last executing test programs: 6.636447602s ago: executing program 0 (id=1972): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x2, 0x0, &(0x7f0000000100)="e0b9", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0xaf, &(0x7f00000000c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa8100000086dd60f7d8ff00753c00200100000000fffffffffffffff50000ff0200000000000000000000000000010004c910"], 0x0) 6.428188754s ago: executing program 0 (id=1973): madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='oom_adj\x00') writev(r0, &(0x7f0000000280)=[{&(0x7f0000000140)='15', 0x2}, {&(0x7f0000000400)="04", 0x1}], 0x2) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x8001, 0x0, 0xaf, 0x0, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x2442, 0x20) r5 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x8000) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r5, 0xc0884123, 0x0) fcntl$setlease(r4, 0x400, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_xfrm(0x10, 0x3, 0x6) sendto$inet6(r6, &(0x7f0000000240)="c8", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x7, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}, 0x1c) openat$cgroup_netprio_ifpriomap(r4, &(0x7f00000001c0), 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000540), 0xfffffdd8) ioctl$KVM_RUN(r4, 0xae80, 0x0) r7 = socket$xdp(0x2c, 0x3, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r8, 0xc1105511, &(0x7f00000003c0)={{0x7, 0x0, 0x6, 0x1, 'syz1\x00', 0x80000009}, 0x0, 0x30, 0x1, 0x0, 0x2f, 0x7fff, 'syz0\x00', 0x0, 0xfffffffffffffceb}) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000140)={0x6, 0x0, &(0x7f0000000100)=[r7, r7, r7]}, 0x3) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x9) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r9, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000003d80)=""/4105, 0x1000, 0x1, 0x0}, &(0x7f0000000180)=0x46) 6.263695923s ago: executing program 1 (id=1975): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, &(0x7f0000000040)={0x3, 0x3}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newtfilter={0x8c0, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x890, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x6, 0x4, 0x0, 0x3ebb, 0x7, 0x8, 0x0, 0x5, 0x4, 0x1ff, 0x3, 0x207e, 0x3, 0xea01, 0x3, 0x7, 0x3, 0x8, 0x2, 0x2, 0x6, 0xfffffffc, 0xfffffff9, 0xbe4, 0x1, 0xffffffff, 0x0, 0x10000, 0xffffffff, 0x4, 0xe, 0x4, 0x7, 0x5a, 0x0, 0x5, 0x6, 0xd77d, 0x9, 0x401, 0x1, 0xfffff801, 0x8, 0x8000, 0x1, 0x1, 0x4, 0x5, 0xcf, 0x80000001, 0x3f7, 0x63, 0x80, 0x5, 0x2, 0xfd6, 0xc7, 0x6, 0x0, 0x40, 0x3, 0x0, 0x6, 0x9d, 0xfb, 0x6, 0x1ff, 0x4, 0x2, 0x1, 0x7, 0x5, 0x2, 0x10001, 0x18, 0x0, 0x7, 0xfffffffe, 0x6a1, 0x8, 0x80, 0x6, 0xe1, 0xff, 0x10, 0x7ff, 0x1, 0x6351, 0x9, 0x1, 0xbc8, 0x1, 0x0, 0x7da, 0x5, 0x57, 0xad5d, 0x5, 0x30000, 0x4, 0xb7, 0x9, 0x0, 0x7, 0x5, 0x6, 0x6, 0x2, 0x77e4, 0x1, 0x7fff, 0xf0e, 0x6789, 0x7, 0x8, 0x9, 0x9, 0x2, 0x8, 0x5, 0x6, 0x6, 0x200, 0x9, 0x8, 0xc, 0x3, 0xfffffff8, 0x9, 0x32, 0x3, 0x6, 0xb7a00, 0x8, 0x10000, 0x8, 0x5, 0x0, 0xffff, 0xffffffff, 0xe83, 0x10000, 0x0, 0x0, 0x2, 0xbda, 0x4, 0x2, 0x8, 0x9, 0x8, 0x9, 0xc, 0x5, 0x0, 0x80000001, 0x1000, 0x7, 0x0, 0x9, 0x8, 0x9, 0x7fff, 0xd, 0x8, 0x8, 0x0, 0x6, 0x1, 0x4, 0xffff6f85, 0x1, 0x5, 0x6, 0x10000, 0xdbc, 0x0, 0x6, 0xe, 0x0, 0x3d, 0x5, 0x2, 0xb5b9, 0x3, 0x3, 0x5, 0x2, 0x336, 0x3, 0x7, 0x4, 0x8, 0x2, 0x95ae, 0x0, 0x3ff, 0x0, 0x5, 0x80000000, 0x9, 0x1, 0x90, 0x4, 0x0, 0xffff, 0x9, 0xb3a, 0xfee, 0x1, 0x9, 0x2, 0x2, 0x9, 0x6, 0x80000001, 0x8, 0x0, 0x3, 0x4, 0x4, 0x0, 0x39dd, 0x7, 0x6, 0x4, 0x6a06, 0x3, 0x7, 0x2, 0xde90, 0x7, 0x8, 0x4, 0x40, 0x7f, 0xb2, 0x5, 0x7, 0x881, 0x8, 0x1, 0xfffffff6, 0x3, 0x1, 0x7, 0x0, 0x1, 0x401, 0x7, 0x5, 0x7, 0x2000000, 0x3, 0x7]}]}, @TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x2, 0x9, 0x3, 0x3fc, 0x6, 0x994, 0xff, 0x10000, 0xa, 0x7, 0xbb, 0x8000, 0x7, 0x40, 0x6, 0x75359e2a, 0x3f37, 0x6, 0x6, 0x80, 0x1, 0x2, 0x7ff, 0x7, 0x5, 0x8, 0x800, 0x6, 0x1, 0xe6, 0x9, 0xe, 0x6, 0x7, 0xcb, 0x4, 0x7, 0x80000001, 0x9, 0x6, 0x1, 0xddf, 0x0, 0xe9c, 0x0, 0x3, 0x2, 0x6, 0x7, 0x1, 0xc, 0xceb4, 0x6, 0x5, 0x101, 0xfffffff7, 0x9, 0x80000001, 0x4, 0x3, 0x9, 0xb248, 0x4, 0x40, 0x9, 0x9, 0x8, 0x8001, 0x7, 0x1, 0x7, 0x9, 0x5, 0x2, 0x80000001, 0x3, 0x1, 0x6, 0x3, 0x8, 0x42, 0x1, 0x2, 0x5, 0x81, 0x9, 0x800, 0xda5, 0xa799, 0x1, 0x1209, 0x8, 0x5, 0x537, 0x4d410467, 0x6, 0x8, 0x5, 0x7, 0x3ff, 0x6, 0x10, 0x45, 0xa, 0x4, 0x1, 0x3, 0x7, 0x2, 0xffff, 0x4, 0x80000000, 0x8, 0x40, 0x6cf0, 0x9, 0x7, 0x8001, 0x6, 0x5, 0x6, 0xffff, 0x8000, 0x2, 0x6, 0x80000000, 0xb0a, 0x1, 0x101, 0x6, 0x54, 0x0, 0x5, 0x6, 0x8, 0x4, 0x9b, 0x6, 0x2, 0x200, 0x9, 0x4b6, 0x2, 0x1, 0x7629, 0x7ff, 0x0, 0xfffffe01, 0x9, 0x400, 0x8, 0x1, 0xd2, 0xc, 0x3, 0x18fe, 0x1, 0x7fffffff, 0x1, 0x2, 0xfff, 0x1, 0x9, 0x1, 0x401, 0x81, 0x5, 0x4, 0x7, 0x8, 0x5, 0x2, 0xfff, 0xbb, 0x5, 0x7fff, 0x0, 0x9ad0, 0x8d, 0x59acca75, 0x0, 0x1, 0xffffffff, 0x3, 0x5, 0x4, 0x5, 0x8, 0x0, 0x6, 0x7, 0xb, 0x6, 0x1000, 0x6, 0xfffffff9, 0x1, 0x8, 0x2, 0xd, 0xa1e, 0xfffffff7, 0x9, 0x0, 0xffffffff, 0xa, 0x3f, 0x5, 0xfffff801, 0xffffffff, 0x1b84, 0x7, 0x7fff, 0x6, 0x416, 0x0, 0x0, 0xa54, 0x1, 0x6, 0xffffffff, 0x8001, 0xe, 0x6, 0x800, 0x0, 0x4, 0xfffffffa, 0x6, 0x6, 0xfffeffff, 0x7, 0x3, 0x2, 0xfffff5d7, 0x5, 0x0, 0x3a3, 0x2, 0x8, 0x0, 0x0, 0x81, 0x8b, 0x4, 0x4, 0xa1, 0x4, 0x8, 0x0, 0xfffffffe, 0x0, 0x0, 0x1e, 0x6]}]}, @TCA_CGROUP_EMATCHES={0xc, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xe}}]}, @TCA_CGROUP_POLICE={0x18, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0xe9e}]}, @TCA_CGROUP_EMATCHES={0x58, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x237, 0x0, 0x4}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x0, 0x3, 0x3}, {0x9, 0x3, 0x7, 0x200}}}]}, @TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x1, 0x1, 0xbc}, {0x1, 0x81, 0x6, 0x1, 0x7, 0x2}}}, @TCF_EM_IPT={0xc, 0x2, 0x0, 0x0, {{0x7, 0x9, 0x90}}}]}]}]}}]}, 0x8c0}, 0x1, 0x0, 0x0, 0x84}, 0x8000) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 5.514299119s ago: executing program 1 (id=1977): r0 = epoll_create(0x9) r1 = epoll_create1(0x0) r2 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f000014f000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x1) socket$l2tp6(0xa, 0x2, 0x73) ioctl$KVM_SET_NESTED_STATE(r6, 0x4080aebf, &(0x7f0000003540)=@svm={0xc, 0x1, 0x1080, {0xdddd0000}, {"c1c456d168e6ae9d8f39fa035b501b62bbbce1eca1962c32522b12203dbaf250ac638eb5c30fe4c6047371f043856d896eef29f3d0f8b65fc5446843f46ac74434f711ef97b0ea05126cd3bede819d30b545e143de9c22c4d14bf72469e2f9913e291f7d054012a4aa429420d63677049aad8875688467d7535b9c504b74510ab64c917b41e44f642c8f72dd92647bf784c384924f2f5811ad6c90da7af1b5cb16d7be3a6d7da53fb41ba16978f305b791a100ab8a963c42e528cd169fe86218b2469577ab75f754d892f98f1e7d70b350ac3d70285385f1679e1e1469f654caf9e9efa16862e5153410ba6945bf39442b25be55b53450098cc6b2c50a0be1f43fddb9573bd22931d532bf7a43992ed971f8c8dc40fb20d5091896195e47099b7d2706f9d5e35f888778dade53ca4ec17035c761f9af3f3a1048d8dd26ca3f113285bf0de07e25defd74d72461d4a0389143502dd5a7d057c6b4efff92686852e02091a0844d35edaf4026e17710caf62a01afd6544aee479b5a58839f536144b8fa5eae399d6cf56551b8fce7deef223cd11264c72e98ff4b6389c58ac03d365481d8b6476f59bf073cfdc9677e4d70133a38715a5037858f75940519815391fa33d4d701069fdf326fc4ab5614ef39245bd4735612e15cbb725b0522be1914f7edb956965c4e13845918c0e6b38bf71ce5df9ab2476dfcab8a08e684e66c4d185f462791efbe936e4a08cb9ee69177cf4552cd113d1fa1fccd23b4644807184fb4ada898b09f003d07dbff0948530fd05b7495bdf1c72f6e830d47f7e3a8576c759c4abf415e4d172ae876e3a302d913d3fbd9a8323e3b9f84e5c6391e9761fde814b91483455f91c1b74a4faecb240fc10c3236b1808819c261649b6961775ab8b772e63810f3bb0d4a9c080cdcd034e2ed2ea6f0fc3239ce95ad66ae23231a4dc1aa15b134ab6c1e21684628f0f27c35c5b65269332b0afe6166ab61108c9a32b83db26df4e2c724956a3c9185ee3f82a83c5b68def23acfbf1020a81ea685b5d61558a5760eeb2e4fee699db69dd77b7f0885ef6efc80143393b29b7fa2ceda204c17588621184df381d98a9efeee190ad1bece31a4bc3b60a7b400ff44be64bdfe430891f833f55d4131d5fc57c48c25d6fc1ea1069f5b1b44f65e134df8bffdddf8a207fb3f28ed53073027d47d2bca527e104aeb14c9eff281c49841b6cc2a37acd263146e5efe285f68f8095ac5c555b534584e7827db15925949484c15bbe215953a0700f3a1b42fea2bd1ac211ab0222572203b93ea7166471e0e55f3efcdaccbcefaa611f2f78107e7b5676a7b9651e509fa605c1db4d0af7ad1120ed549048857e36b31e0d87676583a8e49090c87a0b4903d1fa834bd9dd53ee89d30e2dac85d4444f2cba7ee10ca5b78971a9e44f1a5c17175f4daafa7d40a1fb032c778dfae76387dde9b12000c92dd074c7b9d4fdd1696ac520d022c1b9831c3f00cd75dad631380e7b6bca33a23a092d8131025644d6a8ffa7f004ae9f3457de2bb334b32265fb71c01f781552f33d85ab024659fb285480f713a747e4034c4535c413ca4b9351c948ed9133c6787089a3b75cb7360e191126371678047bd086e5d05543596565327e45ee6681aa3c1ab78d4dcc4a98b0e3b9897d8429847496bd9f280738a4b240ace15692131e151cd9800eb066d7e8cd72c161968e49d7c238f1a97459abc17a76d629bd48a921f400bfb841170a5cc967c41d8edb2f345bbef4598936f9e88bbb041996d0a20d5ccd6d2d6fa9712da9f31561233e5a939412f50789c12e093dd3a02a09a5040e4678531ac0ab97499e389fc228ca7c59545fee89232a43b2c168f9e881a5a1ada004c74b650e732d391075edb49bfd977a730b986334f7bb97e641cb7e8c16fc48668aaa247b23b934bcf9d7724240a53247208ab87b80079c9e8fbd9726d593e95112a73e060f495c4488fd857facc4407de4407c4a7553ed243386dbe44d3e2df6a7ca75bd4f171971d43723461d9a09ea31bdbd804d1786242c9bfacc0c3119beaea3c6b87533a178c93adabd7fe0c897a6a64ff74cc7db437940e22c3aa63d1d9c473e5bdc1972d39c6abe320a04e0256a1358c12644681c5676da99ad40df6dd15b7b8cf0389fa22f85fa7c3fd0fa379a1a1d0a1a805d221383dc89b5025d093155973fc6efd47adea7d71ad5f152e6c0d888f75ea55725a00545d1af0cea2cd9f9c226fc4e361d32c74c703f84abcda14d2fb95dafd7a80172937c157f315ec225f48a5c570932d0bf0c20771a18bfe4759187f30192e5dcfaa09022b56cec2c1e5c11e645286cc151771a4304a4a6d6fd8d6f3e1dc4c80ecc9fcf78ca4581704a8542e3650bdd38e216003c1b69e12b5afcdbb8c0e738f9f98a167393350c308ba8e5e4ce1ea9db748ffe085166edd268ef6a0a3e7c9f09fcf1533e09848fe46ddc4e005dfe0269e1455e0cc18c1d72dfa0a3c11e97c8c202fc586e14bc6d63366de1820a0df189da905f0e340e7e85e884204f40d570f8c19908915cba7a364a80f4f2d7f31e83ba122661774b5eb2a5af42f14166ba949be0704cca02129f11ff9354280d1b432ed075160acbee765330cc1f87f94a26d9a7ee7d8c4218eb00f690d6f7a2fd0924b0fe0fb99236564be712839a2ab95cda64102ebd926bcaa52128d1913a32b7f5c51cf977054b654f48afd4b7be2255530718c7e3096bf24c0c009c672e3ab5c3589d56e34d5129e38f8d0e7b5b5da8b76e3d0c8471e49b5fd61084fd8dd1107c3bcabbb5ea5596e90738ed816c9e67629b5591f1b28995007eeea36672f58c9f7c9e178e7778c060a841a1fd82219935c5929c2ab833d7e88cefcada906bffe54909f2780eee1b10c6ab09183e2a9d84a6ac8027f2ad125c90f953e0c9aeabd37f18e959e451107631ddbcce2b6c6f65d65ccc9e84d795e1017b6c7425031552cdfa752cef6c25f7e315d7cc3463921dc88db5f578ad39f1e02104af2a28d01155e7cf77c3dc33081b01213419c680e5be65f06cc2d38bfd8bbe026815095123f53a0171a4534453ac8fde28c6ea380dd77429d3a3ef35377644ee0ac4f0e991c3369d73a0bab921f559a0741f2fbd493f7e1c98420f771e7debd407be2c1ca4d7d5572544666a2cd7c92217d35adbc10c5e8018920673f30aed8e15ee3dffde7cde5a46a88977127fad0c682e81b21c5ef5686d1ff7b355a38bb6bdcacb03bf4601bdf61bd39ec4c445b0a2139a5579fbccad37843f79c406ab7917b2099f1d82befdf705d50601b6ab27c08fc39b9d26bd227de9d8cefcc4422baad0854db4c3e31e48ac07a73694c299f43ce70601bb3c1f319a52a283d9651fe5bdce3e226cc6b1c4640e85be122f71da1012ea7929e73479f1fa26b3fd0de92442ad70930c1fed3bbb75892b307d0f6912b99541a431f40394337533e6f0a7eb440a091872ed7ee5b21a32660385cce754fbca917040c2ef8c9bbbbfc2dc51536128547e374f37aecea85b6e2101760eb11b0670b50692e9911f1b8b55b96a6c5a9b50a0de05d595640745cca2df953c384380f6e744b163b2aad573130c142aa2d4451ab9b5e8a5ce39eb32e2b207020b737271ec42963feaa73364e549333e8324068144b772979d2b28710ce42cd5b6196c3a6324a0a0709ad584f06a01aac60c63183b4e3b99f6aa39674e663fbddc69bb1347500dc67c83f034265fad2a502cdc5f1badb41e1fa563793ed27d5e004b42e4ceecfea461866b26b766103b88cbe66982034128db12705881a9cc0480b20356efc8ae720341668aa69cf1246c380c633c296ee37fba2b5849cebcec4ed617c19638d2f782fc1c22970824e700250d10793fb886cbbf93d6b0e4007b19e20e02e437abfa824a95d72c33698b18124efbaac678374cd562b80b23d221468299281507d98974994ecc0190ea6a3d21d5543d84b8621e7bdccadcc370235a602d7498c64e2aa54548591eb6b9c53e18185a473367da9654d40b3e076116996ee512efd4d014ae111e336e8b0a1b03a5f7e918cd6b5939f7bd5521fcd2302c8828c20da3ab4b91aa0fecf2f5140a88e0190125054629aa1b58b479e6f1b0b4a5a6d81bc8e5485d89797a24a7fa3f57af68d593bce3f479778821c1ef36900f24691d16a4812b01aa0f34aabd549c99de66c739fe115a79ba87fb5d30812e1b7239b79f5b5af946224e04bd69a47aaa8d08749857fd46f608ba3e4218e24509faae2707bdb9aa80e27380e4aa0853188a851a12c16357700b75c6542bac8c34ad53e33daeca1c7ab21959b8b31f262b5fab1c0593ed9ba3b70f4241ce784f55f7b35594f074450dda2b9fa72e16e15baede64b3d0750cc300b3796a94c57ad03488dd50da1cf8f9b1e039b49873bba1ea0fc318c56a341bf3ddb102f3c7326e94acef2dda312df40f6ad0614627850461a2d277f64979857cece29f0a072f7e0b520543bb3530d0dd703e0dad2584e4bb36eb8f8e507263760a765e417da058c3e9cbfa446d649f5efc788bd389fcac723c945b524e87d54b015daada7b210654f1be1747b49dde79eebe4afa6ad14ae7c1556553696aaea99b7ce73ab7b4b5fd61d76186fc5ecd512f619462446b00f054303a48e694bd014af53aa0ae99052be164e2c1336698d6961c53454008b44100901c9c8249c6a60a6328659f6e0c33214144d88b7087bfd9a64a76b5886453183c854d874ff4a1b0ec83a7a930d369a1b29c5fcaf75768d7dfacd42fdd8d2f302393d91169de6c69eb5d96c9ba3e3b0214cae24eeedd5abfdf41fd6df45433e8da73e63c4f99c0da4793d17971e531e63ba8c610febecdd60ba958cf35379655a938bb95db85b4d8ae456ec3bee3d9ce26b06f930e8371a968f1686c815640acf299659d975c5ca42e756e13a684c5344a47f6add021d5280442cee4f4112f5616b36d616ea9272e68954cbb1f76e1bfed2e4a9bb6f41813b024e17a1f642ec30594458b75d65572f140daf2538f7a0d7ae4cb73e83ecc35e5b28f4d48776be31b62f41bad2120d1e35cd4636b8afdf8afeb6785c86c14aac7dcdcd049eb14b7b999321f818931ee2bbf2ccbcf83128a1fea3ef81832683295869c0ab1cb5873c473ffa73b02cd2f3bfb4950648ae1026dc26de58c1bf7c612ae7cccf519e94707b8b88de295ecacf1adca3cb3fc17897ddae82b4a29c5607165bac2c520c3969a0c1dc2e3ff724730906ec3af69c063a68355b48f8d65ee9d46b91a6598e3acd6ec2a93bef26132bc6cc89acb15f32fdaccca9391a6c72d05649cf3281827a7ac308170235d1eb7c70e59ee52ff732499d1e8ae323c19653c15bac1afdabddd4f6b7ebcff3d0e9e7201a281c2d35deacd49f1aa2ad4c2ce0ed4cad7aec5bc0e58dd234359233019d0c02db0539d691a0a532791fa271fdf1cedb7b5be435c535df354d22471f7819202949196375cec19408590ece2b8a3828e0397dcbfe742b468c0d3b5198d6d6d4635350fddacbd6695b766401198e982814b5214a59b812efa54a7bc32265aee884ddad9283b2a9be0443915a26f82e7786352a11704441ecb52282febdab1e4290eeb962ed28622f9d7052a5cd741f404b04c50ce99f4077f94bf82fbf7514c34007358a09b0867c93b097119a23074b9cabcff0efecda3b1091a3d62810eb0e6ee0ed85a0e53406251802ef1231a611fcd8f25e9451c6d5567c433e714c7ba9ad969a57998d49daf0e7d4070e6779fda7e23e81380408422d79"}}) ioctl$KVM_GET_NESTED_STATE(r6, 0xc080aebe, &(0x7f0000000440)=@svm={0x0, 0x1, 0x1080, {0xeeef0000}, {"d966fb400c38ae6e19702a1de65cf9d6d7fe271db36dc9ae146a6feb49c267ed240651664e343d7fe698eee1d427ecf266507afecf84aa44e8743898bb673db3936a023d89fd3a67f6a392177c62c3c99dd6072103de78ea3537166e1c692817a3683375bff451bcd349f91e33f8659ff6782abc3d2d445cfb810348ae8445abec836ddef05d4e0913c02d1e9fc9b03c7255490e5344f6b4ee70ca8f17c66a94728bfd4973f59dff4daeebc8b2c783c1646b3baaf936f46f3187934206799803cd5bd8b54f0f8d3e821ea87ab2188f4fb62bf3d645fc5da36fc3dbe6a8540bb8038555e203beaaa914ae195c4583f1a8742a7cbc0b4d92eb2e7ccacf7a7c6915c1348c24da0c3a634fc6a2053905a5f8a958c58841b4fd1c29fd229a069d65d4e3c7397961c7d8fc74ad16948898c881d58e52aaa041e5c20ef48ccd20d722d5da679bf8cba2fa35e72929d3398882f97ac81a6d16faa5bf0749bab50f40a1d4b326956f4659a2955f70f4d64e165ec0aeb9c652175435f1dcccf939db09813044dce8425397600617d9a6e4c92e1fdb3382af221925b4893824143147122e18a058777bac5a9e62555a82656083d57559783f4ce31f25e4450a916701175b798e7253fc518399f6690c81f76795540caf753b2dd5cf3738a450212820df33182cf2364e1897e55b5196dd16126021bb081c8a341272296d617f50c043be9644e84fe4bdf60ca95c2b60016a77a16f49260f4df113a2ff2214e2c239129d44b4571e029e1df3aa683a54467cef44f03db9551f837c7372011c07dd677a302206f8d6bc7a2f02a65c8e9f2240e9ac40bf4f1c6e43faba91735226150ab7b1595c5f760826a6c469be2f3267a111091778d2da4348dc0f07b700cf5c3d99b60483c7ff20158654d41c89caaece61c7fbe880bedab7c7fedb487a5072624b06e2b24636c0391f538daa2ccb3c90930bdcccefa8797b5a2445d49a6cc89fce889b79de8ceeff4135dbf82d3f29c56066b752f2b92e912a96df94786c55307cac4041901d532b8b23d84bf9d16ec0f2d11ba66e76018a920f4bd3cb1b26f5dd7cf493460566fe29af71761b4d470287c680fbb023f9def3ea7cdae3bea207e410a53ca4fec59d00a0e08241bd5c7552a2ecfadf4af4489b7a961a2b153aeed0fafdf3c30f372241271d87b0356323ea6cd996317492c8c8c1eed5d9586e9cbd52c202f3db41494f341ee13af52c4f105da902b425fe4adba3e092bc52cd6e3f77ddfa400c54a50fb50c7b641764e4d66237d91119a9c0566c16e2111698cea6839cd64f1cb7a65ac233c272a424abeaceff5d7b60a3d634c51295f3e7804bd035df8ff28417c0d4fcbaa5448e4317b62d494932a4df05537727b7c4277805cee296fb2edafc82288a9df76e1f501f5f9c8774c43f406c513fac11700d02b6d320eabcfee5f2ade43172a02d4e808679b2f24d0c86524a1e4e94b781adb5491ae3400f6d03204b628ce1e6e765b60a9c381c55b1e02c9a6c38d984d262e67c5485ba19ed16990ddf81d6e8b1092c4d4ef1b505104e4349956a957e0700f6a6e181b0c1e5163188d5711e1936dbc3e63e2c9be91141cd55eb4f5732c3fd2e3eec54110021b7c41b3d860c1be602cfbdb22fb4974f608fd01982b62882427ede14f86930afce94d9c3fdc9a5813357817be643ebf2bd5fb161eb3685e988afdc5c442a5fd38486499b9d8442c75b889254e7aeb26936ccf4d0dbb4ba74a0ccdccdbab0104952b966592793b08272f5dacdcaca17b90992c38004d31848e0819c25414eceaa847860c0deead9dcac9d96c1afedd96478614cd22a060c0df6ed4f0f142cd0dafa85937ff947c2f6aa7215b0d13532c89c944ae242215a523d9533b7dd7aad73040cb7be4583d2564123d84d702b288fefa02c1c2b54a104d7fe09ca4285fc0b764c6df906e0b1cc4f037e6d627c60e4dff42573524c01d8d9e2a7f6e36940e7d7dfcef5ccd198f0207280e1d94ff04b15ff5f96d4a0383121f09fb7b02378a68683d1f83609665ee665694aed8e9aa542965c9bb1d2a2fdf0d015d43ee936c73307afe67fcd707a15d7c0390547df84d2ce62ed7c2f409595c9c70932e2eebebddbdca9dc5719d1d885a23f0593c22af31310d2700aa5c71b419b5d6aa0193371afec86b4c745bd6c8c6c6a259eca2e4e5aac26d373dec05cf76ecca03edf5e7b3935498dcf4a9a500da37d585e5e74b9ffd80ba6b10be96faf41f846cc640cc51ebdd57f3a8f79a35cf4cf3e513eecb3715df76a56f3e059f7f6f9382c2a0e829d855e8ecb82f0845e78bcbc9091825dc06bbc8dbe625e81981d62ad71ea64052b57b1553834668ee37fe013381b2014714c06cf51a3fbd69dc6069bf33c06e522dfe16cbc51415d6f3f916db534c6ead0183b8db41167558c47eafbae74b0d7ca6cceb9cb087ec1d60e416f27fb789488f2fe3eb2916da954c4144a06689748ee0be8f997164264527cf7bec9314e4e8ef45e6005da5c50b6999aa8354390beccd60e9b158bd81f9dbc82a15692d7932310d8bc3ab0cd6c48e8b09584724eb598f64aaa163b3949ef4c567a52a8152b6f0911fe4743eb662dda5d2e69a8b12e1f59009f57337ede497d0bc25e866d9e899fc1a8988270fb3f82361e0cfcc26514323ce14432a07defb9a5e71191a36fce70af649ad879ddd46d8ce88c6b8b08f140640350b40cd19748ef98df3a86f9500d99d3af8a71fcc29a5d5bc0ab1f2ccb2f918aa2a7e41eafeb3732c4832ca7113e0a350ec02940663982176ac0aa1358ca1f1c3e80606ad3faa9675c9354a5fc3ebe1abaa3e16169cdf2abb00fd258627ebfcfd6a2b2df2a359d643b527d97a884e08831c8383304092c1b3670b8d11f872a68c764c0c1b901872843db85271b6888e03e137ba83471fa6bd81dc5de42098fa62cb4c6a52c81eef77409441d1785737aeaacd00310f87e38681166f10719e66817191c70096ce0f1f1939cc53ff2c90b441f4ec07aa7e7abdb92f81d8b0f5389ee55eefc67aaa7d5e83b4a1d113a06afbf048f97ecbb59e4c6700ddca518fd7eae3529868152c6eb4701248be1fde7160f3923bc138f8fbbfcecffa5b6258dd362292ecef192d9af99ad5f918ac39ae87e8300dc14a923635cd305c92c6fcdd6b8fe4588b823f612a8ed1e6b7e1458dd7e9d02f88735a71a51c0987ffcae93f64e2132c5e14ae02ac6d12343a4694e1073d2794fa630d191a14237a07689f19dda7326a7739677e24ffc5a89e95a14df792eb94d09a4fd369df3b25093e92153e9bcd552b776e1226650b24dd1404741379a5e1a6941ccf5600b523229ff7f0a902d10228008b7486ab760f5e66679eb43746ad30aa31516358152699b4d8ddf961c3fec7cfc483d3eb3261b2d63cb8d3abcc237e5183f2c4737f0e2135be41cebf94d7ee44236ac8ddc9b7de5b71645c29a9c5661df802f94f93044e4e19c3f4a8e186c391f51ee42698b894578ce2555d2246d5027b0e6ab5b1274c4c6a5de1a1e00f095ba9035f40043d439dbd367af31dc1af6450b837d34f510ace218a8928b6f994076cd8754d8bae88c95814380c01ef45f3ea5a1d6e6feef7336f3f1b857f0293add639614cde949df81bf005d04b48de1f5ade1a3fa10b25309775360da988d47b30b59c9f199af8e5203dcf7cb1d3e1faa21913138a915cc90101ee4e97a895007a60748dda2fbb70988b1d3c960152cad23eeb823887f7c10cf4050033624d591cc58f1baa96dd1232dccf312c5735d7768205b03916824bd09f8420061efb9d310b4358b54076886d6cec8bbfc5e77627b9ebef3cea396cb202e5fde0aa5c341d071c330be6f36aeece05f994e921321ca2d803a8616989901bd7b44cf8b18f7fc9921f67924aeca7665e3aab6edacef9f57a501dce9ed365a829dd8b75e6cbc315385a2bfd60d93f928e1b6478229d032ca73547e700e1a68e46cae8e0f8639ed3f4f367788b30e1e7174b93405d25d41bf6a199615b8ac5778fea38c6db0d70856cec2668ec7abe6f5f163d220c2efce5d1a6270955d224852fd2991ff8800d5e862557c4d7e1aa083f05d3821b921984749807e1984a8a66225f970d4aba38f72eb13ac72da90f0496e09513fc8d2c7694ca40b3d56f2771788c8647dea3e9ace710d5162a96cff4192a11bcb3185c970bf88be7d07e89166fcd9de7d672eabe5561ee8b40a0fb763a2c9b21449d85805f315995abcc48d83fd9e85cb8f5c5e08e0a655b47964273b793d7bb4a4572344d112d98d8093e6615e31289a2fe29c2c34417ec2a0037c1c1c392e193dedebc54db5e6a4b8a9d343b7f92281a17bbe7533fedec3e9dd3fbeb7901cde37371f999b61aa3b4e58ec399074a9cabf639236c0adeed0f18c1407a9dbbd82b3bc5a858bc4d21271e053798060fc139790762235d44afd2bdf66c9131b1ef13d2ea2abce6145f084720b59dbe18773ff1cb8ac1433c95e9a44a80466da8751c95885336dfbc5ff7b51e45023079698f2d42b915ae5539a8f5acf6ee3a60784270cd0cb071a221ef3b98be42a0d2a6bd2d78c124d628375868f9a652f5cee0a2a8a1c6408de9e64c5d9500767d9ed87a6153049c09d826a7eea908196c311e243f77cba0c720f7a72835c693cdb2c3588b40b59cf251a41145661af1d5b90a0fdab815b2002e4158ec032dbfb27dff15a0e5faef50b241d52a58a32dc068c36a26ca83fb0ba14765ceb9aba02861c35d633d1418f14865805c5bdd0e3466256b95ebb38389c97db074b0eb2df61392a3ee40fdf284a9adfa66a09352fc8e326e3ca5ae977b345591794c3d378a12ba52a2b6df1e146e9f8fea2e47f120fe65ad140dc22c6ab48810af2bca7a7f3473729d1af54f5d3898daa6247d5b4f6285987c03146f3ca7ab1bcd7adcc9774a59084fcf433218367a138933c7c42632ee48d6a1ed692cc7c081e2df2bf5fa0319aaebafd0877b55178f5b522bf11b818b6596e7e7dedcbdad95df5011949fb41fc20ddc6edc75ed5b8e771c4ef0b57a65eba5124cbe18ea3212aa5bd5e89fbd8f7cea891d77909b7ee244523d5a4ae3b28cab21453c48e66e0e1e02988d061d21c92017589e5066e8edb842714f87e3ac08cf977a25369a107ebec261b010ce09138568bf079b75e37df83682bec0e7a77182aa95c950fef538979adc02f524985a1a2408ee755762e3657527a64958062dd4ac508538b823850ebdc74f4bbd9a5bd64769cd0b47c390e1ff966836575faf384573a18c7e5fa6dfedcc736b109c0eafee3661a3ec7a59023a1c0e8b665e3be26a8c2946674ec1343ed175ec9d72d01451733095b2a164cc7315999e6f2faf333ed6a033cb4cdc9da0646c7a8510b8a85ffd86241656a332c63e5c0507f6808f1a9cd08ea7cc8717356effc36c379354763722e65032ab1c40bedbb77060381eb0c99b6186e7cc8754d8aae9135e23efbfcd5f147f9e4ca7261bf4be24415130fbb81fcf581e11138ed63f025b3c275985347c76daab55d4d9c447791acdd3dbab1abf35eccedf8125e6452cb00d58578d99e68b92c41f814ab89c7bb89ecf249e1f049fcccd319d012550081ca5695ae8b551cd9e488fd0ebbc0ba56119304799caf39679083851cd1d9c8bd8fb4de03647f85b3a78b6477330b901ad7ed8b45e75b1a5f97df3954f61962135b900f2b178a087e5f728ef7c3ff264423a86dde67dddf52dd3509096ed94ce11d1bcca288e23e8cca5f3011b0ba3cef01d9ccbbcbf3a3dc"}}) r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r2, &(0x7f0000000100)) r8 = epoll_create1(0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)={0x60000000}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000000)) r9 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r9, 0x114, 0x1d, &(0x7f0000000040)=ANY=[@ANYRESHEX=r9, @ANYRESHEX=r9, @ANYRESHEX=r2, @ANYRESOCT=0x0, @ANYRES64=r2], 0x4) 5.470156829s ago: executing program 3 (id=1978): socket$netlink(0x10, 0x3, 0x0) syz_mount_image$fuse(&(0x7f0000000580), 0x0, 0x2849034, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@mcast2, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x1, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000002}}, [@tmpl={0x44, 0x5, [{{@in=@private=0xa010101, 0x3, 0x3c}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2, 0x4, 0x3}]}]}, 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=@migrate={0xa0, 0x21, 0x1, 0x4, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x3a}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0, 0x2e}}, [@migrate={0x50, 0x11, [{@in=@loopback=0xa010101, @in=@loopback, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@loopback, 0x3c, 0x4, 0x0, 0x0, 0xa, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r2) close(r2) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r2, 0x40146f2c, &(0x7f0000000200)={0x4, 0xc2e170975ad28aba, 0x0, 0x11}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="24000000240035b9000000000000000000000000060003000054f082"], 0x24}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000000)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0xfffffffffffffffe, 0xc}, 0x68) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x12, 0x22, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x60, 0x10, 0x403, 0x300, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x1e, 0x1f}}, @IFLA_VLAN_ID={0x6, 0x1, 0xffc}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x60}}, 0x8000) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x60, 0x10, 0x401, 0x4, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x28, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x1c, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x80000001, 0x7fffffff}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x80000001, 0x6}}]}, @IFLA_VLAN_ID={0x6, 0x1, 0x3}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x60}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000004) socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_open_dev$hidraw(&(0x7f0000000000), 0x6, 0x80100) ioctl$HIDIOCGFEATURE(r9, 0xc0404807, &(0x7f0000000080)={0x2, "66fbc0ed17abe5900424ce46609c90817a43ee97d88462dd0cebca3b3ad4bec8a0a867074881131cca5a5ffdd86178ac7e75fba73c5e5472f2b78bb726e76d38"}) 5.052549321s ago: executing program 1 (id=1979): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="5000000040000100fcff0700040000000100000004004880300001802c00108014000c80100090800c00588008007300", @ANYRES32=0x0, @ANYBLOB="14000b00000093b0b9a0fab1946d000000040000080002"], 0x50}, 0x1, 0x0, 0x0, 0x4000805}, 0x2004c094) 4.991780599s ago: executing program 1 (id=1980): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x240601, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newtfilter={0x8c8, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x898, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x6, 0x4, 0x0, 0x3ebb, 0x7, 0x8, 0x0, 0x5, 0x4, 0x1ff, 0x3, 0x207e, 0x3, 0xea01, 0x3, 0x7, 0x3, 0x8, 0x2, 0x2, 0x6, 0xfffffffc, 0xfffffff9, 0xbe4, 0x1, 0xffffffff, 0x0, 0x10000, 0xffffffff, 0x4, 0xe, 0x4, 0x7, 0x5a, 0x0, 0x5, 0x6, 0xd77d, 0x9, 0x401, 0x1, 0xfffff801, 0x8, 0x8000, 0x1, 0x1, 0x4, 0x5, 0xcf, 0x80000001, 0x3f7, 0x63, 0x80, 0x5, 0x2, 0xfd6, 0xc7, 0x6, 0x0, 0x40, 0x3, 0x0, 0x6, 0x9d, 0xfb, 0x6, 0x1ff, 0x4, 0x2, 0x1, 0x7, 0x5, 0x2, 0x10001, 0x18, 0x0, 0x7, 0xfffffffe, 0x6a1, 0x8, 0x80, 0x6, 0xe1, 0xff, 0x10, 0x7ff, 0x1, 0x6351, 0x9, 0x1, 0xbc8, 0x1, 0x0, 0x7da, 0x5, 0x57, 0xad5d, 0x5, 0x30000, 0x4, 0xb7, 0x9, 0x0, 0x7, 0x5, 0x6, 0x6, 0x2, 0x77e4, 0x1, 0x7fff, 0xf0e, 0x6789, 0x7, 0x8, 0x9, 0x9, 0x2, 0x8, 0x5, 0x6, 0x6, 0x200, 0x9, 0x8, 0xc, 0x3, 0xfffffff8, 0x9, 0x32, 0x3, 0x6, 0xb7a00, 0x8, 0x10000, 0x8, 0x5, 0x0, 0xffff, 0xffffffff, 0xe83, 0x10000, 0x0, 0x0, 0x2, 0xbda, 0x4, 0x2, 0x8, 0x9, 0x8, 0x9, 0xc, 0x5, 0x0, 0x80000001, 0x1000, 0x7, 0x0, 0x9, 0x8, 0x9, 0x7fff, 0xd, 0x8, 0x8, 0x0, 0x6, 0x1, 0x4, 0xffff6f85, 0x1, 0x5, 0x6, 0x10000, 0xdbc, 0x0, 0x6, 0xe, 0x0, 0x3d, 0x5, 0x2, 0xb5b9, 0x3, 0x3, 0x5, 0x2, 0x336, 0x3, 0x7, 0x4, 0x8, 0x2, 0x95ae, 0x0, 0x3ff, 0x0, 0x5, 0x80000000, 0x9, 0x1, 0x90, 0x4, 0x0, 0xffff, 0x9, 0xb3a, 0xfee, 0x1, 0x9, 0x2, 0x2, 0x9, 0x6, 0x80000001, 0x8, 0x0, 0x3, 0x4, 0x4, 0x0, 0x39dd, 0x7, 0x6, 0x4, 0x6a06, 0x3, 0x7, 0x2, 0xde90, 0x7, 0x8, 0x4, 0x40, 0x7f, 0xb2, 0x5, 0x7, 0x881, 0x8, 0x1, 0xfffffff6, 0x3, 0x1, 0x7, 0x0, 0x1, 0x401, 0x7, 0x5, 0x7, 0x2000000, 0x3, 0x7]}]}, @TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x2, 0x9, 0x3, 0x3fc, 0x6, 0x994, 0xff, 0x10000, 0xa, 0x7, 0xbb, 0x8000, 0x7, 0x40, 0x6, 0x75359e2a, 0x3f37, 0x6, 0x6, 0x80, 0x1, 0x2, 0x7ff, 0x7, 0x5, 0x8, 0x800, 0x6, 0x1, 0xe6, 0x9, 0xe, 0x6, 0x7, 0xcb, 0x4, 0x7, 0x80000001, 0x9, 0x6, 0x1, 0xddf, 0x0, 0xe9c, 0x0, 0x3, 0x2, 0x6, 0x7, 0x1, 0xc, 0xceb4, 0x6, 0x5, 0x101, 0xfffffff7, 0x9, 0x80000001, 0x4, 0x3, 0x9, 0xb248, 0x4, 0x40, 0x9, 0x9, 0x8, 0x8001, 0x7, 0x1, 0x7, 0x9, 0x5, 0x2, 0x80000001, 0x3, 0x1, 0x6, 0x3, 0x8, 0x42, 0x1, 0x2, 0x5, 0x81, 0x9, 0x800, 0xda5, 0xa799, 0x1, 0x1209, 0x8, 0x5, 0x537, 0x4d410467, 0x6, 0x8, 0x5, 0x7, 0x3ff, 0x6, 0x10, 0x45, 0xa, 0x4, 0x1, 0x3, 0x7, 0x2, 0xffff, 0x4, 0x80000000, 0x8, 0x40, 0x6cf0, 0x9, 0x7, 0x8001, 0x6, 0x5, 0x6, 0xffff, 0x8000, 0x2, 0x6, 0x80000000, 0xb0a, 0x1, 0x101, 0x6, 0x54, 0x0, 0x5, 0x6, 0x8, 0x4, 0x9b, 0x6, 0x2, 0x200, 0x9, 0x4b6, 0x2, 0x1, 0x7629, 0x7ff, 0x0, 0xfffffe01, 0x9, 0x400, 0x8, 0x1, 0xd2, 0xc, 0x3, 0x18fe, 0x1, 0x7fffffff, 0x1, 0x2, 0xfff, 0x1, 0x9, 0x1, 0x401, 0x81, 0x5, 0x4, 0x7, 0x8, 0x5, 0x2, 0xfff, 0xbb, 0x5, 0x7fff, 0x0, 0x9ad0, 0x8d, 0x59acca75, 0x0, 0x1, 0xffffffff, 0x3, 0x5, 0x4, 0x5, 0x8, 0x0, 0x6, 0x7, 0xb, 0x6, 0x1000, 0x6, 0xfffffff9, 0x1, 0x8, 0x2, 0xd, 0xa1e, 0xfffffff7, 0x9, 0x0, 0xffffffff, 0xa, 0x3f, 0x5, 0xfffff801, 0xffffffff, 0x1b84, 0x7, 0x7fff, 0x6, 0x416, 0x0, 0x0, 0xa54, 0x1, 0x6, 0xffffffff, 0x8001, 0xe, 0x6, 0x800, 0x0, 0x4, 0xfffffffa, 0x6, 0x6, 0xfffeffff, 0x7, 0x3, 0x2, 0xfffff5d7, 0x5, 0x0, 0x3a3, 0x2, 0x8, 0x0, 0x0, 0x81, 0x8b, 0x4, 0x4, 0xa1, 0x4, 0x8, 0x0, 0xfffffffe, 0x0, 0x0, 0x1e, 0x6]}]}, @TCA_CGROUP_EMATCHES={0xc, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xe}}]}, @TCA_CGROUP_POLICE={0x18, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0xe9e}]}, @TCA_CGROUP_EMATCHES={0x60, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x237, 0x0, 0x4}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x0, 0x3, 0x3}, {0x9, 0x3, 0x7, 0x200}}}]}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x1, 0x1, 0xbc}, {0x1, 0x81, 0x6, 0x1, 0x7, 0x2}}}, @TCF_EM_IPT={0x14, 0x2, 0x0, 0x0, {{0x7, 0x9, 0x90}, [@TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x3}]}}]}]}]}}]}, 0x8c8}, 0x1, 0x0, 0x0, 0x84}, 0x8000) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 4.484050424s ago: executing program 3 (id=1981): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xff00}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x30, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x104}}, 0x0) 4.324114889s ago: executing program 3 (id=1982): r0 = syz_io_uring_setup(0x832, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xe, &(0x7f0000000a40)=ANY=[@ANYBLOB="b70200000d000000bfa300000000000005000000000000007a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000050404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf27fb6d2c643db7e2d5fb4b0936cdf827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923dd29c034055b67d5b310efcfa89147a7fb0a93d035f2f206d2ef831ab7ea0c34f17e3ad6eecbb622003b538dfd8e012e79578e51bc53099e90f4580d7be3e8c254a5cba117cbdb9cd38bdb2cc8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e6a9f65f1328d6704902cbe7bc04b82d2789cb132b8667c214733a18c8b6619f28d996d60a17e3c184b751c51160100000000000080148b9a31ee8dc8b544f3c4a532e60a0ac346dfebd31a08060000000200000000000000334d83239dd20100008000000000d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08a406f99f7b1e1ad828267d4eadd3964663e085354133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0183babc190ae2ebf8aad34732181feb28cb0bae7c34dc5e7c805210600000000000000c3dec04b25df45d4f71ab158c36657b7218baa07a99bd50499ccc421ace5e845885efb5b9964e4beba3da8223fe5308e4e65ee93e107000000f8ddebf70132a4d01776839b8eccf707882042e716df9b57b290c661d4e85031086197bcc5cb0e221a0c34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb0015982730711c599e1c72ffa11ed8be1a6830d7507005154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d1cdac944779dc08a705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe3304000000323e9c707fe81436b024c2574980397bc49d70c060d57bc88fbe3bbaa058b040362ab926150763fb099408885afc2bf9a46a076b7babfcddeff8c35030669ea69f5e4be1b8e0d6697e97186f9ae97d5670dba6623279f73db9dec75070cd9ab0fda6b069ef6d2857ca3e4e6068f1bf710d133d541da86e046e513b3177e4a6cc999dc21c3ef408e6b178e7c9f274d7fafc8d757d33dfa35aa2b2ff7f9a7d365e63845f3e1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cadecc13219ba7518aa4f7db34ead13484742067ab743c1d82a5687f2ed690000010000000000000000000000000000000000000099d4fa0000000000003f0ecdc7c82e72919c91d2039afe17e95edef8ba72205beff7771bcb293747b88486cacee403000000a2919a4b09e168e4e4d5ff2ed893f2e314679fa69fc7e0cf761f91b18725704a01c56009a9f748e5aaf30a10bd8c409b1870c1f75e26b45264e3d3f8e0048e55ae289c2f884d0766cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c1540bf3d162dc1c27fa30f0dc60b9f257db5d1c7ed2efce676a93110904d5e055af44664b53c764d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354da8de21eada75d3a3afb2c76ff0700007976694b6a0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d201721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e671282a2d3066ac968c7d7d7db195f255b1b4a85eb9ee0a3b68c9e209756623adf685dd715d68ed1274b4d5502f512493af8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb20407ff7098b7174bef66fa03a99b5c0c20b378065fac4ef9ac2d0d804b9400000060e5d3f1749f6aecf69ba83a71caa9bdddc679f1b826f74b6563a4be1fd82b73c8c2bc"], 0x0}, 0x90) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r3 = memfd_create(&(0x7f0000000500)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\xee\xf6Oc8\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Ncp\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xe9fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\xdeQ/\xb8X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31W\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\x0e\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]\xd5\xbe\'U\xf17', 0x1) r4 = dup(r3) r5 = memfd_create(&(0x7f0000002600)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb90a\xa9\xb2\x04\x1d\xa1\xce\x8b\x19\xea\xef\xe3\x00\x00\x00\x00\x00x\xdd\x02', 0x0) copy_file_range(r5, 0x0, r4, 0x0, 0x7, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x0, r6, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0, 0x2020, 0x1}) io_uring_enter(r0, 0x27e2, 0x0, 0x0, 0x0, 0x0) 4.062509019s ago: executing program 2 (id=1983): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = userfaultfd(0x800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x2, 0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) socket(0xa, 0x3, 0x3a) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000002c0)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff080045fe00380000000000019078ac1e000100010000000000320000ac14140ae0000001040022eb0000ffff"], 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000300)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0x45c5, 0xc595, 0x7, 0x2, 0x1, 0x2000000000000000, 0x80000004000000, 0xffffffffffffffff], 0x8000000, 0x2010d3}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000200)="440f20c0350b000000440f22c0360f09c4217d700c9d0000000028b8010000000f01c166b82e000f00d80f20d835080000000f22d82e0f019885000000b9b1060000b86f8d0000ba0000000066b8b5008ec036363ef3420f51a600000000b9e30b0000b8f233278fba000000000f30", 0x6f}], 0x1, 0x13, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000000), 0x22482, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) 3.730536724s ago: executing program 3 (id=1984): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001dc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad0e0e2b45d14ee446b840edaa1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c50ce6a8e9f65de13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87915ed063f608dddb03a95b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0fd9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000c3d51d9a161446b4373e06a9e07f8a000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b284"], &(0x7f0000000140)='GPL\x00'}, 0x94) r2 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r2, r1}) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f00000001c0)={r2}) 3.542446208s ago: executing program 0 (id=1985): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001a80)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x24008041}, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_256={{0x303, 0x36}, "00000007e4008000", "8b3de2aabceef22f419e59f30000000004000000000200", "e73400", "000000d900"}, 0x38) 3.359785761s ago: executing program 1 (id=1986): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) syz_usb_disconnect(r0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r1, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/216, 0xd8}], 0x1, 0xa3, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000880)=0x14) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2b}}}]}, 0x38}}, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd21, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x2, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x7, 0x9, 0x10000000, 0x1000, 0x401}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x3, 0x4}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x810}, 0x0) r9 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_IPV6_RTHDR(r9, 0x29, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="00020201"], 0x18) connect$inet6(r9, &(0x7f0000000100)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r10 = dup(r9) write$P9_RGETLOCK(r10, &(0x7f0000000100)={0x28, 0x37, 0x2, {0x0, 0x10000, 0x4, 0x0, 0xa, 'wireguard\x00'}}, 0x28) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@bloom_filter={0x1e, 0x90a, 0x3d, 0x80000000, 0xaa0, r10, 0x0, '\x00', r2, 0xffffffffffffffff, 0x3, 0x5, 0x3, 0x3}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, r11, 0x10000000000000}, 0x38) r12 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x8a00) syz_usb_disconnect(r12) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) fstatfs(r1, &(0x7f0000000940)=""/255) r13 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r13, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r13, &(0x7f0000000340)={&(0x7f00000008c0)={0xa, 0x4e20, 0x80000, @dev={0xfe, 0x80, '\x00', 0x1d}, 0xfffffffe}, 0x1c, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x00\b'], 0x28}, 0x40c0) ioctl$EVIOCRMFF(r12, 0x4004550d, 0x0) 2.82340592s ago: executing program 0 (id=1987): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x240601, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newtfilter={0x8bc, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x88c, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x6, 0x4, 0x0, 0x3ebb, 0x7, 0x8, 0x0, 0x5, 0x4, 0x1ff, 0x3, 0x207e, 0x3, 0xea01, 0x3, 0x7, 0x3, 0x8, 0x2, 0x2, 0x6, 0xfffffffc, 0xfffffff9, 0xbe4, 0x1, 0xffffffff, 0x0, 0x10000, 0xffffffff, 0x4, 0xe, 0x4, 0x7, 0x5a, 0x0, 0x5, 0x6, 0xd77d, 0x9, 0x401, 0x1, 0xfffff801, 0x8, 0x8000, 0x1, 0x1, 0x4, 0x5, 0xcf, 0x80000001, 0x3f7, 0x63, 0x80, 0x5, 0x2, 0xfd6, 0xc7, 0x6, 0x0, 0x40, 0x3, 0x0, 0x6, 0x9d, 0xfb, 0x6, 0x1ff, 0x4, 0x2, 0x1, 0x7, 0x5, 0x2, 0x10001, 0x18, 0x0, 0x7, 0xfffffffe, 0x6a1, 0x8, 0x80, 0x6, 0xe1, 0xff, 0x10, 0x7ff, 0x1, 0x6351, 0x9, 0x1, 0xbc8, 0x1, 0x0, 0x7da, 0x5, 0x57, 0xad5d, 0x5, 0x30000, 0x4, 0xb7, 0x9, 0x0, 0x7, 0x5, 0x6, 0x6, 0x2, 0x77e4, 0x1, 0x7fff, 0xf0e, 0x6789, 0x7, 0x8, 0x9, 0x9, 0x2, 0x8, 0x5, 0x6, 0x6, 0x200, 0x9, 0x8, 0xc, 0x3, 0xfffffff8, 0x9, 0x32, 0x3, 0x6, 0xb7a00, 0x8, 0x10000, 0x8, 0x5, 0x0, 0xffff, 0xffffffff, 0xe83, 0x10000, 0x0, 0x0, 0x2, 0xbda, 0x4, 0x2, 0x8, 0x9, 0x8, 0x9, 0xc, 0x5, 0x0, 0x80000001, 0x1000, 0x7, 0x0, 0x9, 0x8, 0x9, 0x7fff, 0xd, 0x8, 0x8, 0x0, 0x6, 0x1, 0x4, 0xffff6f85, 0x1, 0x5, 0x6, 0x10000, 0xdbc, 0x0, 0x6, 0xe, 0x0, 0x3d, 0x5, 0x2, 0xb5b9, 0x3, 0x3, 0x5, 0x2, 0x336, 0x3, 0x7, 0x4, 0x8, 0x2, 0x95ae, 0x0, 0x3ff, 0x0, 0x5, 0x80000000, 0x9, 0x1, 0x90, 0x4, 0x0, 0xffff, 0x9, 0xb3a, 0xfee, 0x1, 0x9, 0x2, 0x2, 0x9, 0x6, 0x80000001, 0x8, 0x0, 0x3, 0x4, 0x4, 0x0, 0x39dd, 0x7, 0x6, 0x4, 0x6a06, 0x3, 0x7, 0x2, 0xde90, 0x7, 0x8, 0x4, 0x40, 0x7f, 0xb2, 0x5, 0x7, 0x881, 0x8, 0x1, 0xfffffff6, 0x3, 0x1, 0x7, 0x0, 0x1, 0x401, 0x7, 0x5, 0x7, 0x2000000, 0x3, 0x7]}]}, @TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x2, 0x9, 0x3, 0x3fc, 0x6, 0x994, 0xff, 0x10000, 0xa, 0x7, 0xbb, 0x8000, 0x7, 0x40, 0x6, 0x75359e2a, 0x3f37, 0x6, 0x6, 0x80, 0x1, 0x2, 0x7ff, 0x7, 0x5, 0x8, 0x800, 0x6, 0x1, 0xe6, 0x9, 0xe, 0x6, 0x7, 0xcb, 0x4, 0x7, 0x80000001, 0x9, 0x6, 0x1, 0xddf, 0x0, 0xe9c, 0x0, 0x3, 0x2, 0x6, 0x7, 0x1, 0xc, 0xceb4, 0x6, 0x5, 0x101, 0xfffffff7, 0x9, 0x80000001, 0x4, 0x3, 0x9, 0xb248, 0x4, 0x40, 0x9, 0x9, 0x8, 0x8001, 0x7, 0x1, 0x7, 0x9, 0x5, 0x2, 0x80000001, 0x3, 0x1, 0x6, 0x3, 0x8, 0x42, 0x1, 0x2, 0x5, 0x81, 0x9, 0x800, 0xda5, 0xa799, 0x1, 0x1209, 0x8, 0x5, 0x537, 0x4d410467, 0x6, 0x8, 0x5, 0x7, 0x3ff, 0x6, 0x10, 0x45, 0xa, 0x4, 0x1, 0x3, 0x7, 0x2, 0xffff, 0x4, 0x80000000, 0x8, 0x40, 0x6cf0, 0x9, 0x7, 0x8001, 0x6, 0x5, 0x6, 0xffff, 0x8000, 0x2, 0x6, 0x80000000, 0xb0a, 0x1, 0x101, 0x6, 0x54, 0x0, 0x5, 0x6, 0x8, 0x4, 0x9b, 0x6, 0x2, 0x200, 0x9, 0x4b6, 0x2, 0x1, 0x7629, 0x7ff, 0x0, 0xfffffe01, 0x9, 0x400, 0x8, 0x1, 0xd2, 0xc, 0x3, 0x18fe, 0x1, 0x7fffffff, 0x1, 0x2, 0xfff, 0x1, 0x9, 0x1, 0x401, 0x81, 0x5, 0x4, 0x7, 0x8, 0x5, 0x2, 0xfff, 0xbb, 0x5, 0x7fff, 0x0, 0x9ad0, 0x8d, 0x59acca75, 0x0, 0x1, 0xffffffff, 0x3, 0x5, 0x4, 0x5, 0x8, 0x0, 0x6, 0x7, 0xb, 0x6, 0x1000, 0x6, 0xfffffff9, 0x1, 0x8, 0x2, 0xd, 0xa1e, 0xfffffff7, 0x9, 0x0, 0xffffffff, 0xa, 0x3f, 0x5, 0xfffff801, 0xffffffff, 0x1b84, 0x7, 0x7fff, 0x6, 0x416, 0x0, 0x0, 0xa54, 0x1, 0x6, 0xffffffff, 0x8001, 0xe, 0x6, 0x800, 0x0, 0x4, 0xfffffffa, 0x6, 0x6, 0xfffeffff, 0x7, 0x3, 0x2, 0xfffff5d7, 0x5, 0x0, 0x3a3, 0x2, 0x8, 0x0, 0x0, 0x81, 0x8b, 0x4, 0x4, 0xa1, 0x4, 0x8, 0x0, 0xfffffffe, 0x0, 0x0, 0x1e, 0x6]}]}, @TCA_CGROUP_POLICE={0x18, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0xe9e}]}, @TCA_CGROUP_EMATCHES={0x60, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x237, 0x0, 0x4}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x0, 0x3, 0x3}, {0x9, 0x3, 0x7, 0x200}}}]}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x1, 0x1, 0xbc}, {0x1, 0x81, 0x6, 0x1, 0x7, 0x2}}}, @TCF_EM_IPT={0x14, 0x2, 0x0, 0x0, {{0x7, 0x9, 0x90}, [@TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x3}]}}]}]}]}}]}, 0x8bc}, 0x1, 0x0, 0x0, 0x84}, 0x8000) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 2.648695789s ago: executing program 3 (id=1988): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x239, &(0x7f0000000480)={0x0, 0x8901, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000280)=@ethtool_ringparam={0x33, 0x83, 0xffff, 0x401000, 0xe, 0x3, 0x2000001, 0x1, 0xb000000}}) socket$inet_smc(0x2b, 0x1, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x2007, @fd, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) io_uring_enter(r2, 0x47ba, 0x100, 0x5, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r2, 0x18, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x1, {0x7, 0xa44}, 0x80}, 0x1) io_uring_enter(r2, 0xfd5, 0x4ecb, 0x0, &(0x7f00000000c0)={[0x2]}, 0x8) 2.577505454s ago: executing program 0 (id=1989): setsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) (async) socket(0x200000000000011, 0x3, 0x7) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$packet(0x11, 0x2, 0x300) (async) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000", 0x36}], 0x1) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{0x0}], 0x1) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x141301) ioctl$USBDEVFS_CLEAR_HALT(r2, 0x80045515, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r4) (async) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000700)=@filter={'filter\x00', 0x42, 0x4, 0x330, 0xffffffff, 0x98, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x298, 0x298, 0x298, 0xffffffff, 0x4, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'vlan0\x00', {0xff}, {0xff}, 0x8, 0x0, 0x17}, 0x0, 0x70, 0x98, 0x0, {0x100000000000000}}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@icmp={{0x28}, {0x10, "b630"}}, @common=@osf={{0x50}, {'syz1\x00', 0x0, 0xb, 0x0, 0x1}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x0, 0x0, {0x2}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @empty, 0x0, 0x8, [0xa, 0x25, 0x2a, 0xa, 0x13, 0xe, 0x29, 0x21, 0x38, 0x21, 0x40, 0x20, 0x28, 0x18, 0x22, 0x1e], 0x1, 0x0, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffd}}}}, 0x390) (async, rerun: 32) lsetxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x3) (async, rerun: 32) r5 = fsopen(&(0x7f00000000c0)='msdos\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, 0x0, &(0x7f0000000b00)='\xbf%#\x00', 0x0) (async, rerun: 32) syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) (rerun: 32) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[], 0x50) (async, rerun: 64) getpgrp(0x0) (async, rerun: 64) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r6, &(0x7f0000000180)=ANY=[@ANYBLOB="7f454c4620040000000000100000000002003e00ebffffff7c000000000000004000000000000000020000000000000000000000060038000100feff03000300030000000f000000080000000000000013000000000000000000000000000000e500000000000000010000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d9fa6a50000000000000000000000000000000000000000000000000000000075187a2c6290e5487a971aedab150000000000000000000000000000000000000000000000000000000000000000b800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006914bfa73c63790447642d8fc8201ffef7b8a523d06ba6797aea22dab8c6dfea9178724c12880d987df337acb4c45ed6a22227c176ba4916fc67b3ecea93bfd56096d3328e0f1f6b386a14ad56625fe578c2d04dda65ebed9ff7027aa6a81e0893e16a791917bf6d1a21adc1b80dc457ceb79665372ac48491522841b40cca0fb6a2caccbd882f1d438c41e5fd2375e0702ca1d05d09bc4c19d4aa2d734d78d1cb48c8bb9f3d2889b89fc878a1a489703c8d2fe15f7811e844cade6a1633305c115ca98c7eae68a1a97cc08f01e93028bba6a930e21d6b1b3610fa845b1835421975ab76c6e61f61f482"], 0x178) (async) close(r6) 2.060822746s ago: executing program 2 (id=1990): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="2000000072009fb30008000004000000070000a6", @ANYRES32=0x0, @ANYBLOB="080001"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x8000) 1.943792517s ago: executing program 2 (id=1991): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000001c0)="b9800000c00f3235000400000f30440f20c03508000000440f22c036646665f36526f20f22a5430f01c566ba4000edc4a39979250b00000008b9800000c00f3235010000000f30f245ab48b800000000000000800f23c00f21f83500000b000f23f8c481e57dcd", 0x67}], 0x1, 0x10, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001200)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x8050}, 0x4001c) ioctl$KVM_RUN(r3, 0xae80, 0x3800000000000000) 1.724629464s ago: executing program 4 (id=1992): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000084000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c00008008000340000000022c0000000e0a8d5dda63e717542700000a0000000900010073797a31000000000900020073797a31"], 0xdc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) 1.557341277s ago: executing program 4 (id=1993): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(0xffffffffffffffff, &(0x7f0000000380)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x20}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x1, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x4e21, 0x20, 0x41424344, 0x41424344, 0x0, 0x5, 0x6, 0x0, 0x5, 0x0, 0x18, {[@sack={0x5, 0x2}]}}}}}}, 0x3a) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x14001, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000040)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x1c, 0x6, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, {[], {{0x4e24, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}]}}}}}}}}, 0x0) ioctl$TIOCSETD(r2, 0x5423, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x24, 0x0, 0x0) r3 = syz_open_dev$usbmon(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x12, r3, 0xc3d33000) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r4, &(0x7f0000001b40)={&(0x7f0000000200)=@name={0x1e, 0x2, 0x1, {{0x0, 0xffffffff}, 0x10000000}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x5c, 0x2, [@TCA_FW_ACT={0x58, 0x4, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0xfffffffffffffe87, 0x2, {{0x4, 0xfb, 0x3, 0x2, 0x9}, 0x3}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xaee}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x84}, 0x8000) 1.443951318s ago: executing program 2 (id=1994): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c00000010000305000000000000000000000003", @ANYRES32=0x0, @ANYBLOB="ef00000000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r1], 0x4c}, 0x1, 0x0, 0x0, 0x4008040}, 0x0) 1.356822714s ago: executing program 4 (id=1995): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000007000000324900007f00000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r0, 0x0, 0x20}, 0x38) 1.275377468s ago: executing program 2 (id=1996): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x240601, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newtfilter={0x8c8, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x898, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x6, 0x4, 0x0, 0x3ebb, 0x7, 0x8, 0x0, 0x5, 0x4, 0x1ff, 0x3, 0x207e, 0x3, 0xea01, 0x3, 0x7, 0x3, 0x8, 0x2, 0x2, 0x6, 0xfffffffc, 0xfffffff9, 0xbe4, 0x1, 0xffffffff, 0x0, 0x10000, 0xffffffff, 0x4, 0xe, 0x4, 0x7, 0x5a, 0x0, 0x5, 0x6, 0xd77d, 0x9, 0x401, 0x1, 0xfffff801, 0x8, 0x8000, 0x1, 0x1, 0x4, 0x5, 0xcf, 0x80000001, 0x3f7, 0x63, 0x80, 0x5, 0x2, 0xfd6, 0xc7, 0x6, 0x0, 0x40, 0x3, 0x0, 0x6, 0x9d, 0xfb, 0x6, 0x1ff, 0x4, 0x2, 0x1, 0x7, 0x5, 0x2, 0x10001, 0x18, 0x0, 0x7, 0xfffffffe, 0x6a1, 0x8, 0x80, 0x6, 0xe1, 0xff, 0x10, 0x7ff, 0x1, 0x6351, 0x9, 0x1, 0xbc8, 0x1, 0x0, 0x7da, 0x5, 0x57, 0xad5d, 0x5, 0x30000, 0x4, 0xb7, 0x9, 0x0, 0x7, 0x5, 0x6, 0x6, 0x2, 0x77e4, 0x1, 0x7fff, 0xf0e, 0x6789, 0x7, 0x8, 0x9, 0x9, 0x2, 0x8, 0x5, 0x6, 0x6, 0x200, 0x9, 0x8, 0xc, 0x3, 0xfffffff8, 0x9, 0x32, 0x3, 0x6, 0xb7a00, 0x8, 0x10000, 0x8, 0x5, 0x0, 0xffff, 0xffffffff, 0xe83, 0x10000, 0x0, 0x0, 0x2, 0xbda, 0x4, 0x2, 0x8, 0x9, 0x8, 0x9, 0xc, 0x5, 0x0, 0x80000001, 0x1000, 0x7, 0x0, 0x9, 0x8, 0x9, 0x7fff, 0xd, 0x8, 0x8, 0x0, 0x6, 0x1, 0x4, 0xffff6f85, 0x1, 0x5, 0x6, 0x10000, 0xdbc, 0x0, 0x6, 0xe, 0x0, 0x3d, 0x5, 0x2, 0xb5b9, 0x3, 0x3, 0x5, 0x2, 0x336, 0x3, 0x7, 0x4, 0x8, 0x2, 0x95ae, 0x0, 0x3ff, 0x0, 0x5, 0x80000000, 0x9, 0x1, 0x90, 0x4, 0x0, 0xffff, 0x9, 0xb3a, 0xfee, 0x1, 0x9, 0x2, 0x2, 0x9, 0x6, 0x80000001, 0x8, 0x0, 0x3, 0x4, 0x4, 0x0, 0x39dd, 0x7, 0x6, 0x4, 0x6a06, 0x3, 0x7, 0x2, 0xde90, 0x7, 0x8, 0x4, 0x40, 0x7f, 0xb2, 0x5, 0x7, 0x881, 0x8, 0x1, 0xfffffff6, 0x3, 0x1, 0x7, 0x0, 0x1, 0x401, 0x7, 0x5, 0x7, 0x2000000, 0x3, 0x7]}]}, @TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x2, 0x9, 0x3, 0x3fc, 0x6, 0x994, 0xff, 0x10000, 0xa, 0x7, 0xbb, 0x8000, 0x7, 0x40, 0x6, 0x75359e2a, 0x3f37, 0x6, 0x6, 0x80, 0x1, 0x2, 0x7ff, 0x7, 0x5, 0x8, 0x800, 0x6, 0x1, 0xe6, 0x9, 0xe, 0x6, 0x7, 0xcb, 0x4, 0x7, 0x80000001, 0x9, 0x6, 0x1, 0xddf, 0x0, 0xe9c, 0x0, 0x3, 0x2, 0x6, 0x7, 0x1, 0xc, 0xceb4, 0x6, 0x5, 0x101, 0xfffffff7, 0x9, 0x80000001, 0x4, 0x3, 0x9, 0xb248, 0x4, 0x40, 0x9, 0x9, 0x8, 0x8001, 0x7, 0x1, 0x7, 0x9, 0x5, 0x2, 0x80000001, 0x3, 0x1, 0x6, 0x3, 0x8, 0x42, 0x1, 0x2, 0x5, 0x81, 0x9, 0x800, 0xda5, 0xa799, 0x1, 0x1209, 0x8, 0x5, 0x537, 0x4d410467, 0x6, 0x8, 0x5, 0x7, 0x3ff, 0x6, 0x10, 0x45, 0xa, 0x4, 0x1, 0x3, 0x7, 0x2, 0xffff, 0x4, 0x80000000, 0x8, 0x40, 0x6cf0, 0x9, 0x7, 0x8001, 0x6, 0x5, 0x6, 0xffff, 0x8000, 0x2, 0x6, 0x80000000, 0xb0a, 0x1, 0x101, 0x6, 0x54, 0x0, 0x5, 0x6, 0x8, 0x4, 0x9b, 0x6, 0x2, 0x200, 0x9, 0x4b6, 0x2, 0x1, 0x7629, 0x7ff, 0x0, 0xfffffe01, 0x9, 0x400, 0x8, 0x1, 0xd2, 0xc, 0x3, 0x18fe, 0x1, 0x7fffffff, 0x1, 0x2, 0xfff, 0x1, 0x9, 0x1, 0x401, 0x81, 0x5, 0x4, 0x7, 0x8, 0x5, 0x2, 0xfff, 0xbb, 0x5, 0x7fff, 0x0, 0x9ad0, 0x8d, 0x59acca75, 0x0, 0x1, 0xffffffff, 0x3, 0x5, 0x4, 0x5, 0x8, 0x0, 0x6, 0x7, 0xb, 0x6, 0x1000, 0x6, 0xfffffff9, 0x1, 0x8, 0x2, 0xd, 0xa1e, 0xfffffff7, 0x9, 0x0, 0xffffffff, 0xa, 0x3f, 0x5, 0xfffff801, 0xffffffff, 0x1b84, 0x7, 0x7fff, 0x6, 0x416, 0x0, 0x0, 0xa54, 0x1, 0x6, 0xffffffff, 0x8001, 0xe, 0x6, 0x800, 0x0, 0x4, 0xfffffffa, 0x6, 0x6, 0xfffeffff, 0x7, 0x3, 0x2, 0xfffff5d7, 0x5, 0x0, 0x3a3, 0x2, 0x8, 0x0, 0x0, 0x81, 0x8b, 0x4, 0x4, 0xa1, 0x4, 0x8, 0x0, 0xfffffffe, 0x0, 0x0, 0x1e, 0x6]}]}, @TCA_CGROUP_EMATCHES={0xc, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xe}}]}, @TCA_CGROUP_POLICE={0x18, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0xe9e}]}, @TCA_CGROUP_EMATCHES={0x60, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x237, 0x0, 0x4}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x0, 0x3, 0x3}, {0x9, 0x3, 0x7, 0x200}}}]}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x1, 0x1, 0xbc}, {0x1, 0x81, 0x6, 0x1, 0x7, 0x2}}}, @TCF_EM_IPT={0x14, 0x2, 0x0, 0x0, {{0x7, 0x9, 0x90}, [@TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x3}]}}]}]}]}}]}, 0x8c8}, 0x1, 0x0, 0x0, 0x84}, 0x8000) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 1.071679679s ago: executing program 4 (id=1997): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=@newqdisc={0x24, 0x24, 0x8, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {}, {0xfff2, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xfffa, 0x2}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x86dd}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x3a}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040000}, 0x24000000) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000210029bd70000000000003000000261dc0a2a0bce5a1c46f809e501b0ee190ee3546a513c2ce512c52974466b8c8eca567b44e8cb98cdb3501c67433b9a9190d1a10ebe008370d82cc25694c8a55b4ae05b7649ad82d01bf74f1f6aa5becb38784b90e50b18c6e1affd21249369cdc525c26df2202565e983136fcf3ad7be64204880946f658f4a079a81dc6e7650530a72c416aa79026d28910dc4f8c0f79ada2d827280000645735e8f32c096d71a082ad2b2354f84b83eab7d374d23fdc4a59ea4d48816c639fa50aa5000e626a0a783004cc776feac34ad5deb6bb8777929dc1d21a67dc00"/249], 0x14}, 0x1, 0x0, 0x0, 0x20000801}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f7f"], 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.009358612s ago: executing program 2 (id=1998): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) unshare(0x1e028180) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x98}}, 0x20050800) syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000800)={'filter\x00', 0x104, 0x4, 0x3c8, 0x1f8, 0x0, 0x110, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@empty, @broadcast, 0x0, 0x0, 0x81, 0x0, {}, {@empty, {[0x0, 0x0, 0x0, 0xff]}}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'netdevsim0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @empty, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x64010101, 0x8, 0x1}}}, {{@arp={@loopback, @local, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00', {}, {}, 0x0, 0x20}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x80ca, 0x8}}}, {{@arp={@rand_addr=0x64010100, @loopback, 0xff, 0x0, 0x0, 0x1, {@mac, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}, {@mac=@broadcast, {[0x0, 0x0, 0x88ede4f229c5de10, 0xff]}}, 0x0, 0x7, 0xfff7, 0x8, 0x9, 0xf, 'wg0\x00', 'pim6reg0\x00', {}, {}, 0x0, 0x200}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0xc0, 0xe8}, {0x20}}}}, 0x418) 868.913264ms ago: executing program 4 (id=1999): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x240601, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newtfilter={0x8bc, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x88c, 0x2, [@TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x6, 0x4, 0x0, 0x3ebb, 0x7, 0x8, 0x0, 0x5, 0x4, 0x1ff, 0x3, 0x207e, 0x3, 0xea01, 0x3, 0x7, 0x3, 0x8, 0x2, 0x2, 0x6, 0xfffffffc, 0xfffffff9, 0xbe4, 0x1, 0xffffffff, 0x0, 0x10000, 0xffffffff, 0x4, 0xe, 0x4, 0x7, 0x5a, 0x0, 0x5, 0x6, 0xd77d, 0x9, 0x401, 0x1, 0xfffff801, 0x8, 0x8000, 0x1, 0x1, 0x4, 0x5, 0xcf, 0x80000001, 0x3f7, 0x63, 0x80, 0x5, 0x2, 0xfd6, 0xc7, 0x6, 0x0, 0x40, 0x3, 0x0, 0x6, 0x9d, 0xfb, 0x6, 0x1ff, 0x4, 0x2, 0x1, 0x7, 0x5, 0x2, 0x10001, 0x18, 0x0, 0x7, 0xfffffffe, 0x6a1, 0x8, 0x80, 0x6, 0xe1, 0xff, 0x10, 0x7ff, 0x1, 0x6351, 0x9, 0x1, 0xbc8, 0x1, 0x0, 0x7da, 0x5, 0x57, 0xad5d, 0x5, 0x30000, 0x4, 0xb7, 0x9, 0x0, 0x7, 0x5, 0x6, 0x6, 0x2, 0x77e4, 0x1, 0x7fff, 0xf0e, 0x6789, 0x7, 0x8, 0x9, 0x9, 0x2, 0x8, 0x5, 0x6, 0x6, 0x200, 0x9, 0x8, 0xc, 0x3, 0xfffffff8, 0x9, 0x32, 0x3, 0x6, 0xb7a00, 0x8, 0x10000, 0x8, 0x5, 0x0, 0xffff, 0xffffffff, 0xe83, 0x10000, 0x0, 0x0, 0x2, 0xbda, 0x4, 0x2, 0x8, 0x9, 0x8, 0x9, 0xc, 0x5, 0x0, 0x80000001, 0x1000, 0x7, 0x0, 0x9, 0x8, 0x9, 0x7fff, 0xd, 0x8, 0x8, 0x0, 0x6, 0x1, 0x4, 0xffff6f85, 0x1, 0x5, 0x6, 0x10000, 0xdbc, 0x0, 0x6, 0xe, 0x0, 0x3d, 0x5, 0x2, 0xb5b9, 0x3, 0x3, 0x5, 0x2, 0x336, 0x3, 0x7, 0x4, 0x8, 0x2, 0x95ae, 0x0, 0x3ff, 0x0, 0x5, 0x80000000, 0x9, 0x1, 0x90, 0x4, 0x0, 0xffff, 0x9, 0xb3a, 0xfee, 0x1, 0x9, 0x2, 0x2, 0x9, 0x6, 0x80000001, 0x8, 0x0, 0x3, 0x4, 0x4, 0x0, 0x39dd, 0x7, 0x6, 0x4, 0x6a06, 0x3, 0x7, 0x2, 0xde90, 0x7, 0x8, 0x4, 0x40, 0x7f, 0xb2, 0x5, 0x7, 0x881, 0x8, 0x1, 0xfffffff6, 0x3, 0x1, 0x7, 0x0, 0x1, 0x401, 0x7, 0x5, 0x7, 0x2000000, 0x3, 0x7]}]}, @TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x2, 0x9, 0x3, 0x3fc, 0x6, 0x994, 0xff, 0x10000, 0xa, 0x7, 0xbb, 0x8000, 0x7, 0x40, 0x6, 0x75359e2a, 0x3f37, 0x6, 0x6, 0x80, 0x1, 0x2, 0x7ff, 0x7, 0x5, 0x8, 0x800, 0x6, 0x1, 0xe6, 0x9, 0xe, 0x6, 0x7, 0xcb, 0x4, 0x7, 0x80000001, 0x9, 0x6, 0x1, 0xddf, 0x0, 0xe9c, 0x0, 0x3, 0x2, 0x6, 0x7, 0x1, 0xc, 0xceb4, 0x6, 0x5, 0x101, 0xfffffff7, 0x9, 0x80000001, 0x4, 0x3, 0x9, 0xb248, 0x4, 0x40, 0x9, 0x9, 0x8, 0x8001, 0x7, 0x1, 0x7, 0x9, 0x5, 0x2, 0x80000001, 0x3, 0x1, 0x6, 0x3, 0x8, 0x42, 0x1, 0x2, 0x5, 0x81, 0x9, 0x800, 0xda5, 0xa799, 0x1, 0x1209, 0x8, 0x5, 0x537, 0x4d410467, 0x6, 0x8, 0x5, 0x7, 0x3ff, 0x6, 0x10, 0x45, 0xa, 0x4, 0x1, 0x3, 0x7, 0x2, 0xffff, 0x4, 0x80000000, 0x8, 0x40, 0x6cf0, 0x9, 0x7, 0x8001, 0x6, 0x5, 0x6, 0xffff, 0x8000, 0x2, 0x6, 0x80000000, 0xb0a, 0x1, 0x101, 0x6, 0x54, 0x0, 0x5, 0x6, 0x8, 0x4, 0x9b, 0x6, 0x2, 0x200, 0x9, 0x4b6, 0x2, 0x1, 0x7629, 0x7ff, 0x0, 0xfffffe01, 0x9, 0x400, 0x8, 0x1, 0xd2, 0xc, 0x3, 0x18fe, 0x1, 0x7fffffff, 0x1, 0x2, 0xfff, 0x1, 0x9, 0x1, 0x401, 0x81, 0x5, 0x4, 0x7, 0x8, 0x5, 0x2, 0xfff, 0xbb, 0x5, 0x7fff, 0x0, 0x9ad0, 0x8d, 0x59acca75, 0x0, 0x1, 0xffffffff, 0x3, 0x5, 0x4, 0x5, 0x8, 0x0, 0x6, 0x7, 0xb, 0x6, 0x1000, 0x6, 0xfffffff9, 0x1, 0x8, 0x2, 0xd, 0xa1e, 0xfffffff7, 0x9, 0x0, 0xffffffff, 0xa, 0x3f, 0x5, 0xfffff801, 0xffffffff, 0x1b84, 0x7, 0x7fff, 0x6, 0x416, 0x0, 0x0, 0xa54, 0x1, 0x6, 0xffffffff, 0x8001, 0xe, 0x6, 0x800, 0x0, 0x4, 0xfffffffa, 0x6, 0x6, 0xfffeffff, 0x7, 0x3, 0x2, 0xfffff5d7, 0x5, 0x0, 0x3a3, 0x2, 0x8, 0x0, 0x0, 0x81, 0x8b, 0x4, 0x4, 0xa1, 0x4, 0x8, 0x0, 0xfffffffe, 0x0, 0x0, 0x1e, 0x6]}]}, @TCA_CGROUP_POLICE={0x18, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0xe9e}]}, @TCA_CGROUP_EMATCHES={0x60, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x237, 0x0, 0x4}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x0, 0x3, 0x3}, {0x9, 0x3, 0x7, 0x200}}}]}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x1, 0x1, 0xbc}, {0x1, 0x81, 0x6, 0x1, 0x7, 0x2}}}, @TCF_EM_IPT={0x14, 0x2, 0x0, 0x0, {{0x7, 0x9, 0x90}, [@TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x3}]}}]}]}]}}]}, 0x8bc}, 0x1, 0x0, 0x0, 0x84}, 0x8000) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5393, &(0x7f0000000000)) 731.071114ms ago: executing program 3 (id=2000): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010601bc3bd020402012c651e50102030109021200017b63200909040002"], 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, 0x0, &(0x7f0000000980)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x8, 0x3, 0x258, 0x0, 0xa, 0x148, 0xe8, 0x60, 0x1c0, 0x2a8, 0x2a8, 0x1c0, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0xc0, 0xe8, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@socket2={{0x28}, 0x1}, @common=@inet=@ecn={{0x28}, {0x1, 0x10, 0x7, 0x7f}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x2, 0x1, 0xd8cb, 'netbios-ns\x00', 'syz1\x00', {0xa000000000000000}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0xffffffffffffff37) syz_usb_connect(0x5, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="12010601bc3bd020402012c651e50102030109021200017b63200909040002"], 0x0) (async) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, 0x0, &(0x7f0000000980)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x8, 0x3, 0x258, 0x0, 0xa, 0x148, 0xe8, 0x60, 0x1c0, 0x2a8, 0x2a8, 0x1c0, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0xc0, 0xe8, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@socket2={{0x28}, 0x1}, @common=@inet=@ecn={{0x28}, {0x1, 0x10, 0x7, 0x7f}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x2, 0x1, 0xd8cb, 'netbios-ns\x00', 'syz1\x00', {0xa000000000000000}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0xffffffffffffff37) (async) 599.823704ms ago: executing program 4 (id=2001): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000024917720042322023f77010203010902120001000010000904"], 0x0) syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) syz_open_dev$sndctrl(&(0x7f00000000c0), 0x9, 0x240302) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100008e88052086800095d89301020301090212000100000000090401"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000400)={&(0x7f0000000000)=[{0x0, 0x2000, 0x0, 0x0}, {0x8000, 0x6000, 0x0, 0x0}], 0x2}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000100)={'erspan0\x00', {0x2, 0x4e23, @multicast2}}) mknodat(0xffffffffffffff9c, &(0x7f0000000180)='./file5\x00', 0x61c0, 0x700) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000000000404c054b0200000000000109022400010000000009040000010300000009210000"], 0x0) r3 = syz_open_dev$sg(0x0, 0x6f5e, 0x101) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) connect$unix(0xffffffffffffffff, 0x0, 0x0) quotactl_fd$Q_GETFMT(0xffffffffffffffff, 0xffffffff80000401, 0x0, 0x0) quotactl_fd$Q_GETQUOTA(0xffffffffffffffff, 0xffffffff80000702, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0xb, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x8004) r7 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, 0x0, &(0x7f0000000580)=@chain) io_setup(0x10000, &(0x7f0000000800)) io_setup(0x9, &(0x7f0000002e40)) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000500)={0x53, 0xfffffffffffffffe, 0x0, 0x81, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0xc166, 0x10010, 0x3, 0x0}) syz_usb_control_io$hid(r2, &(0x7f0000000100)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) 465.219928ms ago: executing program 0 (id=2002): sendto$inet(0xffffffffffffffff, &(0x7f0000000100)="1c", 0x1, 0x0, &(0x7f0000001100)={0x2, 0x0, @private}, 0x10) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(r1, 0x0, 0x0, 0xfffffe04, 0x1) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r2) syz_usb_connect(0x6, 0x24, &(0x7f0000000200)=ANY=[], 0x0) ioctl$EVIOCRMFF(r2, 0x40085503, 0x0) 0s ago: executing program 1 (id=2003): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r7, 0x40345410, &(0x7f0000000300)={{0x0, 0x1, 0x7f, 0x1}}) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r7, 0x80605414, &(0x7f0000000000)) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=@newqdisc={0x50, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x81}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x842}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) bind$packet(r3, &(0x7f0000000040)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r3, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close_range(r2, 0xffffffffffffffff, 0x2) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r1, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newlink={0x60, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, r1, 0x42024, 0x8d85}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_DIR={0x5}, @IFLA_GRE_LOCAL={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040014}, 0x0) ioctl$XFS_IOC_FSBULKSTAT(r9, 0xc0205865, &(0x7f0000000500)={&(0x7f00000001c0)=0x7, 0x26, &(0x7f0000000940)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000300)}) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r10, 0x408c5333, &(0x7f0000000540)={0xd9f6, 0x7, 0x0, 'queue1\x00', 0x9625}) kernel console output (not intermixed with test programs): [ 463.442349][ T30] kauditd_printk_skb: 53 callbacks suppressed [ 463.442366][ T30] audit: type=1326 audit(1773907530.948:510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11402 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 463.717226][ T30] audit: type=1326 audit(1773907530.948:511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11402 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 463.762490][T11409] netlink: 2028 bytes leftover after parsing attributes in process `syz.1.1543'. [ 463.771924][T11409] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1543'. [ 463.817418][ T30] audit: type=1326 audit(1773907531.018:512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11402 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 463.920854][ T30] audit: type=1326 audit(1773907531.048:513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11402 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 464.005404][ T30] audit: type=1326 audit(1773907531.048:514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11408 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f4f1ef5cfce code=0x7ffc0000 [ 464.046647][T11414] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1546'. [ 464.067256][ T30] audit: type=1326 audit(1773907531.138:515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11402 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 464.116593][ T30] audit: type=1326 audit(1773907531.138:516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11402 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 464.156434][T11416] vlan2: entered allmulticast mode [ 464.172291][T11416] team0: entered allmulticast mode [ 464.183242][T11416] team_slave_0: entered allmulticast mode [ 464.189135][ T30] audit: type=1326 audit(1773907531.138:517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11402 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 464.215572][T11416] team_slave_1: entered allmulticast mode [ 464.264734][ T30] audit: type=1326 audit(1773907531.138:518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11402 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 464.298769][ T30] audit: type=1326 audit(1773907531.268:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11408 comm="syz.3.1544" exe="/root/syz-executor" sig=0 arch=c000003e syscall=60 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 464.479028][ T5914] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 464.588080][T11425] syzkaller1: entered promiscuous mode [ 464.599968][T11425] syzkaller1: entered allmulticast mode [ 464.667341][ T5914] usb 3-1: Using ep0 maxpacket: 16 [ 464.677732][ T5914] usb 3-1: config 2 has an invalid interface number: 85 but max is 3 [ 464.687558][ T5914] usb 3-1: config 2 has an invalid interface number: 7 but max is 3 [ 464.706287][ T5914] usb 3-1: config 2 has an invalid interface number: 240 but max is 3 [ 464.764306][ T5914] usb 3-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 464.779392][ T5914] usb 3-1: config 2 has an invalid interface number: 92 but max is 3 [ 464.797761][ T5914] usb 