last executing test programs: 2m59.088247691s ago: executing program 2 (id=1037): sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x44010}, 0x8000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x118) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) fsopen(&(0x7f0000000100)='gadgetfs\x00', 0x1) syz_open_dev$vim2m(0x0, 0x7, 0x2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5e114b6f, 0x12, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x10002, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r2, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE_wg(r2, 0x1, 0x19, &(0x7f0000000000)='wg2\x00', 0x4) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 2m57.123500061s ago: executing program 2 (id=1043): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001740)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r2, {0x5}, {0x0, 0x4888}, {0xa, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 2m56.99354841s ago: executing program 2 (id=1044): r0 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) sendmmsg$sock(r3, &(0x7f0000002c80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000008c0)="9a1646e333841dd817f884072bcfc4e86d09eae42c771150d2a0f7409c1370d3638a8b435039d8f5f5a58fd9696b618dee51e4869aced576ce4348d9b259fb3273c6a36fc309164021180c785a3c299cbf15a38790db0474eb0b41d11d4893959adec407e9ba742652a28fc5165a05b7593682298736a7ccd86db5f3758d2939e9992035d6de58a4b803a94a72a31139fd6e1f77b7e96492191da02c8bfd789de8bc6acd5484430d64a233fd9512f3d646d33db37e305f92dc1db89bd85b2689c942b596c0a45c4efff576", 0xcb}, {&(0x7f00000009c0)="efaf7a93d21cbcbd56d058e53b498eb5aec446ded5a0a15afc4a85e66ba967dd32bdaa041334d821c83f07626dff625725d9d7f2454a3c0354409cd461092701a394007cca7bf7ed39cb6d0860fc9fffc3867688808a8a9fa32d9c9f797ac6d2f35665413642d174ba233adaa36bf0d40144a05abc9458f98e5738d6952053397589681183bf74246782eaa788d1afbf227f54319c505f1678a3165181261067da7d2cc5ce2f9a8ca0b99fa09f8e95675cd7666c5e2edb4b8029c371ccfe0497285e0e223106e4b43dbbdae8faa67a625fff23346e701f1c8cf9b6cd0d485c422d1c07b63988d3377dfe6634b1e184", 0xef}, {&(0x7f0000000ac0)="8f30e4f3a357d24b35a884da0ffdc5c42f7ce57129b691f99daded3f1e2aa5f6738c747cd9fa7b3e59a5a24970b0a2a5bcc8cd72fc0a6e472442b441e273146cb840d20afb23fa12cfaaf4d54ffea9bdaf5d445e4773e815b6462cdc4b449d55a1d007a07e49cef17635abf4c4986abcc36fc5529e63aa97265af26fd3286548b2a7932c81883c382b1598d0761891370633573d40cd4b425576ff4998bf040fa0aef4b64392fc7f7b6fafb4a073a88f883f16c9c771664b430d91", 0xbb}, {&(0x7f0000000b80)="3b3d07b7091f697381965e2e7909f9f6f54a284af3f8fdb1c24e6d0c4a7f58ffca9b24b191f510fbf55fd3e76154e2a4fe1e14c7bbff4c24907805f79e2a90f0d8c8faccbd2243475ecfa1f5fac83b8910baf212596b2a4a23aab8eb9cfa683836af5e50b1bc4f815b49fc47f85fe32f63a26492042b663d8c955bfad12d47e8", 0x80}], 0x4}}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000d80)="d51927d7b27f39aa725cb19a990f66ac9aae2f7d92045a4c05e60f4dc5dc6c4e4ac8449b9915fb289bf1692a4c7d9440950ee716b680274b3c53048b6a2aeca47c5e6987db6b4fb364fa1e1709caa0696b9e02eabc8757ef2dd6a17f3efa", 0x5e}, {&(0x7f0000000e00)="96bc7002996addfa3b96a5e4de4cf18b08fa24022c9eb8cd8932ada8710619787de006", 0x23}, {&(0x7f0000000e40)="1304235350b0171b15c5c7a6c9861daf", 0x10}, {&(0x7f0000000e80)="048dc9fb57afe301fd6f4184903098607627504035b7aa74e71b85eaa192909644d18f5695718d3c3532f6ed73c2422e87d6d3032447f236426269422e70740455409baf685a743e7e079b3ac4a1b592da8a23ea97a80da6ec7fb46355caf53ab8efe6d61dbb939c5f96f86c3d", 0x6d}, {&(0x7f0000000f00)="68a55df1c6bed91373cc79fcf0ea4c17187a680c0c711ae1d37231d4e7cd61719f501fd0d890485c98ee906e64fad259a1", 0x31}], 0x5}}, {{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000010c0)="1f193ccd5e71244bc55dbcdc29e1a25fb59915f7f84fb5105984bc94ac926679df8c", 0x22}, {&(0x7f0000001100)="b35ba3572fcda875bc97e8", 0xb}, {&(0x7f0000001140)="795f2ce94a7d8725e389c01b493ee679f9e1f4660442a05c2cbbf66384679166ec101d934bd017c061424e92d24f48d86b", 0x31}, {&(0x7f0000001180)="93", 0x1}, {&(0x7f00000011c0)="3dff21fdbef2b0b843e0740163754db27084ece48f14e2ccb75ed71caecb8d01a49808a0a2269f17dc98a78e584f6cc71495faa98957034a6e6f6e9ea743d838d77a3f108a034c89", 0x48}, {&(0x7f0000001240)="b17b27be17bcb19544700a33471f8c21345d9ed983455906bb74ac68c911b5f14c7d60075f017c69c25768", 0x2b}, {&(0x7f0000001280)="45871f6c7aa143cfbb579d430702b24380586237795f6665c24e267fb8c62c14f85be705fbab74d85c8d479162b42724e414f24b9602b0c068930b8f0431f77f7ed4bb04c4bd7edbacb55c07e24b2b7ffbc83bb39385066e27b3b6727c8861edea62c5532877c2bc886e9f673bc9ef731ee32104bc102a8fda64676a9edf0e47f36cd6a35fd53b13b1f365ade8150f7e35c258b0253d8c4dcbc8", 0x9a}], 0x7}}, {{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f00000014c0)="d480dc1917d9339f4084892894143b343fddd9303f0429a7ae5d89e2d238c7a6d95b89164290c367be830f56c6b95c492363a9b522", 0x35}], 0x1}}], 0x5, 0x0) syncfs(r1) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r4, 0x107, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xfffffffe}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}]}]}], {0x14}}, 0xd4}, 0x1, 0x0, 0x0, 0x2000c045}, 0x24000004) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) ioctl$TIOCGSERIAL(r6, 0x541e, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/116}) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$ARCH_GET_MAX_TAG_BITS(0x1e, r7, 0x0, 0x1002) fcntl$setown(r6, 0x8, r7) ioctl$int_in(r6, 0x5452, &(0x7f0000000000)=0x4) 2m56.041595412s ago: executing program 2 (id=1045): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904000001a7a00f00090582020002", @ANYRESHEX=0x0], 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x1, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0xc) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x0, 0x0) 2m52.846027066s ago: executing program 2 (id=1065): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000000000008500000086000000850000000e000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendmsg$inet6(r2, &(0x7f0000000380)={&(0x7f0000000200)={0xa, 0x0, 0x20000, @private2}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000080)='3', 0x1}], 0x1}, 0x0) shutdown(r2, 0x1) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f00000002c0)={0xcf, 0x7, 0x5, 0x7, 0x5, 0x0, 0x7, 0x1, 0x9e, 0x2, 0x1, 0x0, 0x8}, 0xe) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000b40)={'syztnl0\x00', &(0x7f0000000ac0)={'ip6gre0\x00', 0x0, 0x2d, 0x1, 0x2, 0x337, 0x49, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, 0x20, 0x7801, 0x23}}) sendmsg$inet6(r2, &(0x7f0000000e40)={&(0x7f0000000040)={0xa, 0x4e22, 0x3f80000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5}, 0x1c, &(0x7f0000000a80)=[{&(0x7f0000000140)="5e5a83872d2172309ff62e98ab4eb43ccf5a6cbe326f56a35a81d0dfd5932b6d45b9b257cc2b5e4a26a7e420790105612fded8edca48bbc01cd870d1f5757d3aab206babf1927fb71a3a823d39c599e3ae9c17229f7cf074d70b6cf385416812db39fd537681d516e7d4085b49f777d987ad9a1d9b3d4c81b764334b9edb02c728fbbf8f", 0x84}, {&(0x7f0000000580)="4607dff996506285aefcc423537252ce1542f296abfc3d056cbbbc3c336061d95970898b7285cd5bccc24506f5a6a9ed5df0d9dac1518c4fbb2298ccd8add0266159017e160b582489e85052495f1abdf8ab52dbbac04b1ef061d0314f5a1276336078c33ff4210b185b7bb9c6cb6988cf69fd36876ad31686b24d312406f7f20b494e3751149a31fbdf34b2f63e007158ed9b762270c5d7e6fb4a25545708de63b463f62297752347e5c46d8b1a761eeb38269291e325ed05ecfa591ab121553154", 0xc2}, {&(0x7f0000000680)="e297befd7a72f6202dec6bfe3d8f6360dcba08c68017961ffb811362bf4a532beabb8e1fa31e7099fa7687cde10ed8e5fa0e0d255357a2f00411fe12d6afb7d1e6e973092c8c41a072ab98de00f866f5f103d69c9922e6d5057b2bd5ad437486803c623ef962afe397ce36c5fbbe8cfed0d9047a4d930a808cf3", 0x7a}, {&(0x7f0000000700)="7eb1b262411709da72757cf0a3751eb6fa39a98f4a9b2da6d292cb5397d99de4d932fd903056f937de63e9c3310923380cf62e98971c46a95a1454cfc651fbc60e25af6ae27403718ead2f75dbc3c5a6a8dcd7b17bdb71646b113afad957073223479e8066ce4b52f7e4872a667ef2d4ae8f40a21db97e1d9ec5a234cf0dc92fd60b85698f4cb58878098178901160c93348b7757f1c1c57fef924429f1c0bf46c270fae91f7d820ecd5c98f52246ee48f2929bf", 0xb4}, {&(0x7f00000007c0)="d856753dc558c0ad75c62f51e6ff6f3d042c456d39c0d11aeb4781ac4663231e2997373333f163b2188236a0bb8ae78539b0448552f5ef02e11a36f9c8e94f3e78f7b526646ce41d9a031ad5f648b38b27e7b1a5bdd875fb57e8c94f8e64093f059901eab6b2e97dfeb0918a0b14f897f2c926051e21ad1b8f7a842e3b969d12b67412c34a9c8b7aacc47e7bfbf463df8bb050bbfebd2442d4a1d0773bba9e979b3d665bff9c3d1cc725bfe82fd504c3c1b7b57054b7d202590ede07ea9e572f1c83473e99a199de6a98ee8461ae3514f9d66591", 0xd4}, {&(0x7f00000008c0)="76c7655d76598016ff03ba9c10786b9c5bae01845c51a67afb510af53724b3f80aa76a8e97d48677f22246412dd16db6d9d2dab2c19ee35d0e9845e18fb3e344f9d407571277d4055c385d47f68e8ef22677ccc1644405619d9020b8651f9ff0a0417ce3125bc350679cd0cf40066558af4c344620b55608f35de890b09ceb39c62b72e814e4046d06e3cad8b6b6bbeb4caa0fbab038016d35cc463a7395", 0x9e}, {&(0x7f0000000980)="7665a6838de2b191b9d89f2c8049f75b5e0301046a9ed497746558a9928061863838c34f55006eb1729630ddaf42b0d8c0855332b852c4780910ba56fe75bbf31700cf4e32ca03aa96538309072e54b6db8c0c6e3840978f0e7f6d0a70a3c5d2eb61c6871b7ef5df6f0e2b35585db76585ec14c858cd83888db0ea12ec3c3142038bd836d82c17df676244ef117bbb2b2eee090ffea2d1c9ea06cd6b9350608a87611a55de58617aad5ee8155fc1ad74cfdf8cc0a2c38a8ed441dfc086a0efbb59bf8336e36021b99c8a45fb053caae40d698b92a3529c715472995e932bd43c3f765d0636dd2be149", 0xe9}], 0x7, &(0x7f0000000b80)=[@rthdrdstopts={{0x34, 0x29, 0x37, {0x6, 0x3, '\x00', [@enc_lim={0x4, 0x1, 0xfb}, @pad1, @enc_lim={0x4, 0x1, 0x6}, @jumbo={0xc2, 0x4, 0x3}, @jumbo={0xc2, 0x4, 0xfc0}, @jumbo={0xc2, 0x4, 0x40}]}}}, @rthdrdstopts={{0x8c, 0x29, 0x37, {0x87, 0xe, '\x00', [@jumbo={0xc2, 0x4, 0xfffffff9}, @hao={0xc9, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @calipso={0x7, 0x50, {0x0, 0x12, 0x5, 0x6, [0x42, 0xd, 0x71, 0xffffffff, 0xe2, 0x4, 0xd4, 0x4, 0xff61]}}, @enc_lim={0x4, 0x1, 0x6}, @enc_lim={0x4, 0x1, 0x2}, @enc_lim]}}}, @pktinfo={{0x20, 0x29, 0x32, {@mcast2, r3}}}, @dstopts={{0x1c, 0x29, 0x37, {0x2f, 0x0, '\x00', [@generic={0x8, 0x4, "a616f237"}]}}}, @hopopts={{0x1a4, 0x29, 0x36, {0x84, 0x31, '\x00', [@padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @pad1, @calipso={0x7, 0x30, {0x0, 0xa, 0x4, 0xc, [0x8, 0x6, 0x5, 0x3, 0x0]}}, @pad1, @calipso={0x7, 0x38, {0x3, 0xc, 0x8, 0x1, [0x4, 0xcc3, 0x4b8, 0x58, 0x3, 0x6]}}, @padn={0x1, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0x1, [0x0]}, @enc_lim={0x4, 0x1, 0x6}, @generic={0x3, 0x19, "bc13bc1bcd13e9d9eb220fa8e7326425e6d96dc7b35cc9d538"}, @generic={0xd, 0xe9, "31d017c09c786ca35460115a871ca348706e30804a0a5f691d6ff93711a5d30f87872c1a25d9c7fa9959a1467b2f3445e5e16eba3cb60ad2001a2ceafe01faf9f4dc697c4848528963bc61eef6aeb4c541513e32823d945d65ff289514f401f43ec4d50880d3e56a29754058abff02eae52fc5860133bb2dd48c08314816554b0d98220f40c19ae6c2264c43a50ffe2da984baaf3aa5678f25080d268c7362282e963afd806ed6b73aa6acb0e163b4c1d03076546fd18f2bb65f0f6bc2ec8f4bd8f70c5b74e48541fec92531417d46ff7643989983527a7f780514d47d4e69029cc4628ab9e589c041"}]}}}, @tclass={{0x10, 0x29, 0x43, 0xfffffffe}}], 0x2b0}, 0x44000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 2m52.12193268s ago: executing program 2 (id=1068): syz_emit_ethernet(0x3e, &(0x7f0000000100)={@link_local={0x3, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x2, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0xd, 0x0, 0x0, 0x5, 0x7aa, {0x5, 0x4, 0x0, 0x4, 0x3, 0x66, 0x7f, 0x3, 0x0, 0x401, @rand_addr=0x64010101, @rand_addr=0x64010100}}}}}}, 0x0) add_key(0x0, 0x0, &(0x7f0000000080)="f1fe4a3b8809c5", 0x7, 0xfffffffffffffffe) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, 0x0}}], 0x1, 0x8000) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x40801, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fchdir(0xffffffffffffffff) r2 = creat(&(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xae) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/stat\x00', 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000002680)={0x0, 0x2, 0x0, 0x180000, 0x1}, &(0x7f00000026c0)=0x18) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000002700)={r5, @in={{0x2, 0x3, @local}}, 0x3, 0x7f, 0x0, 0x8001, 0xa3, 0x9, 0xc}, &(0x7f00000027c0)=0x9c) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) write$tun(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x42) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) sendmsg$FOU_CMD_GET(0xffffffffffffffff, 0x0, 0x20004040) getrandom(0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000380)=ANY=[@ANYBLOB="040e1a00031000"], 0xf) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="440f20c0350b000000440f22c0360f09c4217d700c9d0000000028b8010000000f01c166b82e000f00d80f20d835080000000f22d82e0f019885000000b9b1060000b86f8d0000ba0000000066b8b5008ec036363ef3420f51a600000000b9e30b0000b8f233278fba000000000f30", 0x6f}], 0x1, 0x13, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x8, 0x61, 0x200002000001, 0x1, 0x36, 0x0, 0x0, 0x36ae, 0x5, 0x6, 0x3, 0x400000000, 0x6, 0xf73c], 