 0xB, skipping [ 979.659384][ T47] usb 1-1: config 6 interface 38 altsetting 8 has a duplicate endpoint with address 0xB, skipping [ 979.701387][ T1107] Bluetooth: (null): Invalid header checksum [ 979.771404][ T47] usb 1-1: config 6 interface 38 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 979.807141][ T1135] Bluetooth: (null): Invalid header checksum [ 979.856276][ T47] usb 1-1: config 6 interface 38 altsetting 8 has a duplicate endpoint with address 0x2, skipping [ 979.911454][ T1135] Bluetooth: (null): Invalid header checksum [ 979.944579][ T47] usb 1-1: config 6 interface 38 altsetting 8 has a duplicate endpoint with address 0xB, skipping [ 980.009125][ T47] usb 1-1: config 6 interface 38 altsetting 8 has 6 endpoint descriptors, different from the interface descriptor's value: 13 [ 980.028399][ T58] Bluetooth: (null): Invalid header checksum [ 980.084118][ T47] usb 1-1: config 6 interface 228 altsetting 161 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 980.130529][ T7373] Bluetooth: (null): Invalid header checksum [ 980.149205][ T47] usb 1-1: config 6 interface 228 altsetting 161 has a duplicate endpoint with address 0x2, skipping [ 980.171384][T17445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 980.204772][ T47] usb 1-1: config 6 interface 228 altsetting 161 has a duplicate endpoint with address 0xC, skipping [ 980.253436][ T47] usb 1-1: config 6 interface 228 altsetting 161 has a duplicate endpoint with address 0xC, skipping [ 980.284438][ T47] usb 1-1: config 6 interface 228 altsetting 161 has a duplicate endpoint with address 0x5, skipping [ 980.314832][ T47] usb 1-1: config 6 interface 228 altsetting 161 has a duplicate endpoint with address 0x9, skipping [ 980.334416][T17445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 980.354795][ T47] usb 1-1: config 6 interface 228 altsetting 161 has a duplicate endpoint with address 0xC, skipping [ 980.378363][ T47] usb 1-1: config 6 interface 228 altsetting 161 has 7 endpoint descriptors, different from the interface descriptor's value: 25 [ 980.480498][ T47] usb 1-1: config 6 interface 103 has no altsetting 0 [ 980.487429][ T47] usb 1-1: config 6 interface 20 has no altsetting 0 [ 980.494120][ T47] usb 1-1: config 6 interface 8 has no altsetting 0 [ 980.596615][ T47] usb 1-1: config 6 interface 38 has no altsetting 0 [ 980.804254][ T47] usb 1-1: config 6 interface 228 has no altsetting 0 [ 980.982393][ T5861] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 981.002625][ T47] usb 1-1: string descriptor 0 read error: -71 [ 981.012365][ T47] usb 1-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice=b9.8f [ 981.036977][ T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.061908][ T47] usb 1-1: can't set config #6, error -71 [ 981.083906][ T47] usb 1-1: USB disconnect, device number 60 [ 981.125852][ T5891] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 981.276765][ T5891] usb 4-1: Using ep0 maxpacket: 32 [ 981.289929][ T5891] usb 4-1: unable to get BOS descriptor or descriptor too short [ 981.301050][ T5891] usb 4-1: config 1 has an invalid descriptor of length 101, skipping remainder of the config [ 981.312796][ T5891] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 981.329560][ T5891] usb 4-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 981.348598][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.359207][ T5891] usb 4-1: Product: syz [ 981.363698][ T5891] usb 4-1: Manufacturer: syz [ 981.372290][ T5891] usb 4-1: SerialNumber: syz [ 981.428976][ T5861] usb 6-1: Using ep0 maxpacket: 32 [ 981.440598][ T5861] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 981.453406][ T5861] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 981.463015][ T5861] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 981.476922][ T5861] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 981.501845][ T5861] usb 6-1: config 0 descriptor?? [ 981.752258][T17459] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 