3-1: config 2 has no interface number 0 [ 464.844719][ T5914] usb 3-1: config 2 has no interface number 1 [ 464.876239][ T5914] usb 3-1: config 2 has no interface number 2 [ 464.901935][ T5914] usb 3-1: config 2 has no interface number 3 [ 464.929823][ T5914] usb 3-1: config 2 interface 85 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 464.946492][ T5914] usb 3-1: config 2 interface 85 altsetting 6 bulk endpoint 0x4 has invalid maxpacket 1023 [ 464.987705][T11433] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1553'. [ 465.031933][ T5914] usb 3-1: config 2 interface 85 altsetting 6 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 465.058009][ T5914] usb 3-1: config 2 interface 85 altsetting 6 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 465.083747][T11433] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1553'. [ 465.101972][ T5914] usb 3-1: config 2 interface 7 altsetting 5 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 465.197071][ T5914] usb 3-1: config 2 interface 7 altsetting 5 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 465.220157][ T5914] usb 3-1: config 2 interface 7 altsetting 5 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 465.243049][ T5914] usb 3-1: config 2 interface 7 altsetting 5 has a duplicate endpoint with address 0x6, skipping [ 465.257310][ T5914] usb 3-1: config 2 interface 240 altsetting 2 bulk endpoint 0xE has invalid maxpacket 32 [ 465.273817][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has a duplicate endpoint with address 0xC, skipping [ 465.286130][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has a duplicate endpoint with address 0x8B, skipping [ 465.317359][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has a duplicate endpoint with address 0x8, skipping [ 465.328796][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has a duplicate endpoint with address 0x8E, skipping [ 465.340185][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has a duplicate endpoint with address 0xF, skipping [ 465.352243][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has a duplicate endpoint with address 0x4, skipping [ 465.387608][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 465.438176][T11440] openvswitch: netlink: VXLAN extension message has 16 unknown bytes. [ 465.512031][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 465.633928][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 465.665903][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has a duplicate endpoint with address 0xA, skipping [ 465.702042][ T5914] usb 3-1: config 2 interface 240 altsetting 2 has a duplicate endpoint with address 0x7, skipping [ 465.729113][ T5914] usb 3-1: config 2 interface 85 has no altsetting 0 [ 465.756172][ T5914] usb 3-1: config 2 interface 7 has no altsetting 0 [ 465.797317][ T5914] usb 3-1: config 2 interface 240 has no altsetting 0 [ 465.820161][ T5914] usb 3-1: config 2 interface 92 has no altsetting 0 [ 465.861259][T11447] [U] .h0FwZ,iqgҏV2sO [ 465.867508][T11447] [U] ` w*BBOLhU [ 465.872033][T11447] [U] w$n|#%o.z\̧mРw [ 465.894161][T11442] pim6reg: entered allmulticast mode [ 465.902729][T11442] pim6reg: left allmulticast mode [ 465.940849][ T5914] usb 3-1: New USB device found, idVendor=2cb7, idProduct=0115, bcdDevice=2f.ef [ 465.950298][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.967276][ T5914] usb 3-1: Product: syz [ 465.981790][ T5914] usb 3-1: Manufacturer: syz [ 465.986398][ T5914] usb 3-1: SerialNumber: syz [ 466.038025][T11417] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 466.144534][T11453] syzkaller0: entered promiscuous mode [ 466.167059][T11453] syzkaller0: entered allmulticast mode [ 466.198009][ T5934] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 466.246665][T11416] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1547'. [ 466.307502][T11417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.318959][T11417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 466.341926][T11417] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1547'. [ 466.425256][ T5934] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 466.469027][ T5934] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 466.523577][ T5934] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 466.569627][T11444] [U] R{ꫢ S [ 466.602303][ T5934] usb 2-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 466.683678][ T5934] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 466.705957][ T5934] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 466.724380][ T5934] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 466.758013][ T5934] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 466.787869][ T5934] usb 2-1: Product: syz [ 466.800477][ T5934] usb 2-1: Manufacturer: syz [ 466.841998][T11443] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 466.853016][ T5934] cdc_wdm 2-1:1.0: skipping garbage [ 466.865409][ T5934] cdc_wdm 2-1:1.0: skipping garbage [ 466.903376][ T5934] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 466.917241][ T5934] cdc_wdm 2-1:1.0: Unknown control protocol [ 466.937484][ T9] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 467.107454][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 467.123469][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 467.131768][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 467.174775][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 467.215310][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 467.260921][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 467.297757][T11416] bond3: option arp_missed_max: mode dependency failed, not supported in mode balance-tlb(5) [ 467.308883][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 467.330617][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 467.359292][T11416] bond3 (unregistering): Released all slaves [ 467.388640][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 467.408414][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 467.427854][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 467.439295][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 467.464113][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 467.478670][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 467.546972][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 467.585235][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 467.617410][T10354] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 467.634056][T11417] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 467.646261][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 467.674494][ T9] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 467.725954][ T9] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 467.726469][ T5914] option 3-1:2.85: GSM modem (1-port) converter detected [ 467.787958][ T5914] option 3-1:2.240: GSM modem (1-port) converter detected [ 467.818554][T10354] usb 1-1: Using ep0 maxpacket: 8 [ 467.840949][ T5914] usb 3-1: USB disconnect, device number 45 [ 467.867698][ T5914] option 3-1:2.85: device disconnected [ 467.922884][ T5914] option 3-1:2.240: device disconnected [ 468.022292][T11468] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1561'. [ 468.031673][T11468] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 468.079419][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 468.106832][T10354] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 468.127582][T10354] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.137463][ T9] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 468.152518][T10354] usb 1-1: Product: syz [ 468.180989][T10354] usb 1-1: Manufacturer: syz [ 468.185812][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 468.203631][T10354] usb 1-1: SerialNumber: syz [ 468.216872][T10354] usb 1-1: config 0 descriptor?? [ 468.223125][ T9] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 468.242057][ T9] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 468.301446][ T9] usb 4-1: config 168 interface 0 has no altsetting 0 [ 468.334071][ T9] usb 4-1: string descriptor 0 read error: -22 [ 468.341706][ T9] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 468.354234][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.364763][T11470] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1562'. [ 468.392943][ T9] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 468.441147][T10354] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 468.451818][T11472] program syz.4.1563 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 468.604947][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.611770][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.618499][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.625127][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.631604][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.638217][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.645284][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.651917][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.658563][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.665165][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.671865][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.678505][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.684891][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.691516][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.697803][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.704405][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.710650][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.717268][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.722966][T11478] netlink: 'syz.3.1559': attribute type 14 has an invalid length. [ 468.725617][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 468.731744][T11478] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1559'. [ 468.737775][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 468.858538][ T629] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 468.859589][T11478] netlink: 'syz.3.1559': attribute type 14 has an invalid length. [ 468.877068][T11478] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1559'. [ 468.878607][ T629] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 468.898165][ T629] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 468.917603][ T629] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 469.173231][T10354] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 469.200762][T10354] usb 1-1: USB disconnect, device number 41 [ 469.474062][ T5914] usb 2-1: USB disconnect, device number 51 [ 469.476856][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 469.540431][T10354] usb 4-1: USB disconnect, device number 44 [ 469.837868][T11512] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 469.923688][T11513] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 469.955972][T11512] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1572'. [ 470.361970][T11520] FAULT_INJECTION: forcing a failure. [ 470.361970][T11520] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 470.402837][T11520] CPU: 0 UID: 0 PID: 11520 Comm: syz.0.1576 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.402876][T11520] Tainted: [L]=SOFTLOCKUP [ 470.402881][T11520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 470.402908][T11520] Call Trace: [ 470.402915][T11520] [ 470.402921][T11520] dump_stack_lvl+0xe8/0x150 [ 470.402948][T11520] should_fail_ex+0x412/0x560 [ 470.403009][T11520] _copy_from_user+0x2d/0xb0 [ 470.403028][T11520] kstrtouint_from_user+0xd6/0x180 [ 470.403051][T11520] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 470.403084][T11520] proc_fail_nth_write+0x8e/0x210 [ 470.403134][T11520] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 470.403159][T11520] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 470.403181][T11520] vfs_write+0x29a/0xb90 [ 470.403225][T11520] ? __pfx_vfs_write+0x10/0x10 [ 470.403250][T11520] ? __fget_files+0x2a/0x420 [ 470.403285][T11520] ? __fget_files+0x3a0/0x420 [ 470.403314][T11520] ? __fget_files+0x2a/0x420 [ 470.403341][T11520] ksys_write+0x150/0x270 [ 470.403359][T11520] ? __pfx_ksys_write+0x10/0x10 [ 470.403382][T11520] do_syscall_64+0x14d/0xf80 [ 470.403399][T11520] ? trace_irq_disable+0x3b/0x150 [ 470.403421][T11520] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.403436][T11520] ? clear_bhb_loop+0x40/0x90 [ 470.403454][T11520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.403468][T11520] RIP: 0033:0x7f1d8bb5cfce [ 470.403483][T11520] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 470.403497][T11520] RSP: 002b:00007f1d8ca13fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 470.403513][T11520] RAX: ffffffffffffffda RBX: 00007f1d8ca146c0 RCX: 00007f1d8bb5cfce [ 470.403523][T11520] RDX: 0000000000000001 RSI: 00007f1d8ca140a0 RDI: 0000000000000004 [ 470.403532][T11520] RBP: 00007f1d8ca14090 R08: 0000000000000000 R09: 0000000000000000 [ 470.403541][T11520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 470.403549][T11520] R13: 00007f1d8be16038 R14: 00007f1d8be15fa0 R15: 00007f1d8bf3fa48 [ 470.403572][T11520] [ 470.619604][T11510] [U] .h0FwZ,iqgҏV2sO [ 470.625683][T11510] [U] ` w*BBOLhU [ 470.630202][T11510] [U] w$n|#%o.z\̧mРw [ 470.956364][ T30] audit: type=1326 audit(1773907538.468:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11526 comm="syz.0.1578" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1d8bb9c799 code=0x0 [ 471.313278][T11535] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 471.547310][T11043] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 471.677647][T11043] usb 2-1: device descriptor read/64, error -71 [ 471.750265][T11502] [U] R{ꫢ S [ 471.927529][T11043] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 472.097284][T11043] usb 2-1: device descriptor read/64, error -71 [ 472.238030][T11043] usb usb2-port1: attempt power cycle [ 472.631132][T11043] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 472.678030][T11043] usb 2-1: device descriptor read/8, error -71 [ 472.709908][T11556] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 472.948008][T11043] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 473.001511][T11043] usb 2-1: device descriptor read/8, error -71 [ 473.223608][T11043] usb usb2-port1: unable to enumerate USB device [ 473.637230][T11578] [U] .h0FwZ,iqgҏV2sO [ 473.643276][T11578] [U] ` w*BBOLhU [ 473.647798][T11578] [U] w$n|#%o.z\̧mРw [ 474.401072][T11592] syzkaller1: entered promiscuous mode [ 474.413963][T11574] [U] R{ꫢ S [ 474.487774][T11592] syzkaller1: entered allmulticast mode [ 474.547574][T11594] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1597'. [ 474.657379][T11597] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1597'. [ 474.756408][T11594] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1597'. [ 474.819152][T11596] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1600'. [ 474.819434][T11597] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1597'. [ 474.868954][T11596] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check. [ 474.942221][ T996] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 475.002009][ T996] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 475.034221][ T996] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 475.094972][ T996] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 475.811444][T11618] fuse: Unknown parameter 'fdP0x000000000000000300000000000000000000' [ 475.937220][T11043] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 475.944914][ T5914] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 476.225060][T11043] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 476.256401][ T5914] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 476.274724][T11043] usb 2-1: config 0 interface 0 has no altsetting 0 [ 476.281569][ T5914] usb 5-1: config 0 interface 0 has no altsetting 0 [ 476.303177][ T5914] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 476.321015][T11043] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 476.335383][ T5914] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 476.345461][T11043] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 476.358080][ T5914] usb 5-1: Product: syz [ 476.368818][ T5914] usb 5-1: Manufacturer: syz [ 476.378581][T11043] usb 2-1: Product: syz [ 476.399808][ T5914] usb 5-1: SerialNumber: syz [ 476.407393][T11043] usb 2-1: Manufacturer: syz [ 476.440540][T11043] usb 2-1: SerialNumber: syz [ 476.446211][ T5914] usb 5-1: config 0 descriptor?? [ 476.499270][ T5914] usb 5-1: selecting invalid altsetting 0 [ 476.516583][T11631] loop2: detected capacity change from 0 to 7 [ 476.532807][T11043] usb 2-1: config 0 descriptor?? [ 476.561324][ T5844] Dev loop2: unable to read RDB block 7 [ 476.574849][ T5844] loop2: AHDI p1 p2 p3 [ 476.590981][ T5844] loop2: partition table partially beyond EOD, truncated [ 476.611337][ T5844] loop2: p1 start 1601398130 is beyond EOD, truncated [ 476.632470][ T5844] loop2: p2 start 1702059890 is beyond EOD, truncated [ 476.653318][T11043] usb 2-1: selecting invalid altsetting 0 [ 476.675872][T11631] Dev loop2: unable to read RDB block 7 [ 476.684084][T11631] loop2: AHDI p1 p2 p3 [ 476.693518][T11631] loop2: partition table partially beyond EOD, truncated [ 476.709316][T11615] netlink: 'syz.4.1604': attribute type 23 has an invalid length. [ 476.718247][ T5914] usb 5-1: USB disconnect, device number 38 [ 476.730410][T11631] loop2: p1 start 1601398130 is beyond EOD, truncated [ 476.744000][T11631] loop2: p2 start 1702059890 is beyond EOD, truncated [ 476.765827][ T5198] Dev loop2: unable to read RDB block 7 [ 476.785404][T11616] netlink: 'syz.1.1605': attribute type 23 has an invalid length. [ 476.823525][ T5198] loop2: AHDI p1 p2 p3 [ 476.866317][ T5198] loop2: partition table partially beyond EOD, truncated [ 476.884561][ T5198] loop2: p1 start 1601398130 is beyond EOD, truncated [ 476.900627][ T5198] loop2: p2 start 1702059890 is beyond EOD, truncated [ 477.050667][T11643] [U] .h0FwZ,iqgҏV2sO [ 477.057440][T11643] [U] ` w*BBOLhU [ 477.061968][T11643] [U] w$n|#%o.z\̧mРw [ 477.199794][T11646] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1614'. [ 477.212553][T11646] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1614'. [ 477.251004][T11043] usb 2-1: USB disconnect, device number 56 [ 477.829236][T11635] [U] R{ꫢ S [ 479.071587][T11672] binder: 11671:11672 ioctl c0046209 200000000000000 returned -22 [ 479.187747][T10354] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 479.327332][T10354] usb 3-1: device descriptor read/64, error -71 [ 479.610748][T10354] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 479.881071][ T797] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 479.889259][T10354] usb 3-1: device descriptor read/64, error -71 [ 480.017724][T10354] usb usb3-port1: attempt power cycle [ 480.070749][T11692] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 480.081799][T11692] team0: Port device batadv1 added [ 480.127390][ T797] usb 4-1: Using ep0 maxpacket: 32 [ 480.178239][ T797] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 480.204200][ T797] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 480.225337][ T797] usb 4-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=a9.9b [ 480.299503][ T797] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.355571][ T797] usb 4-1: config 0 descriptor?? [ 480.432595][T10354] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 480.466447][T10354] usb 3-1: device descriptor read/8, error -71 [ 480.707217][T10354] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 480.716265][ T797] usb 4-1: string descriptor 0 read error: -71 [ 480.747959][T10354] usb 3-1: device descriptor read/8, error -71 [ 480.754544][ T797] usb 4-1: USB disconnect, device number 45 [ 480.868243][T10354] usb usb3-port1: unable to enumerate USB device [ 481.221571][T11710] [U] .h0FwZ,iqgҏV2sO [ 481.237338][T11710] [U] ` w*BBOLhU [ 481.241880][T11710] [U] w$n|#%o.z\̧mРw [ 481.926881][T11729] netlink: 'syz.3.1634': attribute type 10 has an invalid length. [ 482.018289][T11705] [U] R{ꫢ S [ 482.417340][T10354] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 482.463255][ T5914] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 482.647378][T10354] usb 5-1: Using ep0 maxpacket: 32 [ 482.654909][ T5914] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 482.655331][T10354] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 482.677694][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 482.685931][T10354] usb 5-1: config 0 has no interface number 0 [ 482.717605][ T5914] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 482.726677][ T5914] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 482.757366][T10354] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 482.777310][T10354] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.785430][ T5914] usb 3-1: Manufacturer: syz [ 482.903430][ T5914] usb 3-1: config 0 descriptor?? [ 483.027237][T10354] usb 5-1: Product: syz [ 483.033920][ T5914] rc_core: IR keymap rc-hauppauge not found [ 483.047730][ T5914] Registered IR keymap rc-empty [ 483.064731][T10354] usb 5-1: Manufacturer: syz [ 483.075861][ T5914] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 483.097443][T10354] usb 5-1: SerialNumber: syz [ 483.142571][T10354] usb 5-1: config 0 descriptor?? [ 483.170091][T11736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.207038][T10354] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 483.257499][T10354] usb 5-1: selecting invalid altsetting 1 [ 483.276736][T10354] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 483.355776][T11736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 483.368490][T10354] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 483.380088][ T5914] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input44 [ 483.384375][T11752] batadv0: entered promiscuous mode [ 483.412659][T10354] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 483.444846][T11752] macvtap1: entered promiscuous mode [ 483.452339][T10354] usb 5-1: media controller created [ 483.463968][T11752] macvtap1: entered allmulticast mode [ 483.504913][T11752] batadv0: entered allmulticast mode [ 483.550135][T10354] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 