0x80a0000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x64159223755480d7, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xe}, {0x1, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x40448c0}, 0x0) read$FUSE(r3, &(0x7f0000000640)={0x2020}, 0x205f) ioctl$KVM_HYPERV_EVENTFD(0xffffffffffffffff, 0x4018aebd, &(0x7f0000002800)={0x2, 0xffffffffffffffff, 0x1}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) 2m51.576670035s ago: executing program 32 (id=1068): syz_emit_ethernet(0x3e, &(0x7f0000000100)={@link_local={0x3, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x2, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0xd, 0x0, 0x0, 0x5, 0x7aa, {0x5, 0x4, 0x0, 0x4, 0x3, 0x66, 0x7f, 0x3, 0x0, 0x401, @rand_addr=0x64010101, @rand_addr=0x64010100}}}}}}, 0x0) add_key(0x0, 0x0, &(0x7f0000000080)="f1fe4a3b8809c5", 0x7, 0xfffffffffffffffe) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, 0x0}}], 0x1, 0x8000) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x40801, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fchdir(0xffffffffffffffff) r2 = creat(&(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xae) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/stat\x00', 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000002680)={0x0, 0x2, 0x0, 0x180000, 0x1}, &(0x7f00000026c0)=0x18) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000002700)={r5, @in={{0x2, 0x3, @local}}, 0x3, 0x7f, 0x0, 0x8001, 0xa3, 0x9, 0xc}, &(0x7f00000027c0)=0x9c) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) write$tun(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x42) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) sendmsg$FOU_CMD_GET(0xffffffffffffffff, 0x0, 0x20004040) getrandom(0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000380)=ANY=[@ANYBLOB="040e1a00031000"], 0xf) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="440f20c0350b000000440f22c0360f09c4217d700c9d0000000028b8010000000f01c166b82e000f00d80f20d835080000000f22d82e0f019885000000b9b1060000b86f8d0000ba0000000066b8b5008ec036363ef3420f51a600000000b9e30b0000b8f233278fba000000000f30", 0x6f}], 0x1, 0x13, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x8, 0x61, 0x200002000001, 0x1, 0x36, 0x0, 0x0, 0x36ae, 0x5, 0x6, 0x3, 0x400000000, 0x6, 0xf73c], 0x80a0000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x64159223755480d7, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xe}, {0x1, 0xffff}, {0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x40448c0}, 0x0) read$FUSE(r3, &(0x7f0000000640)={0x2020}, 0x205f) ioctl$KVM_HYPERV_EVENTFD(0xffffffffffffffff, 0x4018aebd, &(0x7f0000002800)={0x2, 0xffffffffffffffff, 0x1}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) 9.6215496s ago: executing program 0 (id=1886): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x38, r0, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x9, 0x1c}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1464}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]]}, 0x38}, 0x1, 0x0, 0x0, 0x40049d0}, 0x20000000) 9.556961451s ago: executing program 0 (id=1888): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'dvmrp0\x00'}) syz_open_dev$I2C(&(0x7f00000000c0), 0x1, 0x482) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000200)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000500)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000100)={0x21}) r1 = syz_open_dev$vim2m(&(0x7f0000000340), 0x7ff, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000040)={0x28, 0x1, 0x2, "67423900fcffff0300", 0x3231564e}) io_uring_register$IORING_REGISTER_NAPI(0xffffffffffffffff, 0x1b, &(0x7f00000000c0)={0x5, 0x6}, 0x1) r2 = signalfd4(r0, &(0x7f0000000000)={[0x2]}, 0x8, 0x80800) read$FUSE(r2, &(0x7f0000001b40)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x205c) r4 = syz_open_dev$usbmon(&(0x7f00000000c0), 0x4, 0x900) read$usbmon(r4, 0x0, 0x0) timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x0, @tid=r3}, &(0x7f0000000480)=0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000140)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) ioctl$PPPIOCSPASS(r6, 0x40107447, 0x0) ioctl$BTRFS_IOC_QGROUP_LIMIT(r4, 0x8030942b, &(0x7f00000004c0)={0x7f, {0xc, 0x3, 0x0, 0x3, 0x6}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x1c}}, 0x0) timer_settime(r5, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x3a, 0x1, @tid=r3}, &(0x7f0000000100)=0x0) modify_ldt$read_default(0x2, 0xffffffffffffffff, 0x0) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r9, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x40c, 0xd8, 0x0, 0x148, 0xd8, 0x148, 0x378, 0x240, 0x240, 0x378, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0xb8, 0xd8, 0x0, {}, [@common=@unspec=@connlabel={{0x24}, {0x7, 0x2}}, @inet=@rpfilter={{0x24}, {0x1}}]}, @unspec=@TRACE={0x20}}, {{@ip={@empty, @multicast1, 0xff000000, 0xff000000, 'tunl0\x00', 'pimreg1\x00', {}, {0xff}, 0x84, 0x0, 0x60}, 0x0, 0x258, 0x2a0, 0x0, {}, [@common=@inet=@recent0={{0xf4}, {0xa, 0x9, 0x0, 0x1, 'syz0\x00'}}, @common=@inet=@recent0={{0xf4}, {0x4, 0x3, 0x1, 0x1, 'syz1\x00', 0x1}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0xbb04, 0x2b, 0x10, 'syz1\x00', {0x6182}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x468) timer_settime(r8, 0x1, &(0x7f0000000140)={{0x77359400}, {0x77359400}}, &(0x7f0000000180)) 9.379589541s ago: executing program 0 (id=1889): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_disconnect(r2) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000408205820540000102030109026e0003017f0006080b0002012030230904000000010130000a2401100a00090000000904010000010230000904010101010230000905010960"], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000800)={0x24, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4044004}, 0x11) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r3, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0) 6.327672665s ago: executing program 0 (id=1909): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$I2C(0x0, 0x2, 0x1) r0 = socket$inet6(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x510}]}, 0x34}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 5.727678157s ago: executing program 0 (id=1914): r0 = socket$nl_route(0x10, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)="fc00000018000703ab092500090007000a070000000000060000369321000700ff2500000005d00000000000000398996c92773411419da79bb94b46fe00006cf0abbb0000036c6c256f1a272f2e117c22ebc205214000000000008934d07302ad031720d7d5bbc91a3e2e80772c05defd5a32e280fc83ab00f605f70c9ddefefe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f556", 0x97) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x48d, 0x8595, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x0, 0x4, 0x0, {0x9, 0x21, 0x20, 0x4, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x7, 0x8, 0xc3}}}}}]}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xfd, 0x0, 0x7fff7ffc}]}) getgroups(0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x70, 0x10, 0xffffffffffffffff, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1120}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x38, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x1c, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x7fff, 0xce1}}, @IFLA_VLAN_QOS_MAPPING={0x18, 0x1, {0xe}}]}, @IFLA_VLAN_ID={0x6}, @IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x39, {0x504, 0x347}}]}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x70}, 0x1, 0x0, 0x0, 0x2000c855}, 0x8000002) 3.796466021s ago: executing program 4 (id=1922): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x38, r0, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8}, @val={0xc, 0x99, {0x9, 0x1c}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1464}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]]}, 0x38}, 0x1, 0x0, 0x0, 0x40049d0}, 0x20000000) 3.71760955s ago: executing program 4 (id=1924): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$I2C(0x0, 0x2, 0x1) r0 = socket$inet6(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x510}]}, 0x34}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 3.228626287s ago: executing program 3 (id=1929): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000280)={r0, 0xffffffffffffffff, 0x2, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x1b299bb4, 0x0, 0x1}}, 0x40) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r5 = socket$unix(0x1, 0x5, 0x0) sendto$unix(r5, &(0x7f00000000c0)="4eee3801a8b918391a39def374aa103202a87f2eba73931bba2475d32b12fc96d50abe76e16b90e2873c031347f245bc138f65632de3877550b9a1f56a8e7480b34e3e38c01ea69877882eadb99b14765cad5ad414dc852486b355b51afc4f56c519a69d120301dc3156938be136c12cd98113fa31bb921b76ffcd638170f796752ef48ce66556f128c3406ac36837b13e7577e0d7bba05e4f1f87ad76", 0x9d, 0x1, 0x0, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xcd, 0xcd, 0x8, [@datasec={0xc, 0x3, 0x0, 0xf, 0x1, [{0x1, 0x10000, 0x5}, {0x4, 0x4, 0x6}, {0x1, 0x8, 0x8}], "c9"}, @union={0x3, 0x2, 0x0, 0x5, 0x0, 0x8, [{0x3, 0x3, 0x2}, {0x8, 0x5, 0x4}]}, @volatile={0x2, 0x0, 0x0, 0x9, 0x4}, @enum={0x8, 0x1, 0x0, 0x6, 0x4, [{0x2, 0x4}]}, @int={0x4, 0x0, 0x0, 0x1, 0x0, 0x1a, 0x0, 0xf, 0x1}, @enum64={0x9, 0x5, 0x0, 0x13, 0x1, 0xf, [{0xc, 0x2, 0x8}, {0x6, 0x1, 0x5}, {0x5, 0x3, 0xfffffc01}, {0x6, 0x0, 0x5}, {0xa, 0x1, 0x800}]}]}, {0x0, [0x5f, 0x5f, 0x30, 0x30, 0x5f, 0x61]}}, &(0x7f0000000500)=""/53, 0xf0, 0x35, 0x1, 0x6, 0x10000}, 0x28) r7 = socket$inet_tcp(0x2, 0x1, 0x0) recvfrom$inet(r7, &(0x7f0000000380)=""/45, 0x2d, 0x40000000, &(0x7f00000003c0)={0x2, 0x4e22, @empty}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x4, 0x0, 0xce, 0x800, 0xffffffffffffffff, 0x3, '\x00', 0x0, r6, 0x0, 0x2, 0x4, 0x3}, 0x50) r8 = socket$inet(0x2, 0x3, 0x33) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getsockopt$inet_mreqsrc(r8, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_usb_connect(0x2, 0x5f, &(0x7f0000000040)=ANY=[@ANYBLOB="1201100193ac931040206582a3b50102030109024d0001027f400909040c07027b85530009058103030000000622023ed13729711a6e3f7ee9e3c2f767f89a2dee56136e3bbee236b084ecfe5b5c6c09059a"], 0x0) 3.122244761s ago: executing program 4 (id=1930): r0 = syz_open_dev$I2C(&(0x7f0000000d80), 0x0, 0xc0c00) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000580)={0x1, 0x0, 0x7, &(0x7f0000000540)={0x1c, "584fc4dfae9a34fb1ffbb539b436cc843759a57bf235d2f602000000000000ffff"}}) 3.021300638s ago: executing program 4 (id=1931): socket(0x10, 0x3, 0x0) mknodat(0xffffffffffffff9c, 0x0, 0x8000, 0x103) socket$kcm(0x11, 0x3, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) r1 = socket$inet6(0x10, 0x3, 0x0) memfd_create(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket(0x10, 0x803, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x0, 0x20000, {0xa, 0x40, 0x22, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_ADDRESS={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x40}}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x510}]}, 0x34}}, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 2.671082163s ago: executing program 0 (id=1932): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x9) accept4(r0, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_usb_connect(0x5, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000006c055080a115014cb62010203010902120001fe0000000904"], 0x0) syz_usb_control_io$sierra_net(r2, 0x0, 0x0) syz_usb_control_io$sierra_net(r2, 0x0, &(0x7f0000000900)={0x1c, &(0x7f0000000180)={0x0, 0x1f}, 0x0, 0x0}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r1) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r3, &(0x7f0000001040)={0xfc, {"a2e3ad09ed0d09f91b5e071887f70e09d038e7ff7fc6e5539b0d670a8b089b3f363563030890e0879b0af8c6e70a9b334a959b669a9b2f0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d073b5d0acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669114e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813491ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eb4581f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab9640071550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c513a9177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f411254c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486229e5b2e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df7227dfdb0d2b9e935c5af3cf474bed79dfc24ab0f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78c8fa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000026347ee800", 0x1038}}, 0x1006) r4 = socket$l2tp6(0xa, 0x2, 0x73) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) futex_waitv(&(0x7f0000002d40)=[{0x7, 0x0, 0x2}], 0x1, 0x0, &(0x7f0000003680), 0x1) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r5, 0x5414, &(0x7f0000000000)={0x1, 0x4, 0xb, 0xa}) connect$l2tp6(r4, &(0x7f0000000000)={0xa, 0x0, 0x7, @local, 0xfffffffc, 0x4}, 0x74) 2.562343301s ago: executing