982.081995][T17459] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 982.402024][ T1210] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 982.412773][ T1210] usb 5-1: MIDIStreaming interface descriptor not found [ 982.833142][ T1210] usb 5-1: USB disconnect, device number 72 [ 983.009837][T13700] udevd[13700]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 983.260638][ T47] usb 6-1: USB disconnect, device number 59 [ 983.363757][ T5861] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 983.545177][ T24] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 983.581746][ T5861] usb 1-1: Using ep0 maxpacket: 8 [ 983.588109][ T5861] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 983.598257][ T5861] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 983.688977][T17476] veth0_to_team: entered promiscuous mode [ 983.694817][T17476] veth0_to_team: entered allmulticast mode [ 984.655763][ T5861] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 39456, setting to 1024 [ 984.671197][ T5861] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 984.702129][ T5861] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 984.773456][ T24] usb 3-1: config 1 interface 0 has no altsetting 0 [ 984.823058][T17476] Set syz1 is full, maxelem 6117 reached [ 985.096379][ T5861] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 985.141690][ T24] usb 3-1: string descriptor 0 read error: -22 [ 985.148035][ T5861] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.163018][ T24] usb 3-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.40 [ 985.172057][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 985.214785][T17480] netlink: 52 bytes leftover after parsing attributes in process `syz.5.3048'. [ 985.436418][ T5861] usb 1-1: GET_CAPABILITIES returned 0 [ 985.442922][ T5861] usbtmc 1-1:16.0: can't read capabilities [ 985.469300][T17484] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 985.718000][ C1] usbtmc 1-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 985.765641][T17469] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 985.866168][ T1107] Bluetooth: (null): Invalid header checksum [ 985.879436][ T5861] usb 1-1: USB disconnect, device number 61 [ 985.889114][ T1107] Bluetooth: (null): Invalid header checksum [ 985.905413][T17469] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3044'. [ 985.927741][T17469] netlink: 59 bytes leftover after parsing attributes in process `syz.2.3044'. [ 985.945191][ T1107] Bluetooth: (null): Invalid header checksum [ 985.961141][ T1107] Bluetooth: (null): Invalid header checksum [ 985.970494][T17490] Cannot find set identified by id 0 to match [ 985.980479][T17469] netlink: 59 bytes leftover after parsing attributes in process `syz.2.3044'. [ 986.006421][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.020900][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.030443][T13774] Bluetooth: (null): Invalid header checksum [ 986.048160][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.073765][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.118532][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.132380][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.140877][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.157721][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.177124][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.239872][ T24] holtek 0003:1241:5015.0022: unknown main item tag 0x0 [ 986.324155][ T5891] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 986.493865][ T5891] usb 4-1: MIDIStreaming interface descriptor not found [ 987.471477][ T24] holtek 0003:1241:5015.0022: hidraw0: USB HID vff.7f Device [HID 1241:5015] on usb-dummy_hcd.2-1/input0 [ 987.853193][T17498] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3051'. [ 987.863132][T17498] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3051'. [ 987.999754][ T24] holtek 0003:1241:5015.0022: no inputs found [ 988.016056][ T5891] usb 4-1: USB disconnect, device number 90 [ 988.025751][ T24] usb 3-1: USB disconnect, device number 95 [ 988.429857][T13795] udevd[13795]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 988.528278][T17517] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3057'. [ 988.831920][T17510] sock: sock_timestamping_bind_phc: sock not bind to device [ 989.497235][ T9] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 989.641714][ T9] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 989.651691][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 989.667059][ T9] usb 1-1: config 0 descriptor?? [ 989.714271][ T9] cp210x 1-1:0.0: cp210x converter detected [ 990.311885][ T9] cp210x 1-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 990.779575][ T9] cp210x 1-1:0.0: failed to get vendor val 0x000e size 678: -71 [ 990.787538][ T9] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 990.807478][ T9] usb 1-1: cp210x converter now attached to ttyUSB0 [ 990.858731][ T9] usb 1-1: USB disconnect, device number 62 [ 990.907588][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 990.943859][ T9] cp210x 1-1:0.0: device disconnected [ 990.956541][T17533] batadv_slave_1: entered promiscuous mode [ 990.986374][T17533] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3061'. [ 991.013178][T17531] batadv_slave_1: left promiscuous mode [ 991.687182][T13774] Bluetooth: (null): Invalid header checksum [ 991.695645][T13774] Bluetooth: (null): Invalid header checksum [ 991.707978][T13774] Bluetooth: (null): Invalid header checksum [ 991.729826][T13774] Bluetooth: (null): Invalid header checksum [ 991.745979][ T7380] Bluetooth: (null): Invalid header checksum [ 992.144968][ T5861] libceph: connect (1)[c::]:6789 error -22 [ 992.159561][ T5861] libceph: mon0 (1)[c::]:6789 connect error [ 992.437132][ T5891] libceph: connect (1)[c::]:6789 error -22 [ 992.443210][ T5861] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 992.452408][ T5891] libceph: mon0 (1)[c::]:6789 connect error [ 992.650410][ T5861] usb 1-1: Using ep0 maxpacket: 32 [ 992.682797][T17556] netlink: 52 bytes leftover after parsing attributes in process `syz.5.3066'. [ 992.909473][ T5861] usb 1-1: config 0 has an invalid interface number: 89 but max is 0 [ 992.936321][ T5861] usb 1-1: config 0 has no interface number 0 [ 992.948379][T17543] ceph: No mds server is up or the cluster is laggy [ 992.961648][ T5861] usb 1-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 992.972063][ T24] libceph: connect (1)[c::]:6789 error -22 [ 993.005354][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 993.013672][ T5861] usb 1-1: config 0 interface 89 has no altsetting 0 [ 993.031551][ T5861] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 993.059847][ T5861] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 993.080732][ T5861] usb 1-1: Product: syz [ 993.086361][ T5861] usb 1-1: Manufacturer: syz [ 993.118210][ T5861] usb 1-1: SerialNumber: syz [ 993.189362][ T5861] usb 1-1: config 0 descriptor?? [ 993.225679][ T5861] em28xx 1-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 993.268926][ T5861] em28xx 1-1:0.89: Video interface 89 found: [ 993.478226][ T9] libceph: connect (1)[c::]:6789 error -22 [ 993.608142][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 993.787457][T17574] sock: sock_timestamping_bind_phc: sock not bind to device [ 993.881101][ T9] libceph: connect (1)[c::]:6789 error -22 [ 993.892673][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 993.961208][T17561] ceph: No mds server is up or the cluster is laggy [ 994.429502][ T9] libceph: connect (1)[c::]:6789 error -22 [ 994.579705][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 994.689379][ T5861] em28xx 1-1:0.89: unknown em28xx chip ID (0) [ 994.779843][ T5861] em28xx 1-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 994.828468][ T5861] em28xx 1-1:0.89: board has no eeprom [ 994.842056][ T1210] libceph: connect (1)[c::]:6789 error -22 [ 994.856314][ T1210] libceph: mon0 (1)[c::]:6789 connect error [ 994.918666][ T5861] em28xx 1-1:0.89: Identified as Terratec Grabby (card=67) [ 994.954025][ T5861] em28xx 1-1:0.89: analog set to bulk mode. [ 994.987767][ T24] em28xx 1-1:0.89: Registering V4L2 extension [ 995.011710][T17581] ceph: No mds server is up or the cluster is laggy [ 995.207190][ T1210] usb 1-1: USB disconnect, device number 63 [ 995.217467][ T1210] em28xx 1-1:0.89: Disconnecting em28xx [ 995.315328][ T24] em28xx 1-1:0.89: Config register raw data: 0xffffffed [ 995.371740][ T24] em28xx 1-1:0.89: AC97 chip type couldn't be determined [ 995.403291][ T24] em28xx 1-1:0.89: No AC97 audio processor [ 995.446056][T17599] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 995.482332][ T24] usb 1-1: Decoder not found [ 995.486968][ T24] em28xx 1-1:0.89: failed to create media graph [ 995.553755][T17601] SELinux: policydb magic number 0x32923e81 does not match expected magic number 0xf97cff8c [ 995.564012][T17601] SELinux: failed to load policy [ 995.633727][T17602] Device name cannot be null; rc = [-22] [ 995.877465][ T24] em28xx 1-1:0.89: V4L2 device video103 deregistered [ 997.068580][T17606] ================================================================== [ 997.076667][T17606] BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0 [ 997.084107][T17606] Read of size 8 at addr ffff8880291cc748 by task v4l_id/17606 [ 997.091620][T17606] [ 997.093923][T17606] CPU: 0 UID: 0 PID: 17606 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 997.093939][T17606] Tainted: [L]=SOFTLOCKUP [ 997.093943][T17606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 997.093950][T17606] Call Trace: [ 997.093955][T17606] [ 997.093960][T17606] dump_stack_lvl+0x100/0x190 [ 997.093980][T17606] print_report+0x156/0x4c9 [ 997.093997][T17606] ? __virt_addr_valid+0x81/0x620 [ 997.094014][T17606] ? __phys_addr+0xe8/0x180 [ 997.094030][T17606] ? v4l2_fh_init+0x27d/0x2c0 [ 997.094045][T17606] kasan_report+0xdf/0x1e0 [ 997.094056][T17606] ? v4l2_fh_init+0x27d/0x2c0 [ 997.094071][T17606] v4l2_fh_init+0x27d/0x2c0 [ 997.094086][T17606] v4l2_fh_open+0x64/0xa0 [ 997.094100][T17606] em28xx_v4l2_open+0x11e/0x570 [ 997.094115][T17606] v4l2_open+0x1d2/0x490 [ 997.094130][T17606] ? __pfx_v4l2_open+0x10/0x10 [ 997.094145][T17606] chrdev_open+0x234/0x6a0 [ 997.094157][T17606] ? __pfx_chrdev_open+0x10/0x10 [ 997.094168][T17606] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 997.094183][T17606] do_dentry_open+0x6d8/0x1660 [ 997.094201][T17606] ? __pfx_chrdev_open+0x10/0x10 [ 997.094213][T17606] vfs_open+0x82/0x3f0 [ 997.094226][T17606] path_openat+0x208c/0x31a0 [ 997.094240][T17606] ? __pfx_path_openat+0x10/0x10 [ 997.094254][T17606] do_file_open+0x20e/0x430 [ 997.094266][T17606] ? __pfx_do_file_open+0x10/0x10 [ 997.094281][T17606] ? alloc_fd+0x476/0x790 [ 997.094294][T17606] ? do_getname+0x191/0x390 [ 997.094312][T17606] do_sys_openat2+0x10d/0x1e0 [ 997.094325][T17606] ? __pfx_do_sys_openat2+0x10/0x10 [ 997.094341][T17606] __x64_sys_openat+0x12d/0x210 [ 997.094355][T17606] ? __pfx___x64_sys_openat+0x10/0x10 [ 997.094369][T17606] ? do_user_addr_fault+0x8d6/0x12f0 [ 997.094383][T17606] do_syscall_64+0x106/0xf80 [ 997.094397][T17606] ? clear_bhb_loop+0x40/0x90 [ 997.094409][T17606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 997.094422][T17606] RIP: 0033:0x7f570b4a7407 [ 997.094431][T17606] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 997.094442][T17606] RSP: 002b:00007ffe106c9fd0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 997.094454][T17606] RAX: ffffffffffffffda RBX: 00007f570bc92880 RCX: 00007f570b4a7407 [ 997.094461][T17606] RDX: 0000000000000000 RSI: 00007ffe106cbf1b RDI: ffffffffffffff9c [ 997.094468][T17606] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 997.094475][T17606] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 997.094481][T17606] R13: 00007ffe106ca220 R14: 00007f570bdf9000 R15: 0000557cbd5e34d8 [ 997.094491][T17606] [ 997.094496][T17606] [ 997.354665][T17606] Allocated by task 24: [ 997.358791][T17606] kasan_save_stack+0x30/0x50 [ 