483.573901][T11752] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 483.615396][T11752] batadv0: left allmulticast mode [ 483.620979][T11752] batadv0: left promiscuous mode [ 484.478958][T11735] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 484.509463][T10354] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 484.601652][T10354] zl10353_read_register: readreg error (reg=127, ret==-71) [ 484.626204][T10354] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 484.647390][T11763] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1647'. [ 484.761088][T10354] usb 5-1: USB disconnect, device number 39 [ 485.069844][T11776] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1652'. [ 485.104936][ T5934] usb 3-1: USB disconnect, device number 50 [ 485.127320][T11776] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1652'. [ 485.466535][T11784] [U] .h0FwZ,iqgҏV2sO [ 485.474081][T11784] [U] ` w*BBOLhU [ 485.478621][T11784] [U] w$n|#%o.z\̧mРw [ 486.017742][T11797] netlink: 'syz.0.1655': attribute type 2 has an invalid length. [ 486.443574][T11798] bond3: entered promiscuous mode [ 486.450279][T11798] 8021q: adding VLAN 0 to HW filter on device bond3 [ 486.567393][ T5920] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 486.586525][T11780] [U] R{ꫢ S [ 486.757243][ T5920] usb 1-1: Using ep0 maxpacket: 32 [ 486.778018][ T5920] usb 1-1: config index 0 descriptor too short (expected 36, got 35) [ 486.796611][ T5920] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 486.867537][ T5920] usb 1-1: New USB device found, idVendor=056e, idProduct=011c, bcdDevice= 0.00 [ 486.927246][ T5920] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.947579][ T5920] usb 1-1: config 0 descriptor?? [ 487.466624][T11803] binder: 11802:11803 ioctl c0046209 200000000000000 returned -22 [ 487.552441][T11806] syzkaller0: entered promiscuous mode [ 487.558191][T11806] syzkaller0: entered allmulticast mode [ 487.567020][T11806] tipc: Enabled bearer , priority 0 [ 487.576925][T11805] tipc: Resetting bearer [ 487.626164][T11805] tipc: Disabling bearer [ 489.357319][T11043] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 489.410917][ T5920] usb 1-1: string descriptor 0 read error: -71 [ 489.419296][ T5920] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 489.448055][ T5920] usb 1-1: USB disconnect, device number 42 [ 489.541473][T11043] usb 5-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 489.555690][T11043] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.577359][T11043] usb 5-1: Product: syz [ 489.583523][T11043] usb 5-1: Manufacturer: syz [ 489.592843][T11043] usb 5-1: SerialNumber: syz [ 489.621389][T11043] usb 5-1: config 0 descriptor?? [ 489.651306][T11043] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 489.947244][ T5914] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 489.987465][ T5934] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 490.008908][T11842] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 490.137403][ T5914] usb 2-1: Using ep0 maxpacket: 16 [ 490.150183][ T5914] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 490.169258][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.188346][ T5934] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 490.282161][ T5914] usb 2-1: Product: syz [ 490.286406][ T5914] usb 2-1: Manufacturer: syz [ 490.295364][ T5934] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 490.316223][ T5934] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 490.325615][ T5934] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 490.385339][ T5934] usb 1-1: Manufacturer: syz [ 490.399584][ T5914] usb 2-1: SerialNumber: syz [ 490.423630][ T5934] usb 1-1: config 0 descriptor?? [ 490.502996][T11043] gspca_sunplus: reg_w_riv err -71 [ 490.508397][T11043] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 490.532237][T11043] usb 5-1: USB disconnect, device number 40 [ 490.776828][ T5914] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 490.795779][T11831] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.817451][T11831] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.846168][ T5914] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 490.876944][ T5914] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 490.877438][ T5934] rc_core: IR keymap rc-hauppauge not found [ 490.897984][T11847] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 490.936531][ T5934] Registered IR keymap rc-empty [ 490.953296][ T5934] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 490.955868][ T5914] usb 2-1: media controller created [ 491.003473][ T5934] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input45 [ 491.176146][ T5914] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 491.306933][ T5914] zl10353_read_register: readreg error (reg=127, ret==-71) [ 491.485509][T11849] syzkaller0: entered promiscuous mode [ 491.532266][ T5914] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 491.557722][T11849] syzkaller0: entered allmulticast mode [ 491.589427][ T5914] usb 2-1: USB disconnect, device number 57 [ 492.568368][T11861] loop2: detected capacity change from 0 to 7 [ 492.623029][T11861] Dev loop2: unable to read RDB block 7 [ 492.645262][ T5914] usb 1-1: USB disconnect, device number 43 [ 492.706821][T11861] loop2: AHDI p1 p2 p3 [ 492.757929][T11861] loop2: partition table partially beyond EOD, truncated [ 492.819902][T11861] loop2: p1 start 1601398130 is beyond EOD, truncated [ 492.853437][T11861] loop2: p2 start 1702059890 is beyond EOD, truncated [ 493.702938][T11876] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1678'. [ 493.720317][T11876] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1678'. [ 493.989827][T11043] usb 2-1: new full-speed USB device number 58 using dummy_hcd [ 494.161862][T11043] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 494.183514][T11043] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 494.207456][T11043] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 494.221393][T11043] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 190, setting to 64 [ 494.241139][T11043] usb 2-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 494.251212][T11043] usb 2-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 494.264938][T11043] usb 2-1: Product: syz [ 494.270328][T11043] usb 2-1: Manufacturer: syz [ 494.275094][T11043] usb 2-1: SerialNumber: syz [ 494.289435][T11043] usb 2-1: config 0 descriptor?? [ 494.296046][T11878] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 494.395788][T11043] rc_core: IR keymap rc-imon-rsc not found [ 494.402361][T11043] Registered IR keymap rc-empty [ 494.413867][T11043] rc rc0: iMON Station as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 494.431371][T11043] input: iMON Station as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input46 [ 494.670479][T10354] usb 2-1: USB disconnect, device number 58 [ 494.728319][T11043] usb 4-1: new full-speed USB device number 46 using dummy_hcd [ 494.872645][T11043] usb 4-1: device descriptor read/64, error -71 [ 495.137303][T11043] usb 4-1: new full-speed USB device number 47 using dummy_hcd [ 495.278483][T11043] usb 4-1: device descriptor read/64, error -71 [ 495.448250][T11043] usb usb4-port1: attempt power cycle [ 495.464622][T11894] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 495.617279][ T5914] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 495.747995][ T5914] usb 2-1: device descriptor read/64, error -71 [ 495.807249][T11043] usb 4-1: new full-speed USB device number 48 using dummy_hcd [ 495.854741][T11043] usb 4-1: device descriptor read/8, error -71 [ 495.944177][T11885] tipc: Started in network mode [ 495.949483][T11885] tipc: Node identity ac1414aa, cluster identity 4711 [ 495.957365][T11885] tipc: Enabling of bearer rejected, failed to enable media [ 495.997391][ T5914] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 496.107388][T11043] usb 4-1: new full-speed USB device number 49 using dummy_hcd [ 496.160821][T11043] usb 4-1: device descriptor read/8, error -71 [ 496.188416][ T5914] usb 2-1: device descriptor read/64, error -71 [ 496.314746][T11043] usb usb4-port1: unable to enumerate USB device [ 496.337738][ T5914] usb usb2-port1: attempt power cycle [ 496.430513][ T629] tipc: Left network mode [ 496.708364][ T5914] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 496.747682][ T5914] usb 2-1: device descriptor read/8, error -71 [ 496.759740][T11909] xt_hashlimit: size too large, truncated to 1048576 [ 496.987230][ T5914] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 497.008069][ T5914] usb 2-1: device descriptor read/8, error -71 [ 497.127479][ T5914] usb usb2-port1: unable to enumerate USB device [ 497.174251][T11920] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1691'. [ 497.183812][T11920] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 497.536862][T11924] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.544730][T11924] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.714714][T11931] ptrace attach of "./syz-executor exec"[5845] was attempted by "./syz-executor exec"[11931] [ 497.725793][T11931] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1695'. [ 497.747611][T11924] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 497.772706][T11924] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 497.846720][T11940] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1696'. [ 497.951660][T11924] geneve0: left allmulticast mode [ 498.000328][T11924] ipvlan2: left promiscuous mode [ 498.035234][ T996] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.045440][ T996] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.056777][ T996] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.066351][ T996] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.093230][ T996] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.127741][ T996] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.167458][ T996] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.176469][ T996] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.537814][T11964] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 498.803081][T11969] loop2: detected capacity change from 0 to 7 [ 498.822218][T11969] Dev loop2: unable to read RDB block 7 [ 498.847937][T11969] loop2: AHDI p1 p2 p3 [ 498.971617][T11969] loop2: partition table partially beyond EOD, truncated [ 498.995164][T11969] loop2: p1 start 1601398130 is beyond EOD, truncated [ 499.017869][T11969] loop2: p2 start 1702059890 is beyond EOD, truncated [ 500.060868][T11989] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 500.111538][T11989] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 500.647275][T11944] usb 2-1: new full-speed USB device number 63 using dummy_hcd [ 500.809688][T11944] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 500.827360][T11944] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 500.857936][T11944] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 500.900484][T11944] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.957671][T11943] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 501.128898][T11943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 501.141603][T11943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 501.171727][T11943] usb 4-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 501.191550][T11943] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.226435][T11943] usb 4-1: config 0 descriptor?? [ 501.280965][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.287464][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.363577][T11944] aiptek 2-1:17.0: Aiptek using 400 ms programming speed [ 501.377513][ T9] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 501.386392][T11944] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:17.0/input/input47 [ 501.428979][T11944] input: failed to attach handler kbd to device input47, error: -5 [ 501.449286][T11943] usbhid 4-1:0.0: can't add hid device: -71 [ 501.462083][T11943] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 501.491525][T11943] usb 4-1: USB disconnect, device number 50 [ 501.530241][T11944] usb 2-1: USB disconnect, device number 63 [ 501.569160][ T9] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 501.594026][ T9] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 501.634506][ T9] usb 1-1: config 220 has no interface number 2 [ 501.655890][ T9] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 501.676282][ T9] usb 1-1: config 220 interface 0 has no altsetting 0 [ 501.684101][ T9] usb 1-1: config 220 interface 76 has no altsetting 0 [ 501.693081][ T9] usb 1-1: config 220 interface 1 has no altsetting 0 [ 501.703469][ T9] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 501.713174][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.722550][ T9] usb 1-1: Product: syz [ 501.726890][ T9] usb 1-1: Manufacturer: syz [ 501.732895][ T9] usb 1-1: SerialNumber: syz [ 501.907376][T10354] usb 5-1: new full-speed USB device number 41 using dummy_hcd [ 501.960117][ T9] usb 1-1: selecting invalid altsetting 0 [ 501.965419][T11943] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 501.979286][ T9] uvcvideo 1-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 501.986657][ T9] uvcvideo 1-1:220.0: No valid video chain found. [ 502.003214][ T9] usb 1-1: selecting invalid altsetting 0 [ 502.009376][ T9] usbtest 1-1:220.1: probe with driver usbtest failed with error -22 [ 502.020618][ T9] usb 1-1: USB disconnect, device number 44 [ 502.081738][T10354] usb 5-1: not running at top speed; connect to a high speed hub [ 502.090830][T10354] usb 5-1: config 8 has an invalid interface number: 243 but max is 2 [ 502.099136][T10354] usb 5-1: config 8 contains an unexpected descriptor of type 0x2, skipping [ 502.108109][T10354] usb 5-1: config 8 has an invalid interface number: 55 but max is 2 [ 502.116241][T10354] usb 5-1: config 8 has an invalid interface number: 85 but max is 2 [ 502.125256][T10354] usb 5-1: config 8 has an invalid interface number: 180 but max is 2 [ 502.134047][T10354] usb 5-1: config 8 has an invalid interface number: 230 but max is 2 [ 502.143572][T10354] usb 5-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 502.144846][T11943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 502.152406][T10354] usb 5-1: config 8 has 5 interfaces, different from the descriptor's value: 3 [ 502.152430][T10354] usb 5-1: config 8 has no interface number 0 [ 502.152446][T10354] usb 5-1: config 8 has no interface number 1 [ 502.152462][T10354] usb 5-1: config 8 has no interface number 2 [ 502.152479][T10354] usb 5-1: config 8 has no interface number 3 [ 502.152495][T10354] usb 5-1: config 8 has no interface number 4 [ 502.152580][T10354] usb 5-1: config 8 interface 243 altsetting 15 endpoint 0xF has an invalid bInterval 212, changing to 4 [ 502.152606][T10354] usb 5-1: config 8 interface 243 altsetting 15 has a duplicate endpoint with address 0xF, skipping [ 502.152630][T10354] usb 5-1: config 8 interface 243 altsetting 15 endpoint 0x8 has invalid maxpacket 2047, setting to 64 [ 502.152657][T10354] usb 5-1: config 8 interface 243 altsetting 15 has a duplicate endpoint with address 0x2, skipping [ 502.152679][T10354] usb 5-1: config 8 interface 243 altsetting 15 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 502.152714][T10354] usb 5-1: too many endpoints for config 8 interface 55 altsetting 137: 166, using maximum allowed: 30 [ 502.152780][T10354] usb 5-1: config 8 interface 55 altsetting 137 has 0 endpoint descriptors, different from the interface descriptor's value: 166 [ 502.152818][T10354] usb 5-1: config 8 interface 85 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 502.152839][T10354] usb 5-1: config 8 interface 85 altsetting 1 has a duplicate endpoint with address 0x5, skipping [ 502.152862][T10354] usb 5-1: config 8 interface 85 altsetting 1 has an endpoint descriptor with address 0x64, changing to 0x4 [ 502.152887][T10354] usb 5-1: config 8 interface 85 altsetting 1 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 502.152923][T10354] usb 5-1: config 8 interface 180 altsetting 7 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 502.152954][T10354] usb 5-1: config 8 interface 180 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 502.153009][T10354] usb 5-1: config 8 interface 230 altsetting 24 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 502.153036][T10354] usb 5-1: config 8 interface 243 has no altsetting 0 [ 502.153054][T10354] usb 5-1: config 8 interface 55 has no altsetting 0 [ 502.153080][T10354] usb 5-1: config 8 interface 85 has no altsetting 0 [ 502.153098][T10354] usb 5-1: config 8 interface 180 has no altsetting 0 [ 502.153116][T10354] usb 5-1: config 8 interface 230 has no altsetting 0 [ 502.338274][T10354] usb 5-1: New USB device found, idVendor=045e, idProduct=04e2, bcdDevice=fe.f8 [ 502.353523][T11943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 502.368144][T10354] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.395702][T11943] usb 4-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 502.399854][T11943] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.419689][T11943] usb 4-1: config 0 descriptor?? [ 502.454700][T10354] usb 5-1: Product: 郲أ﩯㿕珂➤㮅ễ欤旅耜뀀鿺襺뮟곜䡥藻솴ᵐ䈰匑軌⤾⋓因膻盚ێ約뵂硉ᆾ븟䑼륝ﱆ叵 [ 502.469863][T10354] usb 5-1: Manufacturer: 슳픭ṗ槫鈴环싧얍ᰙ佲쩷❚榌꥟箨ꔭ嚺浹๐郚쵌㠢牵뱛칢ᨣ硱ꃞ鵷頃䌕퇜锴ﻜ宠蕠祦ʤ䤆蟵䲂♴幧窲䱆飥潧ὣ鿳馰먴ᩯ [ 502.490593][T10354] usb 5-1: SerialNumber: ж [ 502.500094][T12010] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 502.713370][T12010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.727616][T12010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.749075][T12025] netdevsim netdevsim0: Direct firmware load for failed with error -2 [ 502.759386][T12025] netdevsim netdevsim0: Falling back to sysfs fallback for: [ 502.859117][T11943] steelseries 0003:1038:12B6.0009: hidraw0: USB HID v0.00 Device [HID 1038:12b6] on usb-dummy_hcd.3-1/input0 [ 503.226938][T10354] usb 5-1: USB disconnect, device number 41 [ 503.738873][ T9] usb 4-1: USB disconnect, device number 51 [ 503.906349][T12034] pim6reg: entered allmulticast mode [ 504.139578][T12041] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 504.276640][T11943] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 504.347676][ T9] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 504.442236][T11943] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 504.452408][T11943] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 504.473178][T11943] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 504.507520][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 504.612442][ T9] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 504.900521][T11943] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 504.917216][ T9] usb 2-1: config 0 has no interface number 0 [ 504.923372][ T9] usb 2-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 504.957264][ T9] usb 2-1: config 0 interface 89 has no altsetting 0 [ 504.993455][ T9] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 505.027997][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.087473][ T9] usb 2-1: Product: syz [ 505.091778][ T9] usb 2-1: Manufacturer: syz [ 505.097417][T11943] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 505.108860][T11943] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 505.157384][T11943] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 505.167216][T11943] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 505.177741][T11943] usb 3-1: Product: syz [ 505.182018][T11943] usb 3-1: Manufacturer: syz [ 505.192531][ T9] usb 2-1: SerialNumber: syz [ 505.238289][ T9] usb 2-1: config 0 descriptor?? [ 505.279398][T12034] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 505.344336][ T9] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 505.365226][T11943] cdc_wdm 3-1:1.0: skipping garbage [ 505.381595][T11943] cdc_wdm 3-1:1.0: skipping garbage [ 505.387413][ T9] em28xx 2-1:0.89: Video interface 89 found: [ 505.402425][T11943] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 505.428814][T11943] cdc_wdm 3-1:1.0: Unknown control protocol [ 505.608340][T12050] fuse: Invalid rootmode [ 505.860142][ T9] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 506.709780][T11934] usb 3-1: USB disconnect, device number 51 [ 507.024826][T12069] binder: 12068:12069 ioctl c0046209 200000000000000 returned -22 [ 507.328932][T12078] netlink: 'syz.0.1729': attribute type 2 has an invalid length. [ 507.347312][T12078] netlink: 'syz.0.1729': attribute type 2 has an invalid length. [ 507.371181][T12078] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1729'. [ 507.471313][T12082] fuse: Invalid rootmode [ 507.908817][T12099] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 507.932381][ T9] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 507.942128][ T9] em28xx 2-1:0.89: board has no eeprom [ 508.069419][ T9] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 508.100424][ T9] em28xx 2-1:0.89: analog set to bulk mode. [ 508.111384][T10354] em28xx 2-1:0.89: Registering V4L2 extension [ 508.194770][ T9] usb 2-1: USB disconnect, device number 64 [ 508.217091][ T9] em28xx 2-1:0.89: Disconnecting em28xx [ 508.332876][T10354] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 508.354072][T10354] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 508.393860][T10354] em28xx 2-1:0.89: No AC97 audio processor [ 508.459427][T12100] pim6reg: entered allmulticast mode [ 508.739359][T10354] usb 2-1: Decoder not found [ 508.748348][T10354] em28xx 2-1:0.89: failed to create media graph [ 508.764709][T10354] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 508.790068][T10354] em28xx 2-1:0.89: Registering snapshot button... [ 508.827240][T11934] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 508.911023][T10354] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input48 [ 508.935530][T10354] em28xx 2-1:0.89: Remote control support is not available for this card. [ 508.948019][ T9] em28xx 2-1:0.89: Closing input extension [ 508.954571][ T9] em28xx 2-1:0.89: Deregistering snapshot button [ 509.013645][T11934] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 509.034719][ T1101] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.044989][ T1101] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.057269][T11934] usb 4-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 