program 3 (id=1935): socket(0x10, 0x3, 0x0) syz_open_dev$vbi(0x0, 0x3, 0x2) mknodat(0xffffffffffffff9c, 0x0, 0x8000, 0x103) socket$kcm(0x11, 0x3, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) memfd_create(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket(0x10, 0x803, 0x0) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x0, 0x20000, {0xa, 0x40, 0x22, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_ADDRESS={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x40}}, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x510}]}, 0x34}}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 2.437338526s ago: executing program 4 (id=1936): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x38, r0, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x9, 0x1c}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1464}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]]}, 0x38}, 0x1, 0x0, 0x0, 0x40049d0}, 0x20000000) 2.305714963s ago: executing program 1 (id=1937): r0 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0xe00, 0x4) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x15004100}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xb8, r1, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_REG_RULES={0x98, 0x22, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x7f}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x2}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x28}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0xf}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x7fff}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x2}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xe}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x3}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x5}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x6}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x79}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x2}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x8001}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x2}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x9}]}]}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x2}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4800}, 0x4008000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x4c, 0x0, 0x10, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x1000}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}]}, 0x4c}, 0x1, 0x0, 0x0, 0x869b62d8d9f0dd26}, 0x0) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000340), r2) sendmsg$DEVLINK_CMD_SB_GET(r2, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xb0, r3, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x7b4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x7}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x1000}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x1}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40000}, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x1, 0x4) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000500), r2) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r2, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x54, r4, 0x520, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'team0\x00'}, @L2TP_ATTR_RECV_TIMEOUT={0xc}]}, 0x54}, 0x1, 0x0, 0x0, 0x200040c1}, 0x1) r5 = openat$ppp(0xffffff9c, &(0x7f0000000640), 0x800000, 0x0) ioctl$PPPIOCSFLAGS1(r5, 0x40047459, &(0x7f0000000680)=0x8184000) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, &(0x7f0000001840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001800)={&(0x7f0000000700)={0x1100, r1, 0x400, 0x6, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}, @NL80211_ATTR_FRAME_MATCH={0x5, 0x5b, "a1"}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x5}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x3ebb}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x81}, @NL80211_ATTR_FRAME_MATCH={0x1004, 0x5b, "8a374a1aa0e260bc330ba41057f132a2aa4de971f30f9c09cc84f23ef0c4cdaab47c23acad3340deeb092ca330c53b5c2cdc0d15d7b8ac83e017b1060baab6d97331a0fe7ab2d10319fd3a3649b4e74e91a86a0dbaccda7d59604e4ce61dee758bdf6f50b2ace41ef60ceadfaf66242e8a247550d3e2200ea2e47320195070022eb80ac8586e653108802e5e89f7e414baf9944d32198ae18557ab8d3fc8e78bf54519f85a8628f509d17f758c14fb9d513a572b69d011043239ae742cda2639982cfb1d650856c1d94f3916e530d074fea0b75ea930a56bafc5e80624ab3de2e95cd9e225cac209753a3e6f906222d0de7fc10d1b53619d4b4bac24881363d2b3cbcd6ac5b549fcbfa956e105872230d12237aa50663204fff49c1a2508e9278ebfa826f70d978ca7f144dd43c08a0606ef3ba1c66430a8c26c17c1a7f5b2d0a49fade5abc894421bf2ba8b989d6154e854187bc7ec72b91158b22738e062756c21b11510ee2b7488776e03823749f1caa52c5573b5232be6cd2036ef52ffbce1cf1c5b37ca2c0d48bb73725f38a2328a4c6f73a442e19ba39a8b38051a156273f80eee84b86cce18c18bba9d12f9e1d01425c5d904a9a7215608a245a2d23e6eb911185abf4118291d2064f51c48a803fd4338f149d37812d889a074600b06b45699e1b83c02f5b3ce56e694f28052fda13b41b12bfc0da692eeaa5c5493d5550b6dde66cde87398ca4369891088d4e39f8ce7a169029888df7af550edfc9fa7c0345cce9c384f035e2e25695054cb13fbfc1d23dc5e896da893866869f107b07e6b264f58e86c1344c8a4754062bd910e1fa404531f3ed984c82ad68665eb8b326eb95d28a8a6c4b66809196b820dc25693a525adf8f7f87bb65ec84fe1fd6eed52da88b3940e35137150fc2aaf2c99efe5f313e44e0c25f9c17f1d151116642a4bea267646fa99ddd1d4eced69a70add06c8ba5f35c62e670d71d88b8785c14065d771be239fb40c36b7086ad05d63e409e4fb7acee3fd9d3d3ab4661f76610ec59ba7567adbf9403713985974c50049a3cbfb431e884d5f5b95ae7c7d7597169a95c8d92005de25077abe58f1e40fac36d7af77d21bac463e7044b04a2000debdf1eff82bdce7c1f65f252062fa405f1fdd8d7308e715eb6552d0a7333d28eddd22e8e5e6d4c3ac1824e98b3ad086718c877ab0f534b7c06850b8d81315895e79e45a4e50dee73066ceb2f8b6360ec3ddbf20902da89a61d08d11029210cc6b7c8ab2bc399fe93d59fa1f5256e7eca98e183eb95c567a4dd41846aefa53cb46d491bca72769ffe0845a1d7e69f96b7ca613d6992f57524b0509b44e62d6c9bcf316b7e6d4be3e9d6a90a8217c512aee95d98d94e90a6dd442250a0827b22d803f41af2888169e710f9c725798a9c3d08169dd88f21d7685793c2eadbbe8be0e37288468113649d81af8a8a75e4e8abddb739a7180425be6c74d1c9197609d21c49097f08ffb38cdab338d8d594e1e4317af3bc2713db571626bc030271751d940d8199069bcb66bd1fa4550f930df632e8e4de4f38d66b15775787c608fdcf450f25462248efefb2af26140acf6b516461b4e5de6d8be6125b6bbae985ef74220ab5c58df3007c98639de66cea60bc9889f671146a7487cc3c2631159066658cfde702625709b43f14a59a86c8b62ebebd9e4dce601eec80a5ae0826af52cda36043b7e3ff40dba551f74365b252c5c6118c3b0decd39f4fb32df8a1fea3f7dc81d8d21a21f1dde253e4fb935c0a113745325fd34ad0f60f02cb2836dfcd40ebaa8e023838cfb485965299855c6c6c4d7f288b92e3f9d574af2832f2c1f8eef954c32bd11354e929ed0b7edeffb44a705c00b65d48d9876076099ac04ba5ce3dfbf06b69e6a7eec84fac435f62760f4a53b1b3718b61b12017f77c2c6914679f9f7676eead1b36e2c15cd6a61703b12cbff6a277dd1d43c6c6ea2ab61add5730835137939ce9ab5c14bd71da9d8be161fad1f6440f51c6d1c57e011a3f793e9eb71854ee50a5361a0ad4d9de1e077f3df4a8e665bdc300394aa226cbef5eadbcf462735bacd315496bd5397b878b8099957946926da56de48662207472890a9e714d5fd50c70a92ee1b8535720c93cd9506d6e9781d6cf2f76bed4a0d010776a431fb4c66348d94ba0eab1c7dd8797a219041107bd5d701510eb48c6e1f82b9db8fd85c776ddc08e7f3140081570d23c922e01cc77e0a91b7a8d9de9f1c7c84e8b4e8947c73fea81379b73256c78ade4dbc48f9d414f0f728b2a87f1db535981d29a32c6d618f350aa927d510504f21ed9368e8b045b77bbb49a765caff9100a362f0fa22b69e8070f9fcfbf97ff1ed2243f884b6ef3ffd20817cfe34fab2ffef393d8820f660ee6761a7da41825bc277395578db4cbbaad7192aae2dbdd4c7e634acb3f459d75af6f5eace63730c31f61da30e0e792f570b526cecf6b0bbd8b5f5af749a2ea3dc1826cdf0ae53f219484e251ba49943ce54522cdf3bd96463ab062dfb5913605e3c501459d66fecf24f890de14d55fc98ef9b901511a9b2b07e5d0f800489902c20c64510b19a7ce4d19f3fb62ab161d83bc77e33eac0d4d5415644833be55c30cf07620e9f4030f0d80eb21d418cd3efd5c6fd252f2ad645862de0cb85d05c4a5c524afe45e3790d8aa5e3d26c0bb8d9288ed953f49f40e46d1f51791effd7554c733696600fa797c0afc8c587bb2da5e00aa600b55663d0ac28fa97ef34dbc3f7e4b7732695ef573a0a70553f3c08616ede236d6c87fc54b9dfa73f4a8ebae7c0a4838c1f68d0a0c7505b2a84c89643c998a14c7c39e614670a97dddca82ff0a3e37015c4b4c6db85d45af069b69bbf33f83770e8413cdd8ace9d0b25f8fae47ba2f00ebfb3cc44ad3a6c88d88a17f5085ebdd24fc14bbb3877bec8af7faa93554233498ecab24c0713c6365a5a67d89343ce8d38414363f8a79c8f7e344450f3c0fcf03f7e8e6adb173fbca0a7d7549bbc516f0fa6b6d421d35b1952cf208efd80e37afda9a5f7d6c73d5ba05cd1ae5810deb81dc79d549c63025a404914a0cd3c8e5aab02c209064e3b19f828908ffe2551d6b3dc93904ca94345388563411f983dfdc74034b08df422ceacdf2b0476a064d5285b2d0d80de37deb7cf72130b95b434bebba9e9e822c7578502097631680a4d8bb1687402b84a7ee12249063dc5949acc6d2609575f8f4dcc1ba54f721fe1a51076b3b614c35d7ae7c9a50320dbd378f34304b417e0477857e1a2d1fda6501dcc947bb3795aee60e1b0e50deaf32d21455bf242d9dc86cc42ded7b5e5c12f29f949a26841b7876064fd377ffe60337ce02a5a8cb21dc34129c20299a3209f38caa4e23a70091399d0010513a5b01628dffb99065d2fb5a96e4e680f2a8d95f423b0592355e54842e43089f2759e2190539aab6ff3db1a2c0ca2214f674b70791b7fd7035f4bd276fe54585f966034f016e3cd6b9efec685d10c7438071cbd6c279e86bbde6dbfa79e09298857c19fa9b8a168b7b363b1a3ea70a89aa2e4e9a9d3fe9f1708399be5565d5855e967ff6a5c33482923cb7dd23a0fc82911e4c549f02f3ed33251f77f82a7df9d342992073a00ceeec085199db7f02b13e144493f00ef98be93be20910712c9637680326f859d344303d585722977f4aea68b40a95a2c70594d70b9637571cf7a9855d7f3dec024283d9ca7f01700bd6b7835d11cbe1d08e55a4f28e93923a67e3b932f5fec96e98f75dd91eb24e7f60e72628266e92bb7d17e1cf7642918e2be525dd623bfd6fc61371c1ca29d4c091c35442b59d196fda416906b986150f2150f643bb0f8aaeab31b9f08731ed5a9f41ce8d04496cdb8ef3ffa171855f29b71b9ea96bb16cc965c821cc9600470b78299367abd7156f6051bb6bef1ecfe1075d7313f95ab9608a6654453930ee7ec567b3b3db246f0c395d26710b6589d50e7c24ee18d8a25e0cbc75420a35faeac553e98feba63670e4fcdf763d06c290336a9967908faa9d980e05a16a5931188facb80cebe20ee1137fb4e536795727e31743a260c178035c7b9dcbe857e1ac0419a7afae86a917639eb9b168ebabd03dd464baec45fc3d11fc5a2c780cadcf5a4248bb1fbf3684962ea633e739b09f5e1019f83c8c2db6d91ae04e8394300cec7808187d06d613f3e18be7d80a0d4cb077d69c00c842c23afc2dad1955a63ea9636af9d0554dae55bbc2f39d87523e94ea43310b0402fd4151ef4a38667bd02c5ff4edfba6c6ff0eb42cb5fad918d632d21bac6cd571dc5eae135e2cb930e4d78c148ab5b14839a67f238bb51e8674683b7af2b5496145b619399ece2c2cdd6580480ba092b10e0be3987fcbfac89370317dd41b75ccc1fc1b37f9b4e4115c4a61b933f4c069ac1e1ba7b406c03eb667262caeb2af16917350379208d765d9c8f163a84173b56536819b05b412d5eb8f56b2c8235e9388037be0539cd7ee6d1e521908bafb4f78164dee533cf92943f6c2457fb379828ab4d3870d667eb8fb89b6d4149ddf43234ba0167675daa127a671d5775659092897cdabfaf95815e3f443d4e857f2a8d117effebc30bb901e22529650f899c3d6a5b384e1a5dc06c315bb02799fadbf70152311659cc9e497c5523d6729e9169d027075e6efcfa9aaa99714d14986454c1dc7b4ccd431c86235ddcfcf8a306ff36b607faabd926915c636b88f4c2224e039a5cabb141d55e3f90439b3bd0d6c16c63db02e70030640bd039919bb30d53d13a777170874c518b9cd75b28eae30f4126260d0f4f53f042e2ad9f7d321bb4fee99c132f792bc7455fddf8c70e3c1b211bbc3a53baefd9b4f68d69e7e69cf7874d2e22d5a5f7821d7b7b9a9885598d7861bff48bc7e01b8f0bedf3151c25aa60a79c8cd76bda69c12cd5934d615e2af9ee97bfede6786b5315e11840e0f707cb7517f14e6952843b868fec13e542fbadd620c76b8ee7aea506b1db6002f1e6a055be76c1b667b64d33fb34ef5bd64889af571a4f9ccc6d11fcd7aba6e000d0a8e9e684df0fd1c5a22703325999c4870483b64ce228a7061c590c7a024d7deb5af3e540d320fd10e001967c3834f2f664218fff3119ffd7243edf2355a840c7adae2e3ab0798e94912c8bff5ff2d0d33eb2705a3d049599ca4ce483b63d6d7e77335ee15ef8b69a73f992d9f414467616928289f6f246022049df9802f31e1dda5ba2b9fa004327ddcbd4cf2144b2bcb83accc97016bbbb28380fbae79f201a6f32dd00608eb3478df1d6d81d07853cdf6320bd1a4ec977f9d8665aaa89b8b292139ef2001a453161bf42644d2918773e897a50bfcc5023695d161b9bc7dcc3608bbc5496fe22271bc95dad12f82b9d34d8c595deac461f51ba754511e38d0b038a17bf78faae47d42f544d1037728a4c83a89519606d110adf7589b18327d605036e79589b29892b46be1b039f8be8469241ff9d948c2f6b90282f77142cf4499637e8ccd0637c2c471552c2e61111eeb50d9c37aa14382d037aa097c34792afb9ff3d9d598bb9f7a749dd26bc3ca4347e2d0aba858a12fedf82869c16624911723d34cbcb50859263e51a69d8b48b80b55d8ab92a644ff8165d6f832f9884f72fac3d51bc684757009337a5cbae6141953fed4fb47ff5293b91540a39bc84267c77503646160ed6d7d02e68e7a4dacd4f4ef1adf0f4f927ee282a4aea21a0c56dab50f6b74e6d9ee4f8aea0f5555525207f471c7619b23308bc73c938a28b"}, @NL80211_ATTR_FRAME_MATCH={0xbd, 0x5b, "15074c274ec2a7700e87f99a4a04a6f066025db547952d073f3dff6474f6ff6ce4a8979acc896ef47fd4ac26cada073f49ce90dd221f1ef5862c3d050902b6054ada6267c5178a4d5db5a4a0b08784993d757804f2bc32c2b6b9fbd539ecab0870b65f3135d3395c4b4c166506e166455fa71203214b2ba4a8979719be012ab8956a14945cbaba8e0dc76ba0726e4ecba374c372873ac3aa9f623aaff00d0347bef67c8316bc625302d637678ae942e75633933c834a751349"}]}, 0x1100}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r6 = openat$cgroup(0xffffffffffffffff, &(0x7f0000001880)='syz0\x00', 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f00000018c0)='cpuacct.stat\x00', 0x0, 0x0) r8 = syz_genetlink_get_family_id$team(&(0x7f0000001940), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000001980)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f0000001a40)={'syztnl0\x00', &(0x7f00000019c0)={'syztnl0\x00', 0x0, 0x2f, 0x19, 0x2, 0x7, 0x6, @mcast2, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x40, 0x7800, 0x800, 0xffff2376}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001a80)={'team0\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001dc0)={r7, 0xe0, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000001ac0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x5, &(0x7f0000001b00)=[0x0, 0x0], &(0x7f0000001b40)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x10, &(0x7f0000001b80)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x48, 0x10, &(0x7f0000001c00), &(0x7f0000001c40), 0x8, 0x31, 0x8, 0x8, &(0x7f0000001c80)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000001e80)={'ip6_vti0\x00', &(0x7f0000001e00)={'ip6_vti0\x00', 0x0, 0x0, 0x98, 0x3, 0x7a9fb45, 0x2, @private0, @loopback, 0x10, 0x80, 0x1, 0xfb}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000001f40)={'ip6tnl0\x00', &(0x7f0000001ec0)={'syztnl2\x00', 0x0, 0x2f, 0xfc, 0x7, 0x3, 0x30, @loopback, @ipv4={'\x00', '\xff\xff', @local}, 0x8000, 0x0, 0x4, 0x5}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001f80)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r7, 0x89f0, &(0x7f0000002040)={'syztnl2\x00', &(0x7f0000001fc0)={'ip6tnl0\x00', 0x0, 0x29, 0xf, 0xaa, 0xfffffffd, 0x10, @empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x20, 0x8, 0x0, 0x7}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000002140)={'ip_vti0\x00', &(0x7f0000002080)={'syztnl0\x00', 0x0, 0x10, 0x8000, 0x4, 0x61, {{0x24, 0x4, 0x2, 0x1, 0x90, 0x66, 0x0, 0x6, 0x2f, 0x0, @local, @empty, {[@timestamp={0x44, 0x14, 0x1f, 0x0, 0x4, [0x6, 0x9, 0x9, 0x1]}, @generic={0x7, 0xb, "cb8766a25c509677f6"}, @lsrr={0x83, 0x17, 0xed, [@rand_addr=0x4647, @local, @private=0xa010101, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ssrr={0x89, 0x7, 0x2f, [@dev={0xac, 0x14, 0x14, 0x1a}]}, @ssrr={0x89, 0xf, 0x7e, [@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x23}, @empty]}, @generic={0x94, 0x9, "3e71ee411ebe14"}, @timestamp_prespec={0x44, 0x24, 0x4f, 0x3, 0x7, [{@empty, 0x5}, {@multicast2, 0x6737}, {@multicast1, 0x6819fe5c}, {@remote, 0x10001}]}]}}}}}) getsockopt$inet6_mreq(r7, 0x29, 0x124d62a08657b3d4, &(0x7f0000002180)={@loopback, 0x0}, &(0x7f00000021c0)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r7, 0x89f8, &(0x7f00000022c0)={'erspan0\x00', &(0x7f0000002200)={'erspan0\x00', 0x0, 0x7840, 0x40, 0x5, 0x10000, {{0x1f, 0x4, 0x0, 0x25, 0x7c, 0x67, 0x0, 0x9, 0x4, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0xf, 0xe8, [@rand_addr=0x64010100, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp={0x44, 0x18, 0x44, 0x0, 0xb, [0x7, 0x3, 0x2, 0x2, 0xfff]}, @ssrr={0x89, 0xf, 0xb0, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @local]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x20, 0xb4, 0x0, 0xf, [0x5, 0x4, 0x9, 0x9, 0x2, 0x5, 0x8]}, @end, @timestamp_prespec={0x44, 0xc, 0x9b, 0x3, 0x7, [{@dev={0xac, 0x14, 0x14, 0x1a}, 0x3}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000002300)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000002840)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x9acbb6675ef1a24c}, 0xc, &(0x7f0000002800)={&(0x7f0000002340)={0x494, r8, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8, 0x1, r9}, {0x78, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r10}}}]}}, {{0x8, 0x1, r11}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x44}}}]}}, {{0x8}, {0xfc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r13}}, {0x8}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}]}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r14}}}]}}, {{0x8, 0x1, r15}, {0xc0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xa8}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffc}}, {0x8}}}]}}, {{0x8, 0x1, r17}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r18}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r19}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r20}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}]}}]}, 0x494}, 0x1, 0x0, 0x0, 0x810}, 0x80) 2.252444216s ago: executing program 4 (id=1938): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) sendmmsg$sock(r3, 0x0, 0x0, 0x0) syncfs(r1) r4 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r4, 0x107, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xfffffffe}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}]}]}], {0x14}}, 0xd4}, 0x1, 0x0, 0x0, 0x2000c045}, 0x24000004) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) ioctl$TIOCGSERIAL(r6, 0x541e, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/116}) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$ARCH_GET_MAX_TAG_BITS(0x1e, r7, 0x0, 0x1002) fcntl$setown(r6, 0x8, r7) ioctl$int_in(r6, 0x5452, &(0x7f0000000000)=0x4) 2.194774848s ago: executing program 1 (id=1939): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac00000000010505000000faff0000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff02000000000000009d0000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffac1e00010800074000000001180006801400040000000000000000000000000000000001"], 0xac}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="b80000001101050500000000000000000a0000003c0002802c00018014000300ef01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffffffffff0800074001000001240006801400040000000000000000000000000000000001"], 0xb8}}, 0x0) 2.037852763s ago: executing program 1 (id=1940): connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e24, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfb}}, 0x7ffe}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac95ab194f93f8e795a9b294a0fa62d", 0x11}], 0x1}}], 0x1, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x224, 0x52030}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0xffff}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}]}}}]}, 0x48}}, 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650caa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x12, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 1.916155511s ago: executing program 1 (id=1941): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$I2C(0x0, 0x2, 0x1) r0 = socket$inet6(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 1.866390293s ago: executing program 3 (id=1942): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="210327bd7012fcdbdf2504000000"], 0x14}}, 0x40020) 1.824256158s ago: executing program 3 (id=1943): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1}, 0x6e) r0 = userfaultfd(0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x140}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x47, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x2c8, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x7ffff000}], 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="10000000000c102fc460328e1460052085da4700000000000800000008000300", @ANYRES32, @ANYBLOB="0c009900fcffffff59000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x0) userfaultfd(0x1) 1.462194748s ago: executing program 5 (id=1944): openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000280)="650f380195d20066b9e006000066b8511673d166ba129442030f300ff7c7f30f090f350f30b880018ee8f30f060f01c366b80e0000000f23c00f21f8663502000e000f23f8", 0x45}], 0x1, 0x29, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000440)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)={0x2c, r3, 0x211, 0x0, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xb}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}]}, 0x2c}, 0x1, 0x100000000000000, 0x0, 0x4000059}, 0x0) (async) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)={0x2c, r3, 0x211, 0x0, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xb}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}]}, 0x2c}, 0x1, 0x100000000000000, 0x0, 0x4000059}, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) (async) r5 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x28, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff25, 0x0, 0x0, 0x0, 0xa}, 0xfffffffffffffd48) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x73, 0x2, 0x2, 0x4002804c4, 0x9, 0x8000000000000000, 0xc595, 0x0, 0x4, 0xefffffffffffffff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x2002d3}) ioctl$KVM_RUN(r7, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) r8 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'bond0\x00'}) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000040000000000000008e0000dd0000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000040000000000000008e0000dd0000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) socket$nl_route(0x10, 0x3, 0x0) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@ipv6_getaddrlabel={0x1c, 0x4a, 0x1, 0x70bd2a, 0x25dfdbfe, {0xa, 0x0, 0x78, 0x0, 0x0, 0x2}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040040) (async) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@ipv6_getaddrlabel={0x1c, 0x4a, 0x1, 0x70bd2a, 0x25dfdbfe, {0xa, 0x0, 0x78, 0x0, 0x0, 0x2}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040040) r10 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r10, 0x4090ae82, &(0x7f0000000000)={[0x33, 0x790, 0x80000000002, 0x180, 0x400000004, 0xffffffffffffffff, 0xf1, 0x3, 0xfffffffffffffd7e, 0x45, 0x0, 0x3b9, 0xfffffffffffffffe, 0x0, 0x0, 0x8], 0x8000000, 0x3c4210}) ioctl$KVM_RUN(r10, 0xae80, 0x0) 1.340506051s ago: executing program 1 (id=1945): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x8, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x18, 0x2, [@TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x7ffffffffffffff1}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) 1.280323913s ago: executing program 5 (id=1946): syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf67d54da3c41d8ef, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0x7}, {0xffff, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x20000800) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)={0x2e8, r1, 0x5, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x3f, 0xe, {{{}, {}, @device_b, @broadcast, @from_mac}, 0x0, @random=0x4, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @void, @void, @void, @void, @void, @void, @val={0x3c, 0x4, {0x1, 0x7, 0x3c, 0x2}}, @void, @void, @val={0x71, 0x7, {0x1, 0x1, 0x0, 0x1, 0x1, 0xf0, 0x8}}, @void}}, @NL80211_ATTR_FTM_RESPONDER={0x188, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0x75, 0x3, "05221407311cd48d0433c42d000fe6900e82d8c8654a40b485502bdb20bff6e7e6913c13d87f69c0780ef5e64a444dd16e618fe022895d007a0f0767bf97983156aa7c37833247866ce8bdc55c67f4fad2474200f816c1aa7db62ad756bedab8ac4a52e8cd3b205d909f32665a2e932990"}, @NL80211_FTM_RESP_ATTR_LCI={0x2a, 0x2, "8e0a001dc5f81da23bf0fb4bd6efbd848822de9293cf9af151b02b1abf2ddbb41c6e8e57a826"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_LCI={0xdc, 0x2, "829d54c9f23c702d889d3740b24500b61b9d38fd5c223076087aad2b9c18fff3fd11d3d1cc0955a9497032e9a4b90844f3f11d61e50c9df035b8fc4a9ca0df7697e0b342bbf43475db336bd85fd7933780c8f8061d2af6fe8ae8aaf438d1c5825d3cdd7a92983f7d9c97f5621dd8544a0439a40217fbce1f36710a0f070e9f9000b56bfa2f2936c6650e2042fad3a3547ca444a266bd061a4e7c9a44b65ab41222afdb47190fafcc55ce4aa6a48965c86dc0807182034b8518d81c2dd93b85a986343522e886a93a3df88bb1b60f27d54ee9b415c5d779a9"}]}, @NL80211_ATTR_IE={0xeb, 0x2a, [@rann={0x7e, 0x15, {{0x1, 0x2}, 0x7f, 0x5, @broadcast, 0xa96, 0x0, 0x7fff}}, @channel_switch={0x25, 0x3, {0x0, 0x24, 0x2}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @random_vendor={0xdd, 0xbe, "411b1ce364903255ad20e21090c9a7912a8f576196ef2028f7a64d5697b17cf2bedb659a34168b46c3852b09d1970295476d54dbc2bd29933075379bb32ced8c39764c92a54b8eeaca494b6194239c9b7e1c6a8b8fa1af5cb1ac7b9faa3b23caae1ac89b541fbdf858c267a1d3706e92e171f188c09a934bbc69d24023836d7cbd915fbe7f320965ec94a874f2984307da80f3334b74d6ae903eb3d1687c5b05fb9851293b2ec664b008aa688cd30d5ab8f1d1b216892e38f4cac1d64039"}, @erp={0x2a, 0x1, {0x1, 0x0, 0x1}}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x2e8}}, 0x0) 1.218504434s ago: executing program 1 (id=1947): socket(0x10, 0x3, 0x0) mknodat(0xffffffffffffff9c, 0x0, 0x8000, 0x103) socket$kcm(0x11, 0x3, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) r1 = socket$inet6(0x10, 0x3, 0x0) memfd_create(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket(0x10, 0x803, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x0, 0x20000, {0xa, 0x40, 0x22, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_ADDRESS={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x40}}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x510}]}, 0x34}}, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 946.227004ms ago: executing program 3 (id=1948): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x38, r0, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x9, 0x1c}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1464}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]]}, 0x38}, 0x1, 0x0, 0x0, 0x40049d0}, 0x20000000) 903.201906ms ago: executing program 3 (id=1949): syz_usb_connect(0x0, 0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010102973c3408fd0b1100e6fa0102030109022c000108e73007090486"], &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = gettid() prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) symlinkat(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') syz_mount_image$fuse(&(0x7f0000001040), &(0x7f0000003040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x28c000, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0xee00, @ANYBLOB=',group_id=', @ANYRESDEC, @ANYBLOB="fc95d5135d2778f3a0e00005e83772fed7a47d4ac320666ca89f2b8706473daa89fdde66f7eb5cf484328b0f557858726aaa1b"], 0x1, 0x0, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xa8282, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x13, r5, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000300)=ANY=[@ANYBLOB="4d1d85eec042953edbe46158bfb36dcc077e0c55b5a3c62c4cdb2be6d2d960b6a6875b", @ANYRES8=r1], 0x0) r6 = dup(r5) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x20, 0x20000000000001bf, &(0x7f0000000280)=ANY=[@ANYRESDEC, @ANYRESDEC], &(0x7f0000000180)='syzkaller\x00', 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0, 0x0, 0x0, r6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r7, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x0, 0xb20c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001200), 0x4}, 0x50) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd86) madvise(&(0x7f00009ef000/0x4000)=nil, 0x4000, 0x9) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080010000000e8fe55a1180015000600142603600e120500211dff000401a8001600", 0x34}], 0x1}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r6, 0x89f2, &(0x7f0000000640)={'syztnl0\x00', &(0x7f0000000500)={'syztnl2\x00', 0x0, 0x700, 0x0, 0x5, 0x6, {{0x3f, 0x4, 0x3, 0x3b, 0xfc, 0x66, 0x0, 0x4, 0x2f, 0x0, @multicast2, @broadcast, {[@timestamp={0x44, 0x18, 0x22, 0x0, 0x7, [0xa, 0xd, 0x2, 0x5, 0x1]}, @rr={0x7, 0xf, 0x37, [@loopback, @multicast2, @multicast2]}, @ra={0x94, 0x4}, @timestamp_addr={0x44, 0x14, 0xff, 0x1, 0x8, [{@rand_addr=0x64010101, 0x80}, {@empty, 0x9}]}, @noop, @timestamp_prespec={0x44, 0x3c, 0xe, 0x3, 0x3, [{@multicast1, 0x2}, {@multicast1, 0x8}, {@multicast1, 0x9}, {@rand_addr=0x64010101}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@local, 0x5}, {@empty}]}, @cipso={0x86, 0x1e, 0x0, [{0x7, 0x11, "0fb8b284af02ec07dc32395aff23e5"}, {0x0, 0x7, "f6caf6e4bd"}]}, @timestamp_addr={0x44, 0x4c, 0x8b, 0x1, 0xa, [{@private=0xa010101, 0x80000001}, {@local, 0x8416}, {@broadcast, 0x6}, {@empty, 0x756}, {@local}, {@remote, 0x9}, {@rand_addr=0x64010101, 0xa}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffffb3c}, {@multicast2, 0x8}]}]}}}}}) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000000)=@ll={0x11, 0xf7, r8, 0x1, 0x56, 0x6, @remote}, 0x80, 0x0}, 0x24000020) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8001c00180081064e81f782db44b9b545c7910006007c09e8fe55a10a0017", 0x1f}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081044e81f7d28344b904020000", 0x2}], 0x1}, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r9, &(0x7f0000000000)=ANY=[], 0x33fe0) 657.251082ms ago: executing program 5 (id=1950): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x140, 0x82) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000340)={0x3f, 0x3, 0x9}, 0x10) write(r2, &(0x7f00000000c0)="240000001e005f0214ffffffffffff0000000000080008001d00"/36, 0x24) setxattr$security_ima(0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r3, 0x0) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000001100), r0) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000001200)={&(0x7f0000001080), 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x50, r4, 0x4, 0x70bd26, 0x25dfdbff, {}, [@GTPA_MS_ADDR6={0x14, 0xc, @empty}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_PEER_ADDR6={0x14, 0xb, @loopback}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) lremovexattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=ANY=[]) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000000)={0x44, r1, 0x1, 0x70bd28, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_MSGMASK={0x18, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}]}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x44}}, 0x10004000) keyctl$update(0x2, 0x0, 0x0, 0xff88) r5 = socket$inet6(0xa, 0x805, 0x0) getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000000080)=""/4076, &(0x7f00000010c0)=0xfec) 458.475805ms ago: executing program 5 (id=1951): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001240)=ANY=[@ANYBLOB="64010000100011042bbd7000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="00000300000000003001128009000100766c616e00000000200102807c0004800c0001000d0000000b0000000c00010025a40000020000003c000100090000001c0400000c00010000000000030000000c00010003000000020000000c00010081ffffff050000000c00010003000000040000000c000100020800002e0700000c00010003000000030000000c000100090000005a090000040004801c0003800c000100ff030000070000000c00010003000000080000000600010003000000700004800c00010006000000f7ffffff0c00010005000000060000000c00010006000000000000000c00010006000000810000000c00010001000000000000000c000100bb030000e79d00000c00010003000000030000000c00010001000000090000000c0001000600000008665564060005008100000014000300766c616e30"], 0x164}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) 383.537649ms ago: executing program 5 (id=1952): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000300)=[@increfs], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)="82"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0x20, 0x0, &(0x7f0000000000)=[@request_death, @clear_death], 0xfc, 0x1000000, 0x0}) r3 = dup2(r0, r0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x20000) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f00000001c0)=0x2) r4 = syz_io_uring_setup(0x3fb1, &(0x7f0000000300)={0x0, 0x9cb2, 0x40, 0x5, 0xd6}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_PBUF_RING(r4, 0x22, &(0x7f0000000440)={&(0x7f0000001000)={[{0x0, 0x0, 0xffff}]}, 0x1}, 0x1) read$FUSE(r3, &(0x7f00000063c0)={0x2020}, 0x2020) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x9) 0s ago: executing program 5 (id=1953): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r0, &(0x7f0000001040)={0xfc, {"a2e3ad09ed0d09f91b5e071887f70e09d038e7ff7fc6e5539b0d670a8b089b3f363563030890e0879b0af8c6e70a9b334a959b669a9b2f0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d073b5d0acd3b78130daa61d8e804000f005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669114e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813491ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eb4581f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab9640071550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c513a9177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f411254c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486229e5b2e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df7227dfdb0d2b9e935c5af3cf474bed79dfc24ab0f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78c8fa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000026347ee800", 0x1038}}, 0x1006) kernel console output (not intermixed with test programs): tover after parsing attributes in process `syz.5.1398'. [ 377.349646][ T29] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 377.357899][ T29] em28xx 2-1:0.0: dvb set to bulk mode. [ 377.363623][ T5741] em28xx 2-1:0.0: Binding DVB extension [ 377.380607][ T29] usb 2-1: USB disconnect, device number 88 [ 377.388672][ T6938] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 377.390163][ T29] em28xx 2-1:0.0: Disconnecting em28xx [ 377.419520][ T6938] em28xx 6-1:0.0: dvb set to bulk mode. [ 377.443386][ T6938] usb 6-1: USB disconnect, device number 19 [ 377.460642][ T6938] em28xx 6-1:0.0: Disconnecting em28xx [ 377.474013][ T5741] em28xx 2-1:0.0: Registering input extension [ 377.487020][ T5760] em28xx 6-1:0.0: Binding DVB extension [ 377.522275][T10494] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 377.533531][T10494] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 377.554014][ T5760] em28xx 6-1:0.0: Registering input extension [ 377.563682][ T29] em28xx 2-1:0.0: Closing input extension [ 377.579091][ T6938] em28xx 6-1:0.0: Closing input extension [ 377.603209][ T29] em28xx 2-1:0.0: Freeing device [ 377.628253][ T6938] em28xx 6-1:0.0: Freeing device [ 378.097265][ T29] usb 2-1: new full-speed USB device number 89 using dummy_hcd [ 378.258546][ T29] usb 2-1: config 1 has an invalid interface number: 128 but max is 2 [ 378.269962][ T29] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 378.280896][ T29] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 378.290638][ T29] usb 2-1: config 1 has no interface number 0 [ 378.297937][ T29] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 378.307105][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 378.315220][ T29] usb 2-1: SerialNumber: syz [ 378.328618][ T29] usb 2-1: 128:2 : does not exist [ 378.416826][ T5741] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 378.567004][ T5741] usb 6-1: Using ep0 maxpacket: 8 [ 378.583560][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.594553][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.602100][ T5741] usb 6-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 378.629339][ T5741] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.637586][ T5741] usb 6-1: Product: syz [ 378.643018][ T5741] usb 6-1: Manufacturer: syz [ 378.649861][ T5741] usb 6-1: SerialNumber: syz [ 378.685445][T10516] trusted_key: encrypted_key: master key parameter '' is invalid [ 378.946883][ T6938] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 379.062960][ T5741] mxuport 6-1:254.0: mxuport_recv_ctrl_urb - short read (0 / 4) [ 379.071600][ T5741] mxuport 6-1:254.0: probe with driver mxuport failed with error -5 [ 379.116886][ T6938] usb 5-1: Using ep0 maxpacket: 32 [ 379.124133][ T6938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 379.135977][ T6938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 379.146188][ T6938] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 379.155420][ T6938] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.166439][ T6938] usb 5-1: config 0 descriptor?? [ 379.175864][ T6938] hub 5-1:0.0: USB hub found [ 379.305251][ T5760] usb 6-1: USB disconnect, device number 20 [ 379.381111][ T6938] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 379.456983][T10524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 379.467218][T10524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 379.479737][T10524] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1420'. [ 379.794553][ T6938] hid-generic 0003:046D:C31C.000F: unknown main item tag 0x0 [ 379.807354][ T6938] hid-generic 0003:046D:C31C.000F: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.4-1/input0 [ 380.041500][T10531] xt_socket: unknown flags 0x20 [ 380.156526][T10536] xt_connbytes: Forcing CT accounting to be enabled [ 380.208903][T10538] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.219277][T10538] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.690476][T10522] usb 5-1: reset high-speed USB device number 69 using dummy_hcd [ 380.782409][T10541] netlink: 'syz.5.1427': attribute type 1 has an invalid length. [ 380.857431][T10522] usb 5-1: device firmware changed [ 380.865564][ T6938] usb 5-1: USB disconnect, device number 69 [ 380.900938][ T9] usb 2-1: USB disconnect, device number 89 [ 381.026878][ T5760] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 381.041162][ T6938] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 381.196944][ T6938] usb 5-1: Using ep0 maxpacket: 32 [ 381.204487][ T6938] usb 5-1: no configurations [ 381.209810][ T5760] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 381.218551][ T6938] usb 5-1: can't read configurations, error -22 [ 381.224892][ T5760] usb 6-1: config 1 has no interface number 0 [ 381.239056][ T5760] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 381.265438][ T5760] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 381.276924][ T5760] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 381.292521][ T5760] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 381.303260][ T5760] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.312140][ T5760] usb 6-1: Product: syz [ 381.315378][T10550] binder: BINDER_SET_CONTEXT_MGR already set [ 381.316577][ T5760] usb 6-1: Manufacturer: syz [ 381.325606][T10550] binder: 10549:10550 ioctl 4018620d 80004a80 returned -16 [ 381.329612][ T5760] usb 6-1: SerialNumber: syz [ 381.343436][T10541] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 381.354360][T10550] syz.3.1431 (10550): drop_caches: 2 [ 381.364846][T10550] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 381.367335][ T6938] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 381.374962][T10550] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 381.536904][ T6938] usb 5-1: Using ep0 maxpacket: 32 [ 381.549481][ T6938] usb 5-1: no configurations [ 381.554452][ T6938] usb 5-1: can't read configurations, error -22 [ 381.563129][ T6938] usb usb5-port1: attempt power cycle [ 381.569835][T10541] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 381.806907][ T24] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 381.857971][ T6938] usb usb5-port1: Cannot enable. Maybe the USB cable is bad? [ 381.966859][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 381.979653][ T24] usb 2-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 381.987394][ T6938] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 381.992569][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.004794][ T24] usb 2-1: Product: syz [ 382.014826][ T24] usb 2-1: Manufacturer: syz [ 382.024133][ T24] usb 2-1: SerialNumber: syz [ 382.030335][ T6938] usb 5-1: Using ep0 maxpacket: 16 [ 382.030994][T10541] tipc: Started in network mode [ 382.043753][ T6938] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 382.052052][T10541] tipc: Node identity eae155389111, cluster identity 4711 [ 382.063225][T10541] tipc: Enabled bearer , priority 0 [ 382.073205][ T6938] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 382.074892][T10541] syzkaller0: entered promiscuous mode [ 382.089535][T10541] syzkaller0: entered allmulticast mode [ 382.094006][ T6938] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.106926][ T6938] usb 5-1: Product: syz [ 382.111398][ T6938] usb 5-1: Manufacturer: syz [ 382.122923][ T6938] usb 5-1: SerialNumber: syz [ 382.123533][T10540] tipc: Resetting bearer [ 382.138418][ T6938] usb 5-1: config 0 descriptor?? [ 382.159962][ T6938] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 382.174384][T10540] tipc: Disabling bearer [ 382.184814][ T6938] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 382.238420][ T5760] usb 6-1: Incompatible driver and firmware versions [ 382.252083][ T5760] usb 6-1: USB disconnect, device number 21 [ 382.465179][ T24] mxuport 2-1:254.0: mxuport_recv_ctrl_urb - short read (0 / 4) [ 382.473126][ T24] mxuport 2-1:254.0: probe with driver mxuport failed with error -5 [ 382.704970][ T24] usb 2-1: USB disconnect, device number 90 [ 382.764741][ T6938] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 382.877948][T10563] vlan2: entered promiscuous mode [ 382.883870][T10563] bridge0: entered promiscuous mode [ 383.183519][ T6938] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 383.199574][T10554] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1433'. [ 383.211421][ T6938] em28xx 5-1:0.0: board has no eeprom [ 383.287060][ T6938] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 383.308309][ T6938] em28xx 5-1:0.0: dvb set to bulk mode. [ 383.322532][ T5760] em28xx 5-1:0.0: Binding DVB extension [ 383.348093][ T6938] usb 5-1: USB disconnect, device number 73 [ 383.382159][ T6938] em28xx 5-1:0.0: Disconnecting em28xx [ 383.445050][ T5760] em28xx 5-1:0.0: Registering input extension [ 383.463785][ T6938] em28xx 5-1:0.0: Closing input extension [ 383.497466][ T6938] em28xx 5-1:0.0: Freeing device [ 383.542609][T10575] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1441'. [ 383.553295][T10575] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 383.646932][ T24] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 383.826759][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 383.841978][ T24] usb 2-1: config 1 interface 0 has no altsetting 0 [ 383.863653][ T24] usb 2-1: New USB device found, idVendor=044f, idProduct=b320, bcdDevice= 0.40 [ 383.874425][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.882807][ T24] usb 2-1: Product: syz [ 383.891453][ T24] usb 2-1: Manufacturer: syz [ 383.896206][ T24] usb 2-1: SerialNumber: syz [ 383.961572][T10593] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1447'. [ 384.069398][T10595] netlink: 'syz.3.1444': attribute type 4 has an invalid length. [ 384.132420][T10595] netlink: 'syz.3.1444': attribute type 4 has an invalid length. [ 384.291544][T10599] FAULT_INJECTION: forcing a failure. [ 384.291544][T10599] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 384.343792][T10599] CPU: 1 UID: 0 PID: 10599 Comm: syz.4.1448 Tainted: G L syzkaller #0 PREEMPT(full) [ 384.343826][T10599] Tainted: [L]=SOFTLOCKUP [ 384.343835][T10599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 384.343848][T10599] Call Trace: [ 384.343861][T10599] [ 384.343870][T10599] dump_stack_lvl+0xe8/0x150 [ 384.343900][T10599] should_fail_ex+0x412/0x560 [ 384.343937][T10599] _copy_from_user+0x2d/0xb0 [ 384.343965][T10599] input_event_from_user+0x100/0x290 [ 384.343991][T10599] ? __pfx_input_event_from_user+0x10/0x10 [ 384.344028][T10599] evdev_write+0x2c7/0x4c0 [ 384.344050][T10599] ? __lock_acquire+0x6b5/0x2cf0 [ 384.344078][T10599] ? __pfx_evdev_write+0x10/0x10 [ 384.344102][T10599] ? bpf_lsm_file_permission+0x9/0x20 [ 384.344131][T10599] ? security_file_permission+0x75/0x260 [ 384.344159][T10599] ? rw_verify_area+0x255/0x4d0 [ 384.344188][T10599] ? __pfx_evdev_write+0x10/0x10 [ 384.344212][T10599] vfs_write+0x29a/0xb90 [ 384.344251][T10599] ? __pfx_vfs_write+0x10/0x10 [ 384.344282][T10599] ? __fget_files+0x2a/0x420 [ 384.344311][T10599] ? __fget_files+0x2a/0x420 [ 384.344336][T10599] ? __fget_files+0x3a0/0x420 [ 384.344359][T10599] ? __fget_files+0x2a/0x420 [ 384.344394][T10599] ksys_write+0x150/0x270 [ 384.344426][T10599] ? __pfx_ksys_write+0x10/0x10 [ 384.344461][T10599] __do_fast_syscall_32+0x23e/0x6f0 [ 384.344484][T10599] ? do_fast_syscall_32+0x33/0x70 [ 384.344505][T10599] ? lockdep_hardirqs_on+0x7a/0x110 [ 384.344526][T10599] ? asm_int80_emulation+0x1a/0x20 [ 384.344546][T10599] ? do_int80_emulation+0x29f/0x550 [ 384.344573][T10599] do_fast_syscall_32+0x33/0x70 [ 384.344597][T10599] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 384.344623][T10599] RIP: 0023:0xf70af01c [ 384.344750][T10599] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 384.344764][T10599] RSP: 002b:00000000f549d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 384.344780][T10599] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 384.344790][T10599] RDX: 0000000000002250 RSI: 0000000000000000 RDI: 0000000000000000 [ 384.344800][T10599] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 384.344808][T10599] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 384.344827][T10599] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 384.344895][T10599] [ 384.946802][ T5727] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 385.063493][T10609] syzkaller0: entered promiscuous mode [ 385.084525][T10609] syzkaller0: entered allmulticast mode [ 385.117246][ T24] usbhid 2-1:1.0: can't add hid device: -71 [ 385.123677][ T24] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 385.132481][T10609] syzkaller0: create flow: hash 2435843200 index 1 [ 385.139940][ T5727] usb 6-1: Using ep0 maxpacket: 8 [ 385.155912][ T5727] usb 6-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 385.167505][ T24] usb 2-1: USB disconnect, device number 91 [ 385.178633][ T5727] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.201854][ T5727] usb 6-1: Product: syz [ 385.209084][ T5727] usb 6-1: Manufacturer: syz [ 385.222204][ T5727] usb 6-1: SerialNumber: syz [ 385.465977][T10608] syzkaller0: delete flow: hash 2435843200 index 1 [ 385.648205][ T5727] mxuport 6-1:254.0: mxuport_recv_ctrl_urb - short read (0 / 4) [ 385.667375][ T5727] mxuport 6-1:254.0: probe with driver mxuport failed with error -5 [ 385.889313][ T5727] usb 6-1: USB disconnect, device number 22 [ 386.027222][T10620] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 386.033802][T10620] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 386.042476][T10620] vhci_hcd vhci_hcd.0: Device attached [ 386.107519][T10623] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1455'. [ 386.290978][ T24] usb 39-1: new low-speed USB device number 3 using vhci_hcd [ 386.829487][T10621] vhci_hcd: connection reset by peer [ 386.845497][ T68] vhci_hcd vhci_hcd.3: stop threads [ 386.870654][ T68] vhci_hcd vhci_hcd.3: release socket [ 386.880541][ T68] vhci_hcd vhci_hcd.3: disconnect device [ 388.676799][ T5727] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 388.833250][ T5727] usb 6-1: Using ep0 maxpacket: 32 [ 388.851640][ T5727] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 388.898963][ T5727] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 388.943267][ T5727] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 388.980528][ T5727] usb 6-1: config 1 has no interface number 0 [ 389.001311][ T5727] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 389.014709][ T5727] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 389.028085][ T5727] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 389.038271][ T5727] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.078508][ T5727] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 389.154693][T10620] 8021q: adding VLAN 0 to HW filter on device bond1 [ 389.199824][ T5760] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 389.252305][T10620] 8021q: adding VLAN 0 to HW filter on device bond2 [ 389.269120][ T5727] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now attached [ 389.302102][T10620] 8021q: adding VLAN 0 to HW filter on device bond3 [ 389.328223][T10620] 8021q: adding VLAN 0 to HW filter on device bond4 [ 389.359900][T10620] 8021q: adding VLAN 0 to HW filter on device bond5 [ 389.402540][ T5760] usb 2-1: Using ep0 maxpacket: 16 [ 389.411098][ T5760] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 389.426533][T10645] openvswitch: netlink: nsh attr 0 has unexpected len 1 expected 0 [ 389.447493][ T5760] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 389.461938][ T5760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.473689][ T5760] usb 2-1: Product: syz [ 389.480873][ T5760] usb 2-1: Manufacturer: syz [ 389.485549][ T5760] usb 2-1: SerialNumber: syz [ 389.504092][ T5760] usb 2-1: config 0 descriptor?? [ 389.508125][T10322] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 389.528596][ T5760] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 389.556950][ T5760] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 389.841140][T10652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 389.857981][T10652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 389.883849][T10653] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1459'. [ 389.896356][T10636] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 389.897386][ T9] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 389.928011][ T6938] usb 6-1: USB disconnect, device number 23 [ 389.944654][ T6938] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 390.066822][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 390.080091][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 390.109434][ T9] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 390.128464][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.141021][ T5760] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 390.147782][ T9] usb 5-1: Product: syz [ 390.156428][ T9] usb 5-1: Manufacturer: syz [ 390.165273][ T9] usb 5-1: SerialNumber: syz [ 390.177718][ T9] usb 5-1: config 0 descriptor?? [ 390.193296][ T9] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 390.211999][ T9] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 390.561233][ T5760] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 390.569585][ T5760] em28xx 2-1:0.0: board has no eeprom [ 390.738923][ T29] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 390.791436][ T9] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 390.856836][ T5760] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 390.864985][ T5760] em28xx 2-1:0.0: dvb set to bulk mode. [ 390.872290][ T6938] em28xx 2-1:0.0: Binding DVB extension [ 390.906928][ T29] usb 6-1: Using ep0 maxpacket: 16 [ 390.914177][ T29] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 390.927412][ T29] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 390.936985][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.945051][ T29] usb 6-1: Product: syz [ 390.949696][ T29] usb 6-1: Manufacturer: syz [ 390.954391][ T29] usb 6-1: SerialNumber: syz [ 390.962187][ T29] usb 6-1: config 0 descriptor?? [ 390.971685][ T29] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 390.982235][ T29] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 391.206092][ T9] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 391.217671][T10650] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1465'. [ 391.228703][ T9] em28xx 5-1:0.0: board has no eeprom [ 391.296876][ T9] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 391.305129][ T9] em28xx 5-1:0.0: dvb set to bulk mode. [ 391.318345][ T9] usb 5-1: USB disconnect, device number 74 [ 391.326943][ T9] em28xx 5-1:0.0: Disconnecting em28xx [ 391.446980][ T24] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 391.577064][ T29] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 391.596410][ T6938] em28xx 2-1:0.0: Registering input extension [ 391.603102][ T5711] usb 2-1: USB disconnect, device number 92 [ 391.609882][ T5760] em28xx 5-1:0.0: Binding DVB extension [ 391.619871][ T5711] em28xx 2-1:0.0: Disconnecting em28xx [ 391.671396][ T5760] em28xx 5-1:0.0: Registering input extension [ 391.679735][ T5711] em28xx 2-1:0.0: Closing input extension [ 391.685751][ T9] em28xx 5-1:0.0: Closing input extension [ 391.714037][ T5711] em28xx 2-1:0.0: Freeing device [ 391.720999][ T9] em28xx 5-1:0.0: Freeing device [ 391.878540][T10660] binder: BINDER_SET_CONTEXT_MGR already set [ 391.884677][T10660] binder: 10658:10660 ioctl 4018620d 80004a80 returned -16 [ 391.900024][T10660] syz.4.1467 (10660): drop_caches: 2 [ 392.052337][ T29] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 392.061020][ T29] em28xx 6-1:0.0: board has no eeprom [ 392.146806][ T808] usb 5-1: new full-speed USB device number 75 using dummy_hcd [ 392.318397][ T808] usb 5-1: config 2 has an invalid interface number: 12 but max is 0 [ 392.328724][ T808] usb 5-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 392.339447][ T808] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 392.349949][ T808] usb 5-1: config 2 has no interface number 0 [ 392.356193][ T808] usb 5-1: config 2 interface 12 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 392.368680][ T808] usb 5-1: config 2 interface 12 altsetting 7 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 392.380660][ T808] usb 5-1: config 2 interface 12 altsetting 7 endpoint 0x8A has invalid wMaxPacketSize 0 [ 392.391100][ T808] usb 5-1: config 2 interface 12 has no altsetting 0 [ 392.400374][ T808] usb 5-1: New USB device found, idVendor=2040, idProduct=8265, bcdDevice=b5.a3 [ 392.411741][ T808] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.426797][ T5727] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 392.436031][ T808] usb 5-1: Product: syz [ 392.446810][ T808] usb 5-1: Manufacturer: syz [ 392.455205][ T808] usb 5-1: SerialNumber: syz [ 392.586781][ T5727] usb 2-1: Using ep0 maxpacket: 16 [ 392.599967][ T5727] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 392.621462][ T5727] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 392.637506][ T5727] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.647633][ T5727] usb 2-1: Product: syz [ 392.652758][ T5727] usb 2-1: Manufacturer: syz [ 392.658997][ T5727] usb 2-1: SerialNumber: syz [ 392.691895][ T5727] usb 2-1: config 0 descriptor?? [ 392.700460][ T808] em28xx 5-1:2.12: New device syz syz @ 12 Mbps (2040:8265, interface 12, class 12) [ 392.724178][ T5727] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 392.733840][ T808] em28xx 5-1:2.12: Device initialization failed. [ 392.742771][ T808] em28xx 5-1:2.12: Device must be connected to a high-speed USB 2.0 port. [ 392.752122][ T5727] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 392.801457][ T808] usb 5-1: USB disconnect, device number 75 [ 393.196875][ T29] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 393.211532][ T29] em28xx 6-1:0.0: dvb set to bulk mode. [ 393.227846][ T808] em28xx 6-1:0.0: Binding DVB extension [ 393.328316][ T5727] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 393.467183][ T808] em28xx 6-1:0.0: Registering input extension [ 393.792532][ T5727] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 393.823904][ T5727] em28xx 2-1:0.0: board has no eeprom [ 393.857003][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 394.127103][ T5727] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 394.135133][ T5727] em28xx 2-1:0.0: dvb set to bulk mode. [ 394.159046][ T24] em28xx 2-1:0.0: Binding DVB extension [ 394.169215][ T5727] usb 2-1: USB disconnect, device number 93 [ 394.197194][ T5727] em28xx 2-1:0.0: Disconnecting em28xx [ 394.358196][ T24] em28xx 2-1:0.0: Registering input extension [ 394.396260][ T5727] em28xx 2-1:0.0: Closing input extension [ 394.473374][ T5727] em28xx 2-1:0.0: Freeing device [ 394.614958][T10690] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 394.656543][T10690] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 394.693984][T10690] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1477'. [ 394.724326][T10692] FAULT_INJECTION: forcing a failure. [ 394.724326][T10692] name failslab, interval 1, probability 0, space 0, times 0 [ 394.773438][T10692] CPU: 0 UID: 0 PID: 10692 Comm: syz.5.1478 Tainted: G L syzkaller #0 PREEMPT(full) [ 394.773473][T10692] Tainted: [L]=SOFTLOCKUP [ 394.773481][T10692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 394.773492][T10692] Call Trace: [ 394.773501][T10692] [ 394.773510][T10692] dump_stack_lvl+0xe8/0x150 [ 394.773538][T10692] should_fail_ex+0x412/0x560 [ 394.773564][T10692] should_failslab+0xa8/0x100 [ 394.773587][T10692] __kmalloc_cache_noprof+0x88/0x660 [ 394.773615][T10692] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 394.773638][T10692] ? sctp_add_bind_addr+0x8c/0x370 [ 394.773664][T10692] sctp_add_bind_addr+0x8c/0x370 [ 394.773689][T10692] sctp_copy_local_addr_list+0x314/0x4f0 [ 394.773713][T10692] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 394.773735][T10692] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 394.773762][T10692] ? sctp_v4_is_any+0x35/0x60 [ 394.773783][T10692] ? sctp_copy_one_addr+0x93/0x360 [ 394.773808][T10692] sctp_bind_addr_copy+0xb3/0x3c0 [ 394.773831][T10692] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 394.773865][T10692] sctp_connect_new_asoc+0x2ff/0x6b0 [ 394.773894][T10692] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 394.773928][T10692] ? __local_bh_enable_ip+0xd0/0x130 [ 394.773947][T10692] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 394.773975][T10692] ? security_sctp_bind_connect+0x7e/0x2c0 [ 394.774004][T10692] sctp_sendmsg+0x1576/0x2c50 [ 394.774054][T10692] ? __pfx_sctp_sendmsg+0x10/0x10 [ 394.774084][T10692] ? aa_sk_perm+0x6d5/0x900 [ 394.774113][T10692] ? __might_fault+0xaf/0x130 [ 394.774144][T10692] ? __pfx_aa_sk_perm+0x10/0x10 [ 394.774175][T10692] ? sock_rps_record_flow+0x19/0x350 [ 394.774202][T10692] ? inet_sendmsg+0x2f4/0x370 [ 394.774230][T10692] ____sys_sendmsg+0x80a/0x9f0 [ 394.774261][T10692] ? __pfx_____sys_sendmsg+0x10/0x10 [ 394.774299][T10692] ___sys_sendmsg+0x2a5/0x360 [ 394.774319][T10692] ? __lock_acquire+0x6b5/0x2cf0 [ 394.774346][T10692] ? __pfx____sys_sendmsg+0x10/0x10 [ 394.774371][T10692] ? kstrtoull+0x12f/0x1d0 [ 394.774430][T10692] ? __fget_files+0x2a/0x420 [ 394.774455][T10692] ? __fget_files+0x3a0/0x420 [ 394.774509][T10692] __sys_sendmmsg+0x2e7/0x4e0 [ 394.774536][T10692] ? __pfx___sys_sendmmsg+0x10/0x10 [ 394.774588][T10692] ? fput+0xa0/0xd0 [ 394.774613][T10692] ? ksys_write+0x242/0x270 [ 394.774650][T10692] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 394.774677][T10692] __do_fast_syscall_32+0x23e/0x6f0 [ 394.774702][T10692] ? do_fast_syscall_32+0x33/0x70 [ 394.774723][T10692] ? lockdep_hardirqs_on+0x7a/0x110 [ 394.774743][T10692] ? asm_int80_emulation+0x1a/0x20 [ 394.774764][T10692] ? do_int80_emulation+0x29f/0x550 [ 394.774785][T10692] ? trace_irq_disable+0x3b/0x140 [ 394.774819][T10692] do_fast_syscall_32+0x33/0x70 [ 394.774842][T10692] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 394.774867][T10692] RIP: 0023:0xf70af01c [ 394.774885][T10692] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 394.774903][T10692] RSP: 002b:00000000f549d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 394.774925][T10692] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000880 [ 394.774939][T10692] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 394.774952][T10692] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 394.774964][T10692] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 394.774976][T10692] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 394.775008][T10692] [ 395.292367][T10696] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1480'. [ 395.303166][T10699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 395.312810][T10699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 395.435173][T10701] binder: BINDER_SET_CONTEXT_MGR already set [ 395.494240][T10701] binder: 10700:10701 ioctl 4018620d 80004a80 returned -16 [ 395.513412][T10704] syz.1.1482 (10704): drop_caches: 2 [ 395.526797][ T29] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 395.676810][ T29] usb 5-1: Using ep0 maxpacket: 16 [ 395.683722][ T29] usb 5-1: config 1 interface 0 has no altsetting 0 [ 395.698087][ T29] usb 5-1: New USB device found, idVendor=044f, idProduct=b320, bcdDevice= 0.40 [ 395.717044][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.728611][ T29] usb 5-1: Product: syz [ 395.732902][ T29] usb 5-1: Manufacturer: syz [ 395.738303][ T29] usb 5-1: SerialNumber: syz [ 395.756774][ T808] usb 2-1: new full-speed USB device number 94 using dummy_hcd [ 395.875877][T10715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 395.893070][T10715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 395.912222][ T808] usb 2-1: config 2 has an invalid interface number: 12 but max is 0 [ 395.925547][ T808] usb 2-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 395.954853][ T808] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 395.968532][ T808] usb 2-1: config 2 has no interface number 0 [ 395.974806][ T808] usb 2-1: config 2 interface 12 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 395.986882][ T808] usb 2-1: config 2 interface 12 altsetting 7 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 396.003529][ T808] usb 2-1: config 2 interface 12 altsetting 7 endpoint 0x8A has invalid wMaxPacketSize 0 [ 396.024335][ T808] usb 2-1: config 2 interface 12 has no altsetting 0 [ 396.050509][ T808] usb 2-1: New USB device found, idVendor=2040, idProduct=8265, bcdDevice=b5.a3 [ 396.064571][ T808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 396.082513][ T808] usb 2-1: Product: syz [ 396.091362][ T808] usb 2-1: Manufacturer: syz [ 396.101741][ T808] usb 2-1: SerialNumber: syz [ 396.339449][ T808] em28xx 2-1:2.12: New device syz syz @ 12 Mbps (2040:8265, interface 12, class 12) [ 396.366520][ T808] em28xx 2-1:2.12: Device initialization failed. [ 396.383341][ T808] em28xx 2-1:2.12: Device must be connected to a high-speed USB 2.0 port. [ 396.422171][ T808] usb 2-1: USB disconnect, device number 94 [ 396.658375][ T29] usbhid 5-1:1.0: can't add hid device: -71 [ 396.668629][ T29] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 396.684402][ T29] usb 5-1: USB disconnect, device number 76 [ 396.742818][T10720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 396.756668][T10720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 396.847498][T10723] netlink: 'syz.5.1489': attribute type 3 has an invalid length. [ 396.977528][T10728] FAULT_INJECTION: forcing a failure. [ 396.977528][T10728] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 396.977567][T10728] CPU: 0 UID: 0 PID: 10728 Comm: syz.0.1491 Tainted: G L syzkaller #0 PREEMPT(full) [ 396.977593][T10728] Tainted: [L]=SOFTLOCKUP [ 396.977601][T10728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 396.977613][T10728] Call Trace: [ 396.977622][T10728] [ 396.977631][T10728] dump_stack_lvl+0xe8/0x150 [ 396.977658][T10728] should_fail_ex+0x412/0x560 [ 396.977686][T10728] _copy_from_user+0x2d/0xb0 [ 396.977712][T10728] generic_map_update_batch+0x69a/0x990 [ 396.977747][T10728] ? __pfx_generic_map_update_batch+0x10/0x10 [ 396.977773][T10728] ? __fget_files+0x2a/0x420 [ 396.977804][T10728] ? __pfx_generic_map_update_batch+0x10/0x10 [ 396.977829][T10728] bpf_map_do_batch+0x39b/0x630 [ 396.977880][T10728] __sys_bpf+0x7c1/0x950 [ 396.977913][T10728] ? __pfx___sys_bpf+0x10/0x10 [ 396.977959][T10728] ? fput+0xa0/0xd0 [ 396.977984][T10728] ? ksys_write+0x242/0x270 [ 396.978032][T10728] __ia32_sys_bpf+0x7c/0x90 [ 396.978061][T10728] __do_fast_syscall_32+0x23e/0x6f0 [ 396.978084][T10728] ? do_fast_syscall_32+0x33/0x70 [ 396.978104][T10728] ? lockdep_hardirqs_on+0x7a/0x110 [ 396.978124][T10728] ? asm_int80_emulation+0x1a/0x20 [ 396.978143][T10728] ? do_int80_emulation+0x29f/0x550 [ 