997.363448][T17606] kasan_save_track+0x14/0x30 [ 997.368099][T17606] __kasan_kmalloc+0xaa/0xb0 [ 997.372671][T17606] em28xx_v4l2_init.cold+0x94/0x3503 [ 997.377948][T17606] em28xx_init_extension+0x13a/0x200 [ 997.383221][T17606] request_module_async+0x61/0x80 [ 997.388231][T17606] process_one_work+0xa23/0x19a0 [ 997.393150][T17606] worker_thread+0x5ef/0xe50 [ 997.397716][T17606] kthread+0x370/0x450 [ 997.401773][T17606] ret_from_fork+0x754/0xd80 [ 997.406332][T17606] ret_from_fork_asm+0x1a/0x30 [ 997.411071][T17606] [ 997.413365][T17606] Freed by task 24: [ 997.417137][T17606] kasan_save_stack+0x30/0x50 [ 997.421788][T17606] kasan_save_track+0x14/0x30 [ 997.426448][T17606] kasan_save_free_info+0x3b/0x70 [ 997.431443][T17606] __kasan_slab_free+0x5f/0x80 [ 997.436180][T17606] kfree+0x1f6/0x6b0 [ 997.440046][T17606] kref_put.isra.0+0x56/0x90 [ 997.444620][T17606] em28xx_v4l2_init.cold+0x280/0x3503 [ 997.449968][T17606] em28xx_init_extension+0x13a/0x200 [ 997.455235][T17606] request_module_async+0x61/0x80 [ 997.460234][T17606] process_one_work+0xa23/0x19a0 [ 997.465147][T17606] worker_thread+0x5ef/0xe50 [ 997.469792][T17606] kthread+0x370/0x450 [ 997.473828][T17606] ret_from_fork+0x754/0xd80 [ 997.478387][T17606] ret_from_fork_asm+0x1a/0x30 [ 997.483137][T17606] [ 997.485431][T17606] The buggy address belongs to the object at ffff8880291cc000 [ 997.485431][T17606] which belongs to the cache kmalloc-8k of size 8192 [ 997.499450][T17606] The buggy address is located 1864 bytes inside of [ 997.499450][T17606] freed 8192-byte region [ffff8880291cc000, ffff8880291ce000) [ 997.513394][T17606] [ 997.515689][T17606] The buggy address belongs to the physical page: [ 997.522076][T17606] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x291c8 [ 997.530816][T17606] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 997.539281][T17606] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 997.546802][T17606] page_type: f5(slab) [ 997.550753][T17606] raw: 00fff00000000040 ffff88813fe40280 dead000000000100 dead000000000122 [ 997.559303][T17606] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 997.567862][T17606] head: 00fff00000000040 ffff88813fe40280 dead000000000100 dead000000000122 [ 997.576506][T17606] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 997.585158][T17606] head: 00fff00000000003 ffffea0000a47201 00000000ffffffff 00000000ffffffff [ 997.593797][T17606] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 997.602439][T17606] page dumped because: kasan: bad access detected [ 997.608828][T17606] page_owner tracks the page as allocated [ 997.614523][T17606] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 13780, tgid 13780 (kworker/u8:22), ts 902721209737, free_ts 902676057029 [ 997.637064][T17606] post_alloc_hook+0x153/0x170 [ 997.641803][T17606] get_page_from_freelist+0x111d/0x3140 [ 997.647324][T17606] __alloc_frozen_pages_noprof+0x27c/0x2ba0 [ 997.653190][T17606] new_slab+0xa6/0x6b0 [ 997.657230][T17606] refill_objects+0x26b/0x400 [ 997.661889][T17606] __pcs_replace_empty_main+0x1ab/0x660 [ 997.667408][T17606] __kmalloc_node_track_caller_noprof+0x694/0x850 [ 997.673809][T17606] kmalloc_reserve+0xe8/0x350 [ 997.678464][T17606] __alloc_skb+0x185/0x710 [ 997.682870][T17606] h5_rx_pkt_start+0xd3/0x410 [ 997.687537][T17606] h5_recv+0x301/0x960 [ 997.691594][T17606] hci_uart_tty_receive+0x259/0x7e0 [ 997.696762][T17606] tty_ldisc_receive_buf+0x15a/0x1a0 [ 997.702020][T17606] tty_port_default_receive_buf+0x70/0xb0 [ 997.707724][T17606] flush_to_ldisc+0x26b/0x730 [ 997.712373][T17606] process_one_work+0xa23/0x19a0 [ 997.717292][T17606] page last free pid 1210 tgid 1210 stack trace: [ 997.723582][T17606] __free_frozen_pages+0x7e1/0x10d0 [ 997.728752][T17606] qlist_free_all+0x47/0xe0 [ 997.733229][T17606] kasan_quarantine_reduce+0x1a0/0x1f0 [ 997.738674][T17606] __kasan_slab_alloc+0x69/0x90 [ 997.743509][T17606] __kmalloc_cache_noprof+0x243/0x6f0 [ 997.748852][T17606] usb_control_msg+0xbc/0x4b0 [ 997.753500][T17606] hub_ext_port_status+0x152/0x600 [ 997.758587][T17606] hub_port_debounce+0x1a3/0x3f0 [ 997.763503][T17606] hub_event+0x375e/0x4af0 [ 997.767898][T17606] process_one_work+0xa23/0x19a0 [ 997.772831][T17606] worker_thread+0x5ef/0xe50 [ 997.777417][T17606] kthread+0x370/0x450 [ 997.781459][T17606] ret_from_fork+0x754/0xd80 [ 997.786018][T17606] ret_from_fork_asm+0x1a/0x30 [ 997.790754][T17606] [ 997.793048][T17606] Memory state around the buggy address: [ 997.798655][T17606] ffff8880291cc600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 997.806685][T17606] ffff8880291cc680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 997.814725][T17606] >ffff8880291cc700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 997.822754][T17606] ^ [ 997.829229][T17606] ffff8880291cc780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 997.837264][T17606] ffff8880291cc800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 997.845302][T17606] ================================================================== [ 998.088828][T17606] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 998.096060][T17606] CPU: 0 UID: 0 PID: 17606 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 998.106654][T17606] Tainted: [L]=SOFTLOCKUP [ 998.110962][T17606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 998.121001][T17606] Call Trace: [ 998.124264][T17606] [ 998.127176][T17606] dump_stack_lvl+0x100/0x190 [ 998.131848][T17606] vpanic+0x552/0x970 [ 998.135813][T17606] ? __pfx_vpanic+0x10/0x10 [ 998.140305][T17606] ? v4l2_fh_init+0x27d/0x2c0 [ 998.144970][T17606] panic+0xd1/0xe0 [ 998.148683][T17606] ? __pfx_panic+0x10/0x10 [ 998.153081][T17606] ? v4l2_fh_init+0x27d/0x2c0 [ 998.157830][T17606] ? preempt_schedule_common+0x42/0xc0 [ 998.163287][T17606] ? check_panic_on_warn+0x1f/0x90 [ 998.168380][T17606] check_panic_on_warn.cold+0x19/0x34 [ 998.173746][T17606] end_report.part.0+0x3a/0x90 [ 998.178499][T17606] kasan_report.cold+0xe/0x18 [ 998.183438][T17606] ? v4l2_fh_init+0x27d/0x2c0 [ 998.188116][T17606] v4l2_fh_init+0x27d/0x2c0 [ 998.192692][T17606] v4l2_fh_open+0x64/0xa0 [ 998.197005][T17606] em28xx_v4l2_open+0x11e/0x570 [ 998.201853][T17606] v4l2_open+0x1d2/0x490 [ 998.206094][T17606] ? __pfx_v4l2_open+0x10/0x10 [ 998.210842][T17606] chrdev_open+0x234/0x6a0 [ 998.215238][T17606] ? __pfx_chrdev_open+0x10/0x10 [ 998.220156][T17606] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 998.226465][T17606] do_dentry_open+0x6d8/0x1660 [ 998.231224][T17606] ? __pfx_chrdev_open+0x10/0x10 [ 998.236142][T17606] vfs_open+0x82/0x3f0 [ 998.240195][T17606] path_openat+0x208c/0x31a0 [ 998.244768][T17606] ? __pfx_path_openat+0x10/0x10 [ 998.249693][T17606] do_file_open+0x20e/0x430 [ 998.254174][T17606] ? __pfx_do_file_open+0x10/0x10 [ 998.259185][T17606] ? alloc_fd+0x476/0x790 [ 998.263503][T17606] ? do_getname+0x191/0x390 [ 998.267991][T17606] do_sys_openat2+0x10d/0x1e0 [ 998.272650][T17606] ? __pfx_do_sys_openat2+0x10/0x10 [ 998.277853][T17606] __x64_sys_openat+0x12d/0x210 [ 998.282687][T17606] ? __pfx___x64_sys_openat+0x10/0x10 [ 998.288056][T17606] ? do_user_addr_fault+0x8d6/0x12f0 [ 998.293322][T17606] do_syscall_64+0x106/0xf80 [ 998.297905][T17606] ? clear_bhb_loop+0x40/0x90 [ 998.302568][T17606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 998.308442][T17606] RIP: 0033:0x7f570b4a7407 [ 998.312841][T17606] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 998.332444][T17606] RSP: 002b:00007ffe106c9fd0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 998.340841][T17606] RAX: ffffffffffffffda RBX: 00007f570bc92880 RCX: 00007f570b4a7407 [ 998.348798][T17606] RDX: 0000000000000000 RSI: 00007ffe106cbf1b RDI: ffffffffffffff9c [ 998.356770][T17606] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 998.364731][T17606] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 998.372685][T17606] R13: 00007ffe106ca220 R14: 00007f570bdf9000 R15: 0000557cbd5e34d8 [ 998.380656][T17606] [ 998.383883][T17606] Kernel Offset: disabled [ 998.388196][T17606] Rebooting in 86400 seconds..