509.077330][ T1101] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.086166][ T1101] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 509.099543][T11934] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 509.159805][T11934] usb 4-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 509.233488][T11934] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 509.258434][ T9] em28xx 2-1:0.89: Freeing device [ 509.289603][T11934] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 509.381383][T11934] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 509.451643][T11934] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 509.479853][T11934] usb 4-1: Product: syz [ 509.500220][T11934] usb 4-1: Manufacturer: syz [ 509.536943][T12103] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 509.654303][T11934] cdc_wdm 4-1:1.0: skipping garbage [ 509.708798][T11934] cdc_wdm 4-1:1.0: skipping garbage [ 509.818080][T11934] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 509.837388][T12117] binder: 12116:12117 ioctl c0046209 200000000000000 returned -22 [ 509.853908][T11934] cdc_wdm 4-1:1.0: Unknown control protocol [ 510.193665][T12129] fuse: Invalid rootmode [ 510.432031][T12136] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1747'. [ 510.658336][T11934] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 510.871420][T11934] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 510.884044][T11934] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 510.940385][T12148] program syz.4.1751 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 511.007430][T12149] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1751'. [ 511.066402][ T30] audit: type=1326 audit(1773907578.418:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066440][ T30] audit: type=1326 audit(1773907578.418:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066467][ T30] audit: type=1326 audit(1773907578.418:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066492][ T30] audit: type=1326 audit(1773907578.418:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066518][ T30] audit: type=1326 audit(1773907578.418:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066574][ T30] audit: type=1326 audit(1773907578.418:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066604][ T30] audit: type=1326 audit(1773907578.418:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066632][ T30] audit: type=1326 audit(1773907578.418:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066660][ T30] audit: type=1326 audit(1773907578.418:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.066687][ T30] audit: type=1326 audit(1773907578.418:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.4.1751" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f196199c799 code=0x7ffc0000 [ 511.122995][T11944] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 511.133679][T11934] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 511.389084][T11934] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 511.412635][T11934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.472045][T11934] usb 2-1: config 0 descriptor?? [ 511.537183][T11944] usb 3-1: Using ep0 maxpacket: 8 [ 511.557966][T11944] usb 3-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 511.571058][T11944] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.579251][T11944] usb 3-1: Product: syz [ 511.583909][T11944] usb 3-1: Manufacturer: syz [ 511.588827][T11944] usb 3-1: SerialNumber: syz [ 511.613523][T11944] usb 3-1: config 0 descriptor?? [ 511.629832][T11944] gspca_main: sq930x-2.14.0 probing 2770:930c [ 511.793076][T12134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 511.807811][T12134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.888532][ T29] usb 4-1: USB disconnect, device number 52 [ 512.135696][T12134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.166343][T12134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.322311][T12138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.338793][T12138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.375961][T12161] syzkaller0: entered promiscuous mode [ 512.382107][T12161] syzkaller0: entered allmulticast mode [ 512.410433][T12160] tipc: Enabled bearer , priority 0 [ 512.463455][T12159] tipc: Resetting bearer [ 512.569117][T12159] tipc: Disabling bearer [ 512.648007][T11934] usbhid 2-1:0.0: can't add hid device: -71 [ 512.654165][T11934] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 512.672962][T11934] usb 2-1: USB disconnect, device number 65 [ 512.712355][T12169] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 512.739485][T11944] gspca_sq930x: reg_w 0305 fd00 failed -110 [ 512.842819][T12175] fuse: Invalid rootmode [ 512.911303][T12177] netlink: 25 bytes leftover after parsing attributes in process `syz.0.1762'. [ 513.667181][T11944] gspca_sq930x: Unknown sensor [ 513.672120][T11944] sq930x 3-1:0.0: probe with driver sq930x failed with error -22 [ 513.890985][T11944] usb 3-1: USB disconnect, device number 52 [ 513.955378][T12194] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 514.105893][T12200] binder: 12199:12200 ioctl c0046209 200000000000000 returned -22 [ 514.304306][T12209] netlink: 'syz.1.1770': attribute type 8 has an invalid length. [ 514.458552][T11934] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 514.489393][T12212] macsec0: entered promiscuous mode [ 514.496501][T12212] macsec0: left promiscuous mode [ 514.564019][T12215] netlink: 'syz.0.1769': attribute type 6 has an invalid length. [ 514.640730][T11934] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 514.658427][T11934] usb 4-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 514.669667][T12216] netlink: 'syz.1.1772': attribute type 10 has an invalid length. [ 514.699133][T11934] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 514.715074][T11934] usb 4-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 514.727200][T11933] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 514.755598][T11934] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 514.830940][T11934] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 514.851495][T11934] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 514.863781][T11934] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 514.874946][T11934] usb 4-1: Product: syz [ 514.879709][T11934] usb 4-1: Manufacturer: syz [ 514.897702][T11933] usb 5-1: device descriptor read/64, error -71 [ 514.906443][T12189] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 514.923790][T11934] cdc_wdm 4-1:1.0: skipping garbage [ 514.932090][T11934] cdc_wdm 4-1:1.0: skipping garbage [ 514.955523][T11934] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 514.964630][T11934] cdc_wdm 4-1:1.0: Unknown control protocol [ 515.137407][T11933] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 515.277379][T11933] usb 5-1: device descriptor read/64, error -71 [ 515.387862][T11933] usb usb5-port1: attempt power cycle [ 515.742897][T12221] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1774'. [ 515.747456][T11933] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 515.794085][T11933] usb 5-1: device descriptor read/8, error -71 [ 515.940710][T12223] vlan2: entered promiscuous mode [ 515.945884][T12223] bridge0: entered promiscuous mode [ 516.047672][T11933] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 516.078165][T11933] usb 5-1: device descriptor read/8, error -71 [ 516.172012][T12231] fuse: Invalid rootmode [ 516.194441][T11933] usb usb5-port1: unable to enumerate USB device [ 517.136561][T11943] usb 4-1: USB disconnect, device number 53 [ 517.209512][T12242] binder: 12241:12242 ioctl c0046209 200000000000000 returned -22 [ 517.367286][T11933] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 517.481194][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 517.481212][ T30] audit: type=1326 audit(1773907584.928:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 517.567369][T11933] usb 3-1: Using ep0 maxpacket: 16 [ 517.582076][T11933] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 517.592818][T11933] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.655792][ T30] audit: type=1326 audit(1773907584.928:559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 517.687222][T11933] usb 3-1: Product: syz [ 517.700194][T11933] usb 3-1: Manufacturer: syz [ 517.715370][T11933] usb 3-1: SerialNumber: syz [ 517.747988][ T30] audit: type=1326 audit(1773907584.928:560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 517.876419][ T30] audit: type=1326 audit(1773907584.928:561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 517.916252][ T30] audit: type=1326 audit(1773907584.928:562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 517.960680][T12244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.975810][T12244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.991069][T12244] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 518.242938][T11933] usb 3-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 518.274508][ T30] audit: type=1326 audit(1773907584.928:563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 518.302247][T11933] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 518.323776][T11933] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 518.339066][T11933] usb 3-1: media controller created [ 518.367317][ T30] audit: type=1326 audit(1773907584.928:564): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 518.429131][T11933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 518.464699][ T30] audit: type=1326 audit(1773907584.928:565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 518.507951][ T30] audit: type=1326 audit(1773907584.928:566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 518.577429][ T30] audit: type=1326 audit(1773907584.928:567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12249 comm="syz.1.1785" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9e79c799 code=0x7ffc0000 [ 518.698050][T11933] zl10353_read_register: readreg error (reg=127, ret==-110) [ 518.772441][T11933] dvb_usb_gl861 3-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 518.851904][T11943] usb 3-1: USB disconnect, device number 53 [ 519.735695][T12292] binder: 12291:12292 ioctl c0046209 200000000000000 returned -22 [ 519.801818][T12299] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1800'. [ 519.812705][T12299] 8021q: adding VLAN 0 to HW filter on device bond0 [ 519.817520][T11934] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 519.907414][T11933] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 520.001317][T12303] netlink: 'syz.0.1801': attribute type 10 has an invalid length. [ 520.037300][T12303] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1801'. [ 520.060697][T11934] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 520.077305][T11933] usb 5-1: Using ep0 maxpacket: 32 [ 520.092229][T11934] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 520.104414][T11933] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 520.130240][T11933] usb 5-1: config 0 has no interface number 0 [ 520.138065][T11934] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 520.139283][T12303] dummy0: entered promiscuous mode [ 520.177206][T11933] usb 5-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 520.208027][T11934] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 520.222519][T12303] bridge0: port 3(dummy0) entered blocking state [ 520.271679][T11933] usb 5-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 520.285748][T12303] bridge0: port 3(dummy0) entered disabled state [ 520.294867][T11934] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 520.313306][T11933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.340931][T12303] dummy0: entered allmulticast mode [ 520.351192][T11934] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 520.362734][T11933] usb 5-1: Product: syz [ 520.396833][T11933] usb 5-1: Manufacturer: syz [ 520.423438][T11933] usb 5-1: SerialNumber: syz [ 520.435492][T11934] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 520.501871][T11933] usb 5-1: config 0 descriptor?? [ 520.512382][T11934] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 520.539110][T11933] em28xx 5-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 520.551399][T11934] usb 3-1: Product: syz [ 520.589566][T11934] usb 3-1: Manufacturer: syz [ 520.598449][T11933] em28xx 5-1:0.132: Video interface 132 found: [ 520.623698][T12284] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 520.651924][T11934] cdc_wdm 3-1:1.0: skipping garbage [ 520.669810][T11934] cdc_wdm 3-1:1.0: skipping garbage [ 520.697671][T11934] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 520.703596][T11934] cdc_wdm 3-1:1.0: Unknown control protocol [ 520.869271][T12322] bridge0: port 3(hsr0) entered blocking state [ 520.875677][T12322] bridge0: port 3(hsr0) entered disabled state [ 520.885188][T12322] hsr0: entered allmulticast mode [ 520.890386][T12322] hsr_slave_0: entered allmulticast mode [ 520.896115][T12322] hsr_slave_1: entered allmulticast mode [ 520.904266][T12322] hsr0: entered promiscuous mode [ 520.912346][T12322] bridge0: port 3(hsr0) entered blocking state [ 520.918667][T12322] bridge0: port 3(hsr0) entered forwarding state [ 520.955367][T12315] netlink: 'syz.3.1804': attribute type 2 has an invalid length. [ 520.968250][T12315] netlink: 'syz.3.1804': attribute type 2 has an invalid length. [ 520.982574][T12315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1804'. [ 521.177560][T11933] em28xx 5-1:0.132: unknown em28xx chip ID (0) [ 521.914921][T11933] em28xx 5-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 521.937500][T11933] em28xx 5-1:0.132: board has no eeprom [ 522.495049][T11943] usb 3-1: USB disconnect, device number 54 [ 522.750601][T12332] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1810'. [ 522.791409][T12332] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1810'. [ 523.019069][T12337] binder: 12335:12337 ioctl c0046209 200000000000000 returned -22 [ 523.077364][T11933] em28xx 5-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 523.140574][T11933] em28xx 5-1:0.132: analog set to bulk mode. [ 523.161382][T10354] em28xx 5-1:0.132: Registering V4L2 extension [ 523.772016][T10354] em28xx 5-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 523.792870][T10354] em28xx 5-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 523.867675][T10354] em28xx 5-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 523.892785][T10354] em28xx 5-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 523.911365][T12351] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 523.968424][T11944] usb 5-1: USB disconnect, device number 46 [ 523.975751][T11944] em28xx 5-1:0.132: Disconnecting em28xx [ 524.252707][T10354] em28xx 5-1:0.132: Config register raw data: 0xffffffed [ 524.268817][T10354] em28xx 5-1:0.132: AC97 chip type couldn't be determined [ 524.277052][T10354] em28xx 5-1:0.132: No AC97 audio processor [ 524.306410][T10354] usb 5-1: Decoder not found [ 524.313959][T10354] em28xx 5-1:0.132: failed to create media graph [ 524.322830][T10354] em28xx 5-1:0.132: V4L2 device video103 deregistered [ 524.430023][T10354] em28xx 5-1:0.132: Remote control support is not available for this card. [ 524.558431][T11944] em28xx 5-1:0.132: Closing input extension [ 524.614521][T11944] em28xx 5-1:0.132: Freeing device [ 525.297923][T11944] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 525.457411][T11944] usb 5-1: Using ep0 maxpacket: 16 [ 525.467880][T11944] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 525.550962][T11944] usb 5-1: config 0 interface 0 has no altsetting 0 [ 525.590720][T11944] usb 5-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 525.613814][T11944] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.653949][T11944] usb 5-1: Product: syz [ 525.667237][ T29] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 525.675556][T11944] usb 5-1: Manufacturer: syz [ 525.704068][T11944] usb 5-1: SerialNumber: syz [ 525.766542][T11944] usb 5-1: config 0 descriptor?? [ 525.885738][ T29] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 525.894809][ T29] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 525.914087][ T29] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 525.923901][ T29] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 525.936848][ T29] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 526.025916][ T29] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 526.044257][T12382] binder: 12381:12382 ioctl c0046209 200000000000000 returned -22 [ 526.074949][T11944] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input49 [ 526.118688][ T29] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 526.210376][ T29] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 526.244271][ T29] usb 3-1: Product: syz [ 526.304162][ T29] usb 3-1: Manufacturer: syz [ 526.342074][T12373] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 526.351874][ T29] cdc_wdm 3-1:1.0: skipping garbage [ 526.357316][ T29] cdc_wdm 3-1:1.0: skipping garbage [ 526.479969][ T29] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 526.840126][ T30] kauditd_printk_skb: 29 callbacks suppressed [ 526.840145][ T30] audit: type=1326 audit(1773907594.348:597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12391 comm="syz.0.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d8bb9c799 code=0x7ffc0000 [ 526.874367][ T29] cdc_wdm 3-1:1.0: Unknown control protocol [ 527.017439][ T30] audit: type=1326 audit(1773907594.348:598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12391 comm="syz.0.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d8bb9c799 code=0x7ffc0000 [ 527.047510][T11944] rc_core: IR keymap rc-imon-pad not found [ 527.068484][T11944] Registered IR keymap rc-empty [ 527.092791][T11944] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 527.191717][ T30] audit: type=1326 audit(1773907594.348:599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12391 comm="syz.0.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1d8bb9c799 code=0x7ffc0000 [ 527.215208][ T30] audit: type=1326 audit(1773907594.358:600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12391 comm="syz.0.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d8bb9c799 code=0x7ffc0000 [ 527.238770][T10354] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 527.245417][T11944] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 527.460452][T11944] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 527.502022][T11944] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input50 [ 527.576833][T11944] imon 5-1:0.0: iMON device (15c2:0041, intf0) on usb<5:47> initialized [ 527.586026][ T30] audit: type=1326 audit(1773907594.358:601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12391 comm="syz.0.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d8bb9c799 code=0x7ffc0000 [ 527.628528][T10354] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 527.639558][T10354] usb 4-1: config 0 interface 0 has no altsetting 0 [ 527.655366][ C1] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 527.672113][T10354] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 527.681669][T10354] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 527.697942][ T30] audit: type=1326 audit(1773907594.388:602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12391 comm="syz.0.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1d8bb9c799 code=0x7ffc0000 [ 527.738675][T11944] usb 5-1: USB disconnect, device number 47 [ 527.749493][ T30] audit: type=1326 audit(1773907594.418:603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12391 comm="syz.0.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d8bb9c799 code=0x7ffc0000 [ 527.787453][T12399] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1828'. [ 527.797843][T12399] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check. [ 527.847598][T10354] usb 4-1: Product: syz [ 527.852799][T10354] usb 4-1: Manufacturer: syz [ 527.867910][ T30] audit: type=1326 audit(1773907594.418:604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12391 comm="syz.0.1826" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d8bb9c799 code=0x7ffc0000 [ 527.897207][T10354] usb 4-1: SerialNumber: syz [ 528.002203][ T5886] usb 3-1: USB disconnect, device number 55 [ 528.023442][T10354] usb 4-1: config 0 descriptor?? [ 528.081218][T10354] usb 4-1: selecting invalid altsetting 0 [ 528.790575][T12409] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1831'. [ 528.804758][T12393] netlink: 'syz.3.1825': attribute type 23 has an invalid length. [ 528.858022][T10354] usb 4-1: USB disconnect, device number 54 [ 528.955102][ T8488] udevd[8488]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 529.099431][T12419] netlink: 4136 bytes leftover after parsing attributes in process `syz.1.1833'. [ 529.115220][T12419] tipc: Failed to remove unknown binding: 66,1,1/4269801487:157180561/157180563 [ 530.042955][T12437] x_tables: duplicate underflow at hook 3 [ 530.066283][T12431] macsec0: entered promiscuous mode [ 530.075260][T12435] macsec0: left promiscuous mode [ 530.089762][T12431] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1840'. [ 530.240462][T12442] syzkaller0: entered promiscuous mode [ 530.252677][T12442] syzkaller0: entered allmulticast mode [ 530.369084][T12444] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1843'. [ 530.427480][T11934] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 530.603853][T11934] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 530.623620][T11934] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 530.661762][T11934] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 530.701892][T11934] usb 5-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 530.761077][T11934] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 530.844718][T11934] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 530.958490][T11934] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 530.997849][T11934] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 531.027129][T11934] usb 5-1: Product: syz [ 531.058741][T11934] usb 5-1: Manufacturer: syz [ 531.098073][T12429] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 531.122681][T11934] cdc_wdm 5-1:1.0: skipping garbage [ 531.128458][T10354] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 531.146229][T12455] netlink: 'syz.2.1848': attribute type 10 has an invalid length. [ 531.148056][T11934] cdc_wdm 5-1:1.0: skipping garbage [ 531.176415][T11934] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 531.196897][T12455] xfrm0: entered promiscuous mode [ 531.202284][T11934] cdc_wdm 5-1:1.0: Unknown control protocol [ 531.212530][T12455] xfrm0: entered allmulticast mode [ 531.219347][T12455] team0: Device xfrm0 is of different type [ 531.287206][T11944] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 531.308774][T10354] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 531.333822][T10354] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 531.363842][T10354] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 531.417048][T10354] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 531.440569][T11944] usb 4-1: unable to get BOS descriptor or descriptor too short [ 531.447242][T10354] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.452815][T11944] usb 4-1: config 1 interface 0 has no altsetting 0 [ 531.470723][T10354] usb 1-1: config 0 descriptor?? [ 531.473039][T11944] usb 4-1: string descriptor 0 read error: -22 [ 531.578922][T11944] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.40 [ 531.606305][T11944] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.738073][ T30] audit: type=1326 audit(1773907599.258:605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12459 comm="syz.2.1850" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4bc8b9c799 code=0x0 [ 531.890523][T12449] x_tables: arp_tables: .0 target: invalid size 8 (kernel) != (user) 0 [ 531.902563][T10354] usbhid 1-1:0.0: can't add hid device: -71 [ 531.908849][T10354] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 531.931116][T10354] usb 1-1: USB disconnect, device number 45 [ 532.057762][T12453] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.066827][T12453] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.097087][T11934] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 532.269688][T11934] usb 3-1: config 5 has an invalid interface number: 217 but max is 0 [ 532.279681][T11934] usb 3-1: config 5 has no interface number 0 [ 532.291085][T11934] usb 3-1: config 5 interface 217 has no altsetting 0 [ 532.307307][T11934] usb 3-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice=ff.11 [ 532.332427][T11934] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.347158][T11934] usb 3-1: Product: syz [ 532.351664][T11934] usb 3-1: Manufacturer: syz [ 532.356288][T11934] usb 3-1: SerialNumber: syz [ 532.496092][T12468] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.515917][T12468] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.583698][T12471] FAULT_INJECTION: forcing a failure. [ 532.583698][T12471] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 532.626239][T12471] CPU: 0 UID: 0 PID: 12471 Comm: syz.0.1853 Tainted: G L syzkaller #0 PREEMPT(full) [ 532.626271][T12471] Tainted: [L]=SOFTLOCKUP [ 532.626278][T12471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 532.626290][T12471] Call Trace: [ 532.626298][T12471] [ 532.626311][T12471] dump_stack_lvl+0xe8/0x150 [ 532.626347][T12471] should_fail_ex+0x412/0x560 [ 532.626382][T12471] _copy_from_user+0x2d/0xb0 [ 532.626404][T12471] rds_setsockopt+0x610/0xd90 [ 532.626519][T12471] ? __pfx_rds_setsockopt+0x10/0x10 [ 532.626542][T12471] ? fd_install+0x94/0x3d0 [ 532.626571][T12471] ? __pfx_aa_sk_perm+0x10/0x10 [ 532.626601][T12471] ? aa_sock_opt_perm+0xff/0x1a0 [ 532.626631][T12471] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 532.626654][T12471] ? __pfx_rds_setsockopt+0x10/0x10 [ 532.626676][T12471] do_sock_setsockopt+0x17c/0x1b0 [ 532.626703][T12471] __x64_sys_setsockopt+0x13d/0x1b0 [ 532.626728][T12471] do_syscall_64+0x14d/0xf80 [ 532.626749][T12471] ? trace_irq_disable+0x3b/0x150 [ 532.626785][T12471] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.626806][T12471] ? clear_bhb_loop+0x40/0x90 [ 532.626828][T12471] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.626848][T12471] RIP: 0033:0x7f1d8bb9c799 [ 532.626865][T12471] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 532.626882][T12471] RSP: 002b:00007f1d8ca14028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 532.626903][T12471] RAX: ffffffffffffffda RBX: 00007f1d8be15fa0 RCX: 00007f1d8bb9c799 [ 532.626917][T12471] RDX: 000000000000000a RSI: 0000000000000114 RDI: 0000000000000003 [ 532.626928][T12471] RBP: 00007f1d8ca14090 R08: 0000000000000004 R09: 0000000000000000 [ 532.626940][T12471] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 532.626951][T12471] R13: 00007f1d8be16038 R14: 00007f1d8be15fa0 R15: 00007f1d8bf3fa48 [ 532.626980][T12471] [ 533.134298][ T5886] usb 5-1: USB disconnect, device number 48 [ 534.107328][T11944] usbhid 4-1:1.0: can't add hid device: -71 [ 534.144178][T11944] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 534.169710][T11944] usb 4-1: USB disconnect, device number 55 [ 534.266884][T12493] [U] .h0FwZ,iqgҏV2sO [ 534.273134][T12493] [U] ` w*BBOLhU [ 534.277692][T12493] [U] w$n|#%o.z\̧mРw [ 534.805972][T12502] netdevsim netdevsim3: Direct firmware load for failed with error -2 [ 534.814958][T12502] netdevsim netdevsim3: Falling back to sysfs fallback for: [ 535.147732][T12488] [U] R{ꫢ S [ 535.229669][T11934] usb 3-1: unknown interface protocol 0xc9, assuming v1 [ 535.284372][T11934] usb 3-1: cannot find UAC_HEADER [ 535.328675][T11934] snd-usb-audio 3-1:5.217: probe with driver snd-usb-audio failed with error -22 [ 535.341079][T11934] usb 3-1: USB disconnect, device number 56 [ 535.377014][ T9476] udevd[9476]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:5.217/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 535.476023][T12507] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1862'. [ 535.974046][T11944] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 536.273828][T11944] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 536.287439][T11933] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 536.295584][T11944] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.374381][T12522] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1868'. [ 536.384078][T12522] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1868'. [ 536.394156][T11944] usb 3-1: Product: syz [ 536.394190][T11944] usb 3-1: Manufacturer: syz [ 536.394205][T11944] usb 3-1: SerialNumber: syz [ 536.449714][T11933] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 536.462283][T11933] usb 1-1: config 0 interface 0 has no altsetting 0 [ 536.483535][T11933] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 536.496440][T11933] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 536.513964][T11933] usb 1-1: Product: syz [ 536.533137][T11933] usb 1-1: Manufacturer: syz [ 536.551090][T11933] usb 1-1: SerialNumber: syz [ 536.602417][T11933] usb 1-1: config 0 descriptor?? [ 536.651544][T11933] usb 1-1: selecting invalid altsetting 0 [ 536.902011][T12515] netlink: 'syz.0.1864': attribute type 23 has an invalid length. [ 536.911754][T11933] usb 1-1: USB disconnect, device number 46 [ 537.007334][T12517] pim6reg: entered allmulticast mode [ 537.015053][T12517] pim6reg: left allmulticast mode [ 537.267724][T12529] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1871'. [ 537.307295][ T29] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 537.348620][T12531] dlm: no locking on control device [ 537.496458][ T29] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 537.515581][ T29] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 537.552451][ T29] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 537.579996][ T29] usb 5-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 537.597517][ T29] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 537.609029][ T5886] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 537.644437][T12533] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 537.663107][ T29] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 537.679927][T12533] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 537.727190][ T29] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 537.752089][ T29] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 537.766076][ T29] usb 5-1: Product: syz [ 537.772318][ T29] usb 5-1: Manufacturer: syz [ 537.809491][T12523] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 537.823433][ T29] cdc_wdm 5-1:1.0: skipping garbage [ 537.843285][ T29] cdc_wdm 5-1:1.0: skipping garbage [ 537.858236][ T29] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 537.865394][ T29] cdc_wdm 5-1:1.0: Unknown control protocol [ 538.532519][T11944] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 538.607805][T11944] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 538.620125][T11944] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 538.698354][T11944] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 538.776650][T11944] usb 3-1: USB disconnect, device number 57 [ 538.802326][T12550] FAULT_INJECTION: forcing a failure. [ 538.802326][T12550] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 538.830948][T12550] CPU: 0 UID: 0 PID: 12550 Comm: syz.2.1876 Tainted: G L syzkaller #0 PREEMPT(full) [ 538.830980][T12550] Tainted: [L]=SOFTLOCKUP [ 538.830987][T12550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 538.830999][T12550] Call Trace: [ 538.831006][T12550] [ 538.831015][T12550] dump_stack_lvl+0xe8/0x150 [ 538.831050][T12550] should_fail_ex+0x412/0x560 [ 538.831083][T12550] _copy_from_iter+0x1d3/0x1670 [ 538.831119][T12550] ? rcu_is_watching+0x15/0xb0 [ 538.831154][T12550] ? __pfx__copy_from_iter+0x10/0x10 [ 538.831192][T12550] ? netlink_sendmsg+0x650/0xb40 [ 538.831221][T12550] ? skb_put+0x11b/0x210 [ 538.831243][T12550] netlink_sendmsg+0x6c0/0xb40 [ 538.831282][T12550] ? __pfx_netlink_sendmsg+0x10/0x10 [ 538.831314][T12550] ? aa_sock_msg_perm+0xf1/0x1b0 [ 538.831345][T12550] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 538.831371][T12550] ____sys_sendmsg+0x972/0x9f0 [ 538.831392][T12550] ? __lock_acquire+0x6b5/0x2cf0 [ 538.831425][T12550] ? __pfx_____sys_sendmsg+0x10/0x10 [ 538.831457][T12550] ? import_iovec+0x73/0xa0 [ 538.831482][T12550] ___sys_sendmsg+0x2a5/0x360 [ 538.831510][T12550] ? __pfx____sys_sendmsg+0x10/0x10 [ 538.831538][T12550] ? kstrtouint+0x6e/0xe0 [ 538.831599][T12550] ? __fget_files+0x2a/0x420 [ 538.831628][T12550] ? __fget_files+0x3a0/0x420 [ 538.831668][T12550] __sys_sendmmsg+0x27c/0x4e0 [ 538.831696][T12550] ? __pfx___sys_sendmmsg+0x10/0x10 [ 538.831717][T12550] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 538.831770][T12550] ? rcu_is_watching+0x15/0xb0 [ 538.831805][T12550] __x64_sys_sendmmsg+0xa0/0xc0 [ 538.831830][T12550] do_syscall_64+0x14d/0xf80 [ 538.831851][T12550] ? trace_irq_disable+0x3b/0x150 [ 538.831879][T12550] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.831900][T12550] ? clear_bhb_loop+0x40/0x90 [ 538.831924][T12550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.831943][T12550] RIP: 0033:0x7f4bc8b9c799 [ 538.831965][T12550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 538.831981][T12550] RSP: 002b:00007f4bc9a51028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 538.832003][T12550] RAX: ffffffffffffffda RBX: 00007f4bc8e15fa0 RCX: 00007f4bc8b9c799 [ 538.832016][T12550] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 538.832029][T12550] RBP: 00007f4bc9a51090 R08: 0000000000000000 R09: 0000000000000000 [ 538.832041][T12550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 538.832052][T12550] R13: 00007f4bc8e16038 R14: 00007f4bc8e15fa0 R15: 00007f4bc8f3fa48 [ 538.832082][T12550] [ 538.901274][T12552] syzkaller0: entered promiscuous mode [ 539.123742][T12546] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 539.136156][T12552] syzkaller0: entered allmulticast mode [ 539.708420][T12566] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 539.736693][T12565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1882'. [ 539.838259][T11943] usb 5-1: USB disconnect, device number 49 [ 539.896315][T12566] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 539.988743][T12569] vlan3: entered promiscuous mode [ 539.994075][T12569] bridge0: entered promiscuous mode [ 540.095339][T12577] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 540.101986][T12577] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 540.122447][T12577] vhci_hcd vhci_hcd.0: Device attached [ 540.213822][T12578] vhci_hcd: connection closed [ 540.215258][ T6356] vhci_hcd vhci_hcd.1: stop threads [ 540.238693][ T6356] vhci_hcd vhci_hcd.1: release socket [ 540.244444][ T6356] vhci_hcd vhci_hcd.1: disconnect device [ 541.008710][T11934] usb 3-1: new low-speed USB device number 58 using dummy_hcd [ 541.055520][T12604] FAULT_INJECTION: forcing a failure. [ 541.055520][T12604] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 541.070589][T12604] CPU: 0 UID: 0 PID: 12604 Comm: syz.1.1894 Tainted: G L syzkaller #0 PREEMPT(full) [ 541.070617][T12604] Tainted: [L]=SOFTLOCKUP [ 541.070624][T12604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 541.070635][T12604] Call Trace: [ 541.070642][T12604] [ 541.070650][T12604] dump_stack_lvl+0xe8/0x150 [ 541.070682][T12604] should_fail_ex+0x412/0x560 [ 541.070732][T12604] prepare_alloc_pages+0x22a/0x650 [ 541.070796][T12604] __alloc_frozen_pages_noprof+0x12f/0x380 [ 541.070826][T12604] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 541.070855][T12604] ? __pfx_policy_nodemask+0x10/0x10 [ 541.070886][T12604] ? __lock_acquire+0x6b5/0x2cf0 [ 541.070914][T12604] alloc_pages_mpol+0x232/0x4a0 [ 541.070945][T12604] alloc_pages_noprof+0xa8/0x190 [ 541.070971][T12604] pte_alloc_one+0x22/0x370 [ 541.071015][T12604] __pte_alloc+0x25/0x1a0 [ 541.071042][T12604] do_pte_missing+0x2c47/0x3490 [ 541.071069][T12604] ? do_raw_spin_unlock+0xf5/0x210 [ 541.071101][T12604] handle_mm_fault+0x1bec/0x3310 [ 541.071145][T12604] ? handle_mm_fault+0xee/0x3310 [ 541.071182][T12604] ? __pfx_handle_mm_fault+0x10/0x10 [ 541.071232][T12604] ? lock_mm_and_find_vma+0xa7/0x340 [ 541.071256][T12604] do_user_addr_fault+0x75b/0x1340 [ 541.071298][T12604] exc_page_fault+0x6a/0xc0 [ 541.071322][T12604] asm_exc_page_fault+0x26/0x30 [ 541.071341][T12604] RIP: 0010:rep_movs_alternative+0xf/0x90 [ 541.071425][T12604] Code: c4 10 e9 94 48 04 00 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e [ 541.071442][T12604] RSP: 0018:ffffc90005fcfcb8 EFLAGS: 00050202 [ 541.071463][T12604] RAX: 00007ffffffff001 RBX: 0000000000000004 RCX: 0000000000000004 [ 541.071476][T12604] RDX: 0000000000000001 RSI: 0000200000000140 RDI: ffffc90005fcfd40 [ 541.071489][T12604] RBP: ffffc90005fcfe48 R08: 0000000000000003 R09: 0000000000000004 [ 541.071501][T12604] R10: dffffc0000000000 R11: fffff52000bf9fa8 R12: 1ffff92000bf9fa4 [ 541.071516][T12604] R13: 1ffff92000bf9fa4 R14: ffffc90005fcfd40 R15: 0000200000000140 [ 541.071547][T12604] _copy_from_user+0x7a/0xb0 [ 541.071570][T12604] rds_setsockopt+0x610/0xd90 [ 541.071598][T12604] ? __pfx_rds_setsockopt+0x10/0x10 [ 541.071621][T12604] ? fd_install+0x94/0x3d0 [ 541.071650][T12604] ? __pfx_aa_sk_perm+0x10/0x10 [ 541.071681][T12604] ? aa_sock_opt_perm+0xff/0x1a0 [ 541.071713][T12604] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 541.071734][T12604] ? __pfx_rds_setsockopt+0x10/0x10 [ 541.071757][T12604] do_sock_setsockopt+0x17c/0x1b0 [ 541.071785][T12604] __x64_sys_setsockopt+0x13d/0x1b0 [ 541.071812][T12604] do_syscall_64+0x14d/0xf80 [ 541.071833][T12604] ? trace_irq_disable+0x3b/0x150 [ 541.071861][T12604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.071881][T12604] ? clear_bhb_loop+0x40/0x90 [ 541.071906][T12604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.071925][T12604] RIP: 0033:0x7f7e9e79c799 [ 541.071942][T12604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.071959][T12604] RSP: 002b:00007f7e9f626028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 541.071979][T12604] RAX: ffffffffffffffda RBX: 00007f7e9ea15fa0 RCX: 00007f7e9e79c799 [ 541.071993][T12604] RDX: 000000000000000a RSI: 0000000000000114 RDI: 0000000000000003 [ 541.072005][T12604] RBP: 00007f7e9f626090 R08: 0000000000000004 R09: 0000000000000000 [ 541.072017][T12604] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000001 [ 541.072029][T12604] R13: 00007f7e9ea16038 R14: 00007f7e9ea15fa0 R15: 00007f7e9eb3fa48 [ 541.072060][T12604] [ 541.562653][T12616] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 541.607244][T11934] usb 3-1: device descriptor read/64, error -71 [ 541.629673][T12612] warning: `syz.3.1893' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 541.827431][T12615] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 541.867337][T11934] usb 3-1: new low-speed USB device number 59 using dummy_hcd [ 541.997474][T11934] usb 3-1: device descriptor read/64, error -71 [ 542.107416][T11934] usb usb3-port1: attempt power cycle [ 542.477459][T11934] usb 3-1: new low-speed USB device number 60 using dummy_hcd [ 542.517424][T11934] usb 3-1: device descriptor read/8, error -71 [ 542.518862][T11943] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 542.718870][T11943] usb 2-1: Using ep0 maxpacket: 16 [ 542.757390][T11934] usb 3-1: new low-speed USB device number 61 using dummy_hcd [ 542.773147][T11943] usb 2-1: config 1 interface 0 has no altsetting 0 [ 542.793260][T11943] usb 2-1: string descriptor 0 read error: -22 [ 542.800086][T11943] usb 2-1: New USB device found, idVendor=17ef, idProduct=6067, bcdDevice= 0.40 [ 542.829773][T11943] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.878433][T11934] usb 3-1: device descriptor read/8, error -71 [ 543.011006][T11934] usb usb3-port1: unable to enumerate USB device [ 543.224988][T12638] tipc: Started in network mode [ 543.245898][T12638] tipc: Node identity 84e, cluster identity 4711 [ 543.277238][T12638] tipc: Node number set to 2126 [ 543.284626][T12641] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1904'. [ 543.303760][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.318072][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.325251][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.332440][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.341862][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.349052][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.405334][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.423139][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.431531][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.440988][T11943] lenovo 0003:17EF:6067.000A: unknown main item tag 0x0 [ 543.475907][T12647] syzkaller0: entered promiscuous mode [ 543.487216][T12647] syzkaller0: entered allmulticast mode [ 543.525437][T11943] lenovo 0003:17EF:6067.000A: hidraw0: USB HID vff.7f Device [HID 17ef:6067] on usb-dummy_hcd.1-1/input0 [ 543.550128][T11943] usb 2-1: USB disconnect, device number 67 [ 543.636665][T12650] fido_id[12650]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 543.660837][T12652] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1909'. [ 543.807813][T12654] loop2: detected capacity change from 0 to 7 [ 543.815458][T12654] Dev loop2: unable to read RDB block 7 [ 543.822454][T12654] loop2: AHDI p1 p2 p3 [ 543.826694][T12654] loop2: partition table partially beyond EOD, truncated [ 543.847494][T12654] loop2: p1 start 1601398130 is beyond EOD, truncated [ 543.858908][T12654] loop2: p2 start 1702059890 is beyond EOD, truncated [ 544.426630][T12675] netlink: 'syz.3.1918': attribute type 6 has an invalid length. [ 544.461110][T12675] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1918'. [ 544.527284][T11944] usb 2-1: new full-speed USB device number 68 using dummy_hcd [ 544.689307][T11944] usb 2-1: config 1 has an invalid descriptor of length 249, skipping remainder of the config [ 544.739368][T11944] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 544.917587][T11944] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 544.926721][T11944] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.943598][T11944] usb 2-1: Product: syz [ 544.948186][T11944] usb 2-1: Manufacturer: syz [ 544.952820][T11944] usb 2-1: SerialNumber: syz [ 544.997227][T11943] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 545.140049][T12686] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1922'. [ 545.157842][T12686] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1922'. [ 545.246647][T11943] usb 4-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 545.269386][T11943] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.286768][T11943] usb 4-1: Product: syz [ 545.296908][T11943] usb 4-1: Manufacturer: syz [ 545.301981][T11943] usb 4-1: SerialNumber: syz [ 545.498956][T11943] usb 4-1: config 0 descriptor?? [ 545.567040][T11943] hub 4-1:0.0: bad descriptor, ignoring hub [ 545.604971][T11943] hub 4-1:0.0: probe with driver hub failed with error -5 [ 545.768011][T11943] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 545.816971][T11943] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 545.827926][T11943] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 545.839043][T11943] usb 4-1: media controller created [ 545.860704][T11943] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 546.082888][T11943] DVB: Unable to find symbol dib7000p_attach() [ 546.091272][T11943] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 546.213568][T11943] rc_core: IR keymap rc-dib0700-rc5 not found [ 546.227549][T11943] Registered IR keymap rc-empty [ 546.239685][T11943] dvb-usb: could not initialize remote control. [ 546.257350][T11943] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 546.735693][T12703] i2c i2c-1: Invalid block size returned: 58 [ 547.150068][T11933] usb 4-1: USB disconnect, device number 56 [ 547.232738][T11944] usb 2-1: unknown interface protocol 0xbd, assuming v1 [ 547.285040][T11944] usb 2-1: cannot find UAC_HEADER [ 547.339431][T11933] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 547.428070][T10354] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 547.440990][T11944] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 547.460784][T11944] usb 2-1: USB disconnect, device number 68 [ 547.508796][ T9476] udevd[9476]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 547.596360][T10354] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 547.619075][T10354] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 547.655935][T10354] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 547.681232][T10354] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 547.725930][T10354] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 547.763534][T10354] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 547.776751][T12716] FAULT_INJECTION: forcing a failure. [ 547.776751][T12716] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 547.909043][T10354] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 547.933216][T10354] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 547.989519][T10354] usb 3-1: Product: syz [ 547.999652][T12720] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1930'. [ 548.042530][T10354] usb 3-1: Manufacturer: syz [ 548.091743][T12701] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 548.101779][T10354] cdc_wdm 3-1:1.0: skipping garbage [ 548.104260][T12716] CPU: 1 UID: 0 PID: 12716 Comm: syz.1.1929 Tainted: G L syzkaller #0 PREEMPT(full) [ 548.104342][T12716] Tainted: [L]=SOFTLOCKUP [ 548.104362][T12716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 548.104394][T12716] Call Trace: [ 548.104415][T12716] [ 548.104442][T12716] dump_stack_lvl+0xe8/0x150 [ 548.104526][T12716] should_fail_ex+0x412/0x560 [ 548.104636][T12716] _copy_to_user+0x31/0xb0 [ 548.104722][T12716] copy_siginfo_to_user+0x22/0xc0 [ 548.104823][T12716] x64_setup_rt_frame+0x77b/0xcb0 [ 548.105001][T12716] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 548.105080][T12716] arch_do_signal_or_restart+0x424/0x830 [ 548.105149][T12716] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 548.105228][T12716] ? do_readv+0x2b1/0x2e0 [ 548.105324][T12716] exit_to_user_mode_loop+0x86/0x480 [ 548.105386][T12716] ? rcu_is_watching+0x15/0xb0 [ 548.105465][T12716] do_syscall_64+0x32d/0xf80 [ 548.105510][T12716] ? trace_irq_disable+0x3b/0x150 [ 548.105595][T12716] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.105646][T12716] ? clear_bhb_loop+0x40/0x90 [ 548.105712][T12716] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.105756][T12716] RIP: 0033:0x7f7e9e79c797 [ 548.105805][T12716] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 [ 548.105852][T12716] RSP: 002b:00007f7e9f626028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 548.105903][T12716] RAX: 0000000000000013 RBX: 00007f7e9ea15fa0 RCX: 00007f7e9e79c799 [ 548.105941][T12716] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000006 [ 548.105971][T12716] RBP: 00007f7e9f626090 R08: 0000000000000000 R09: 0000000000000000 [ 548.106001][T12716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 548.106031][T12716] R13: 00007f7e9ea16038 R14: 00007f7e9ea15fa0 R15: 00007f7e9eb3fa48 [ 548.106152][T12716] [ 548.310976][T12720] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 548.367705][T12720] bond2 (unregistering): Released all slaves [ 548.498624][T10354] cdc_wdm 3-1:1.0: skipping garbage [ 548.522648][T10354] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 548.547474][T10354] cdc_wdm 3-1:1.0: Unknown control protocol [ 548.621226][T12724] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1931'. [ 548.664583][T12724] A link change request failed with some changes committed already. Interface vcan0 may have been left with an inconsistent configuration, please check. [ 548.977479][T10354] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 549.159347][T10354] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 549.170041][T10354] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 549.200453][T10354] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 549.254484][T10354] usb 2-1: config 0 descriptor?? [ 549.270286][T12738] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1935'. [ 549.494615][T10354] usb 2-1: USB disconnect, device number 69 [ 549.579162][ T30] audit: type=1326 audit(1773907617.088:606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12745 comm="syz.3.1939" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x0 [ 549.694680][T12726] fuse: Unknown parameter 'Fd0xffffffffffffffff' [ 549.947191][T11933] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 550.016087][ T9] usb 3-1: USB disconnect, device number 62 [ 550.120683][T11933] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 550.135571][T11933] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 550.145705][T11933] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.158913][T11933] usb 2-1: config 0 descriptor?? [ 550.264643][T12759] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1944'. [ 550.427491][ T9] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 550.610460][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 550.630813][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 550.654554][ T9] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 550.665250][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.673667][ T9] usb 3-1: Product: syz [ 550.679498][ T9] usb 3-1: Manufacturer: syz [ 550.684233][ T9] usb 3-1: SerialNumber: syz [ 550.693607][ T9] usb 3-1: config 0 descriptor?? [ 550.708122][ T9] usb 3-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 550.729901][T12727] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 550.739526][T12727] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 550.906327][T12766] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 550.916944][T12755] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 550.939303][T12755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 550.948187][T12755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 551.239722][ T9] usb 3-1: USB disconnect, device number 63 [ 551.352898][T10481] udevd[10481]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 552.053877][ T9] usb 2-1: USB disconnect, device number 70 [ 552.351129][T12788] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1953'. [ 553.667420][ T9] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 553.831767][ T9] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 553.841087][ T9] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 553.853626][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 553.869733][ T9] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 553.897060][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 553.919786][T12813] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1959'. [ 553.934438][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 553.957699][T12813] input: syz0 as /devices/virtual/input/input52 [ 553.985126][ T9] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 553.996070][ T9] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 554.034424][ T9] usb 3-1: Product: syz [ 554.043845][ T9] usb 3-1: Manufacturer: syz [ 554.061671][T12793] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 554.072434][ T9] cdc_wdm 3-1:1.0: skipping garbage [ 554.088307][ T9] cdc_wdm 3-1:1.0: skipping garbage [ 554.103321][ T9] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 554.116148][ T9] cdc_wdm 3-1:1.0: Unknown control protocol [ 554.237511][T11933] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 554.422700][T12818] [U] .h0FwZ,iqgҏV2sO [ 554.428876][T12818] [U] ` w*BBOLhU [ 554.433414][T12818] [U] w$n|#%o.z\̧mРw [ 554.487921][T11933] usb 2-1: Using ep0 maxpacket: 16 [ 554.593041][T11933] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 554.604950][T11933] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 554.629183][T11933] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 554.696015][T11933] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 554.709339][T11933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.719158][T11933] usb 2-1: Product: syz [ 554.723817][T11933] usb 2-1: Manufacturer: syz [ 554.772910][T11933] usb 2-1: SerialNumber: syz [ 555.275682][T11933] usb 2-1: 0:2 : does not exist [ 555.282379][T12815] [U] R{ꫢ S [ 555.746133][T11944] usb 3-1: USB disconnect, device number 64 [ 555.810250][T12835] netdevsim netdevsim3: Direct firmware load for failed with error -2 [ 555.819039][T12835] netdevsim netdevsim3: Falling back to sysfs fallback for: [ 555.878452][T12813] dummy0: entered allmulticast mode [ 555.884187][T12813] dummy0: left allmulticast mode [ 556.003919][T11933] usb 2-1: 1:0: cannot get min/max values for control 4 (id 1) [ 556.163388][T11933] usb 2-1: USB disconnect, device number 71 [ 556.438552][T12844] bond_slave_0: entered promiscuous mode [ 556.444334][T12844] bond_slave_1: entered promiscuous mode [ 556.470423][T12844] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 556.490472][T12844] bond_slave_0: left promiscuous mode [ 556.495928][T12844] bond_slave_1: left promiscuous mode [ 556.807708][T12846] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.1966'. [ 556.889923][T12848] binder: 12847:12848 ioctl c0046209 200000000000000 returned -22 [ 557.032381][T12852] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1968'. [ 557.189789][T12856] vlan2: entered promiscuous mode [ 557.194843][T12856] bridge0: entered promiscuous mode [ 557.578807][T12867] program syz.2.1974 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 558.491760][T12869] syz.0.1973 (12869): /proc/12868/oom_adj is deprecated, please use /proc/12868/oom_score_adj instead. [ 558.585596][T12882] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1978'. [ 558.706581][T12886] openvswitch: netlink: VXLAN extension message has 16 unknown bytes. [ 559.807178][ T30] audit: type=1326 audit(1773907627.318:607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.034713][ T30] audit: type=1326 audit(1773907627.318:608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.137936][ T30] audit: type=1326 audit(1773907627.318:609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.209329][ T30] audit: type=1326 audit(1773907627.318:610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.233808][ T30] audit: type=1326 audit(1773907627.318:611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.282013][ T30] audit: type=1326 audit(1773907627.318:612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.325140][ T30] audit: type=1326 audit(1773907627.318:613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.350286][ T30] audit: type=1326 audit(1773907627.318:614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.428656][ T30] audit: type=1326 audit(1773907627.318:615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=326 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 560.558049][ T30] audit: type=1326 audit(1773907627.318:616): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12898 comm="syz.3.1982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4f1ef9c799 code=0x7ffc0000 [ 561.137275][T11944] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 561.261527][T12920] netdevsim netdevsim3: Direct firmware load for failed with error -2 [ 561.270208][T12920] netdevsim netdevsim3: Falling back to sysfs fallback for: [ 561.388918][T11944] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 561.405185][T11944] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 561.427231][T11944] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 561.457222][T11944] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 561.548036][T11944] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 561.711254][T11944] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 561.730350][T11944] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 561.748949][T11944] usb 2-1: Product: syz [ 561.759769][T11944] usb 2-1: Manufacturer: syz [ 561.793106][T11944] cdc_wdm 2-1:1.0: skipping garbage [ 561.798649][T11944] cdc_wdm 2-1:1.0: skipping garbage [ 561.811663][T11944] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 561.825489][T11944] cdc_wdm 2-1:1.0: Unknown control protocol [ 562.003210][T11944] usb 2-1: USB disconnect, device number 72 [ 562.354628][T12933] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1994'. [ 562.669616][T11933] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 562.723409][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.729917][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.809952][T11933] usb 2-1: device descriptor read/64, error -71 [ 563.057240][T11933] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 563.087531][T11944] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 563.187539][T11933] usb 2-1: device descriptor read/64, error -71 [ 563.270286][T11944] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 563.282020][T11944] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 563.291869][T11944] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 563.298455][T11933] usb usb2-port1: attempt power cycle [ 563.305569][T11944] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 563.347171][T10354] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 563.369850][T11944] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 563.389841][T11944] usb 3-1: config 0 descriptor?? [ 563.447268][ T9] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 563.497458][T10354] usb 4-1: Using ep0 maxpacket: 32 [ 563.504542][T10354] usb 4-1: config 123 interface 0 has no altsetting 0 [ 563.515931][T10354] usb 4-1: New USB device found, idVendor=2040, idProduct=c612, bcdDevice=e5.51 [ 563.534517][T10354] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.554296][T10354] usb 4-1: Product: syz [ 563.562508][T10354] usb 4-1: Manufacturer: syz [ 563.572615][T10354] usb 4-1: SerialNumber: syz [ 563.610319][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 563.623359][ T9] usb 5-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 563.681504][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.700970][ T9] usb 5-1: Product: syz [ 563.710611][ T9] usb 5-1: Manufacturer: syz [ 563.730328][ T9] usb 5-1: SerialNumber: syz [ 563.767960][ T9] usb 5-1: config 0 descriptor?? [ 563.800191][ T9] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 563.813804][T12945] x_tables: arp_tables: .0 target: invalid size 8 (kernel) != (user) 0 [ 563.823085][T10354] usb 4-1: dvb_usb_v2: found a 'Hauppauge 126xxx' in warm state [ 563.832633][T11944] usbhid 3-1:0.0: can't add hid device: -71 [ 563.839067][T11944] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 563.851528][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 563.860285][T11944] usb 3-1: USB disconnect, device number 65 [ 563.872516][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 563.892397][T10354] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 563.914541][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 563.932880][T10354] dvbdev: DVB: registering new adapter (Hauppauge 126xxx) [ 563.940360][T12959] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2003'. [ 563.944263][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 563.966327][T10354] usb 4-1: media controller created [ 564.010846][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 564.020596][T12959] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2003'. [ 564.038579][T10354] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 564.038989][T12953] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.063963][T12953] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.099560][T12953] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] SMP KASAN PTI [ 564.111632][T12953] KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] [ 564.120132][T12953] CPU: 1 UID: 0 PID: 12953 Comm: syz.4.2001 Tainted: G L syzkaller #0 PREEMPT(full) [ 564.131101][T12953] Tainted: [L]=SOFTLOCKUP [ 564.135436][T12953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 564.145511][T12953] RIP: 0010:__mutex_lock+0x14b/0x1300 [ 564.150915][T12953] Code: 80 64 27 9a 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 e4 0f 00 00 83 3d f3 9e 77 0e 00 75 23 49 8d 7c 24 60 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 69 1d 80 f6 4d 39 64 24 60 0f 85 10 0f 00 [ 564.170555][T12953] RSP: 0018:ffffc900046c7420 EFLAGS: 00010202 [ 564.176661][T12953] RAX: 0000000000000019 RBX: 1ffff920008d8e9c RCX: ffffffff9a276403 [ 564.184659][T12953] RDX: 0000000000000000 RSI: ffffffff8e167aa0 RDI: 00000000000000c8 [ 564.192659][T12953] RBP: ffffc900046c75d8 R08: ffffc900046c7547 R09: 0000000000000000 [ 564.200668][T12953] R10: ffffc900046c7520 R11: fffff520008d8ea9 R12: 0000000000000068 [ 564.208670][T12953] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 564.216666][T12953] FS: 00007f19627eb6c0(0000) GS:ffff888125560000(0000) knlGS:0000000000000000 [ 564.225617][T12953] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 564.232246][T12953] CR2: 0000001b2e81aff8 CR3: 0000000055484000 CR4: 00000000003526f0 [ 564.240247][T12953] Call Trace: [ 564.243552][T12953] [ 564.246500][T12953] ? __mutex_lock+0x319/0x1300 [ 564.251286][T12953] ? __lock_acquire+0x6b5/0x2cf0 [ 564.256253][T12953] ? dvb_usbv2_generic_write+0x26/0x60 [ 564.261833][T12953] ? __mutex_trylock_common+0x158/0x260 [ 564.267402][T12953] ? mxl111sf_ctrl_msg+0xb0/0x2f0 [ 564.272510][T12953] ? __pfx___mutex_lock+0x10/0x10 [ 564.277551][T12953] ? __pfx___mutex_lock+0x10/0x10 [ 564.282597][T12953] ? __mutex_lock+0x319/0x1300 [ 564.287376][T12953] dvb_usbv2_generic_write+0x26/0x60 [ 564.292675][T12953] mxl111sf_ctrl_msg+0x160/0x2f0 [ 564.297633][T12953] mxl111sf_write_reg+0xa9/0x1b0 [ 564.302591][T12953] ? __pfx_mxl111sf_write_reg+0x10/0x10 [ 564.308155][T12953] ? __lock_acquire+0x6b5/0x2cf0 [ 564.313113][T12953] mxl111sf_i2c_xfer+0x496/0x5100 [ 564.318165][T12953] ? __pfx_mxl111sf_i2c_xfer+0x10/0x10 [ 564.323647][T12953] ? finish_task_switch+0x240/0x920 [ 564.328880][T12953] ? lockdep_hardirqs_on+0x7a/0x110 [ 564.334092][T12953] ? rcu_is_watching+0x15/0xb0 [ 564.338886][T12953] ? trace_sched_exit_tp+0x3a/0x150 [ 564.344103][T12953] ? __schedule+0x15f3/0x52d0 [ 564.348798][T12953] ? __pfx_stack_trace_save+0x10/0x10 [ 564.354186][T12953] ? __pfx_stack_trace_save+0x10/0x10 [ 564.359568][T12953] ? __pfx___schedule+0x10/0x10 [ 564.364429][T12953] ? register_lock_class+0x31/0x2e0 [ 564.369669][T12953] ? irqentry_exit+0x59e/0x620 [ 564.374448][T12953] ? lockdep_hardirqs_on+0x7a/0x110 [ 564.379659][T12953] ? irqentry_exit+0x59e/0x620 [ 564.384436][T12953] ? trace_irq_disable+0x3b/0x150 [ 564.389483][T12953] ? __pfx_mxl111sf_i2c_xfer+0x10/0x10 [ 564.394962][T12953] __i2c_transfer+0x79a/0x2020 [ 564.399828][T12953] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 564.405664][T12953] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 564.411490][T12953] ? i2c_transfer+0xc8/0x2d0 [ 564.416100][T12953] i2c_transfer+0x1cc/0x2d0 [ 564.420620][T12953] i2cdev_ioctl_rdwr+0x460/0x740 [ 564.425620][T12953] i2cdev_ioctl+0x6a5/0x880 [ 564.430157][T12953] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 564.435222][T12953] ? __fget_files+0x3a0/0x420 [ 564.439918][T12953] ? __fget_files+0x2a/0x420 [ 564.444536][T12953] ? bpf_lsm_file_ioctl+0x9/0x20 [ 564.449490][T12953] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 564.454532][T12953] __se_sys_ioctl+0xfc/0x170 [ 564.459138][T12953] do_syscall_64+0x14d/0xf80 [ 564.463742][T12953] ? trace_irq_disable+0x3b/0x150 [ 564.468787][T12953] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.474863][T12953] ? clear_bhb_loop+0x40/0x90 [ 564.479550][T12953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.485449][T12953] RIP: 0033:0x7f196199c799 [ 564.489977][T12953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 564.509608][T12953] RSP: 002b:00007f19627eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 564.518075][T12953] RAX: ffffffffffffffda RBX: 00007f1961c15fa0 RCX: 00007f196199c799 [ 564.526076][T12953] RDX: 0000200000000400 RSI: 0000000000000707 RDI: 0000000000000006 [ 564.534061][T12953] RBP: 00007f1961a32c99 R08: 0000000000000000 R09: 0000000000000000 [ 564.542133][T12953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 564.550115][T12953] R13: 00007f1961c16038 R14: 00007f1961c15fa0 R15: 00007f1961d3fa48 [ 564.558104][T12953] [ 564.561155][T12953] Modules linked in: [ 564.566650][T12953] ---[ end trace 0000000000000000 ]--- [ 564.574930][ T9] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 564.584085][ T9] usb 5-1: media controller created [ 564.595691][T12961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.606586][T12961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.635678][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 564.673596][T12953] RIP: 0010:__mutex_lock+0x14b/0x1300 [ 564.682998][T12953] Code: 80 64 27 9a 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 e4 0f 00 00 83 3d f3 9e 77 0e 00 75 23 49 8d 7c 24 60 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 69 1d 80 f6 4d 39 64 24 60 0f 85 10 0f 00 [ 564.703436][ T9] usb 5-1: selecting invalid altsetting 3 [ 564.719782][T12965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.731444][T12965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 564.745115][ T9] ttusb2: set interface to alts=3 failed [ 564.747176][T12953] RSP: 0018:ffffc900046c7420 EFLAGS: 00010202 [ 564.773287][T12953] RAX: 0000000000000019 RBX: 1ffff920008d8e9c RCX: ffffffff9a276403 [ 564.782050][T12953] RDX: 0000000000000000 RSI: ffffffff8e167aa0 RDI: 00000000000000c8 [ 564.790905][T12953] RBP: ffffc900046c75d8 R08: ffffc900046c7547 R09: 0000000000000000 [ 564.805811][T12953] R10: ffffc900046c7520 R11: fffff520008d8ea9 R12: 0000000000000068 [ 564.827183][T12953] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 564.856231][ T9] DVB: Unable to find symbol tda10086_attach() [ 564.863844][T12953] FS: 00007f19627eb6c0(0000) GS:ffff888125460000(0000) knlGS:0000000000000000 [ 564.873166][ T9] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 564.887622][ T9] dvb-usb: bulk message failed: -22 (4/0) [ 564.896167][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 564.914873][T12953] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 564.923893][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 564.934650][ T9] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 564.970382][ T9] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 564.984232][T12953] CR2: 000020000031e030 CR3: 0000000055484000 CR4: 00000000003526f0 [ 565.007485][T12953] Kernel panic - not syncing: Fatal exception [ 565.014178][T12953] Kernel Offset: disabled [ 565.018514][T12953] Rebooting in 86400 seconds..