396.978164][T10728] ? trace_irq_disable+0x3b/0x140 [ 396.978195][T10728] do_fast_syscall_32+0x33/0x70 [ 396.978218][T10728] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 396.978242][T10728] RIP: 0023:0xf7f7301c [ 396.978259][T10728] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 396.978279][T10728] RSP: 002b:00000000f543650c EFLAGS: 00000206 ORIG_RAX: 0000000000000165 [ 396.978300][T10728] RAX: ffffffffffffffda RBX: 000000000000001a RCX: 0000000080000140 [ 396.978314][T10728] RDX: 0000000000000038 RSI: 0000000000000000 RDI: 0000000000000000 [ 396.978325][T10728] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 396.978336][T10728] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 396.978348][T10728] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 396.978378][T10728] [ 396.987995][T10730] tmpfs: Unknown parameter 'óÐåÝõZåÐmHœSuLVÏŒGÿéUË9ËQ1' [ 397.240080][T10734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 397.337547][T10734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 397.827268][ T5711] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 398.007482][ T5711] usb 5-1: Using ep0 maxpacket: 16 [ 398.030197][ T5711] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 398.061036][ T5711] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 398.070589][ T5711] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.089945][ T5711] usb 5-1: Product: syz [ 398.102106][ T5711] usb 5-1: Manufacturer: syz [ 398.113514][ T5711] usb 5-1: SerialNumber: syz [ 398.132896][ T5711] usb 5-1: config 0 descriptor?? [ 398.152009][ T5711] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 398.165223][ T5711] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 398.371981][T10752] binder: BINDER_SET_CONTEXT_MGR already set [ 398.379434][T10752] binder: 10751:10752 ioctl 4018620d 80004a80 returned -16 [ 398.406179][T10752] syz.1.1500 (10752): drop_caches: 2 [ 398.668426][ T9] usb 2-1: new full-speed USB device number 95 using dummy_hcd [ 398.756344][ T5711] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 398.849505][ T9] usb 2-1: config 2 has an invalid interface number: 12 but max is 0 [ 398.894151][ T9] usb 2-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 398.918654][ T9] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 398.934954][ T9] usb 2-1: config 2 has no interface number 0 [ 398.953555][ T9] usb 2-1: config 2 interface 12 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 398.980749][ T9] usb 2-1: config 2 interface 12 altsetting 7 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 399.048477][ T9] usb 2-1: config 2 interface 12 altsetting 7 endpoint 0x8A has invalid wMaxPacketSize 0 [ 399.063347][ T9] usb 2-1: config 2 interface 12 has no altsetting 0 [ 399.074876][ T9] usb 2-1: New USB device found, idVendor=2040, idProduct=8265, bcdDevice=b5.a3 [ 399.094454][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.110554][ T9] usb 2-1: Product: syz [ 399.123976][ T9] usb 2-1: Manufacturer: syz [ 399.132604][ T9] usb 2-1: SerialNumber: syz [ 399.245385][T10760] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.258532][T10760] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.273075][ T5711] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 399.286103][ T5711] em28xx 5-1:0.0: board has no eeprom [ 399.356503][ T9] em28xx 2-1:2.12: New device syz syz @ 12 Mbps (2040:8265, interface 12, class 12) [ 399.368640][ T9] em28xx 2-1:2.12: Device initialization failed. [ 399.375188][ T9] em28xx 2-1:2.12: Device must be connected to a high-speed USB 2.0 port. [ 399.400951][ T9] usb 2-1: USB disconnect, device number 95 [ 399.954793][T10763] wireguard0: entered promiscuous mode [ 399.962681][T10763] wireguard0: entered allmulticast mode [ 400.423030][ T30] audit: type=1326 audit(1780975241.504:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.477154][ T5711] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 400.494641][ T30] audit: type=1326 audit(1780975241.534:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.530983][T10783] netlink: 'syz.4.1508': attribute type 1 has an invalid length. [ 400.540497][ T5711] em28xx 5-1:0.0: dvb set to bulk mode. [ 400.564012][ T30] audit: type=1326 audit(1780975241.534:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=331 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.590101][ T30] audit: type=1326 audit(1780975241.534:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.590891][ T9] em28xx 5-1:0.0: Binding DVB extension [ 400.620933][ T808] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 400.628970][ T30] audit: type=1326 audit(1780975241.534:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.654823][ T30] audit: type=1326 audit(1780975241.534:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.681188][ T30] audit: type=1326 audit(1780975241.534:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.705905][ T30] audit: type=1326 audit(1780975241.534:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.731314][ T30] audit: type=1326 audit(1780975241.534:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=354 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.778135][T10787] netlink: 'syz.4.1508': attribute type 10 has an invalid length. [ 400.806838][ T808] usb 2-1: Using ep0 maxpacket: 16 [ 400.830110][ T808] usb 2-1: config 1 interface 0 has no altsetting 0 [ 400.840451][T10787] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1508'. [ 400.853514][ T30] audit: type=1326 audit(1780975241.534:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10776 comm="syz.3.1505" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 400.892474][ T808] usb 2-1: New USB device found, idVendor=044f, idProduct=b320, bcdDevice= 0.40 [ 400.904460][ T808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.922139][ T808] usb 2-1: Product: syz [ 400.931133][ T808] usb 2-1: Manufacturer: syz [ 400.941642][ T808] usb 2-1: SerialNumber: syz [ 400.946400][T10783] bond0: option mode: invalid value (8) [ 400.966957][ T9] em28xx 5-1:0.0: Registering input extension [ 400.992755][T10783] bond0 (unregistering): Released all slaves [ 401.216015][T10787] dummy0: entered promiscuous mode [ 401.375809][T10804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 401.409979][T10804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.908138][T10813] binder: BINDER_SET_CONTEXT_MGR already set [ 401.921350][T10813] binder: 10812:10813 ioctl 4018620d 80004a80 returned -16 [ 402.006470][T10814] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.054494][T10814] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.153501][ T808] usbhid 2-1:1.0: can't add hid device: -71 [ 402.166926][ T808] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 402.189682][T10813] syz.5.1514 (10813): drop_caches: 2 [ 402.202532][ T808] usb 2-1: USB disconnect, device number 96 [ 402.256987][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 402.971940][T10821] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.009591][T10821] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.017871][T10823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.035844][T10823] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.067197][T10823] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1519'. [ 403.177481][ T9] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 403.336821][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 403.343861][ T9] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 403.352805][ T9] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 403.361811][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 403.371148][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 403.381517][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 403.391334][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 403.404710][ T9] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 403.413955][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.425584][ T9] usb 2-1: config 0 descriptor?? [ 403.650396][ T9] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 97 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 403.694776][ T9] usb 2-1: USB disconnect, device number 97 [ 403.724935][ T9] usblp0: removed [ 403.925501][T10841] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.962939][T10841] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.980637][T10841] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1524'. [ 404.053584][T10845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 404.072319][T10845] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.180226][T10338] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 404.187138][ T9] usb 2-1: new low-speed USB device number 98 using dummy_hcd [ 404.356988][ T9] usb 2-1: Invalid ep0 maxpacket: 32 [ 404.486781][ T9] usb 2-1: new low-speed USB device number 99 using dummy_hcd [ 404.566926][T10855] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 404.582540][T10855] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.636865][ T9] usb 2-1: Invalid ep0 maxpacket: 32 [ 404.647153][ T9] usb usb2-port1: attempt power cycle [ 404.998046][ T9] usb 2-1: new low-speed USB device number 100 using dummy_hcd [ 405.047670][ T9] usb 2-1: Invalid ep0 maxpacket: 32 [ 405.049785][T10861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 405.071394][T10861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 405.094032][T10861] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1531'. [ 405.196832][ T9] usb 2-1: new low-speed USB device number 101 using dummy_hcd [ 405.227619][ T9] usb 2-1: Invalid ep0 maxpacket: 32 [ 405.240513][ T9] usb usb2-port1: unable to enumerate USB device [ 405.609233][T10863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 405.618981][T10863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 407.519758][T10894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.543198][T10894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 407.884313][T10898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.921389][T10898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 407.949408][T10898] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1543'. [ 408.290969][T10902] xt_CT: No such helper "syz0" [ 408.693785][T10910] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1547'. [ 408.885249][T10913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 408.899385][T10913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.068271][T10919] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 409.279159][T10922] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.293638][T10922] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.641997][T10922] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.670064][T10922] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.761449][T10932] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1554'. [ 409.772635][T10933] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1554'. [ 409.853942][T10935] binder: BINDER_SET_CONTEXT_MGR already set [ 409.864094][T10935] binder: 10934:10935 ioctl 4018620d 80004a80 returned -16 [ 409.886081][T10935] syz.5.1555 (10935): drop_caches: 2 [ 409.895370][T10935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.899340][T10935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.932618][ T5760] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 409.942743][T10936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.943149][T10936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.076940][ T5760] usb 2-1: Using ep0 maxpacket: 32 [ 410.088759][ T5760] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 410.104245][ T5760] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 410.115700][ T5760] usb 2-1: config 0 has no interface number 0 [ 410.122031][ T5760] usb 2-1: config 0 interface 184 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 410.132675][T10943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.136026][ T5760] usb 2-1: config 0 interface 184 has no altsetting 0 [ 410.145092][T10943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.165471][ T5760] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 410.175553][ T5760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.184241][ T5760] usb 2-1: Product: syz [ 410.189092][ T5760] usb 2-1: Manufacturer: syz [ 410.193752][ T5760] usb 2-1: SerialNumber: syz [ 410.202569][ T5760] usb 2-1: config 0 descriptor?? [ 410.212305][ T5760] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 410.223302][ T5760] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -22 [ 411.146842][T10957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 411.165624][T10957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.689306][T10976] FAULT_INJECTION: forcing a failure. [ 412.689306][T10976] name failslab, interval 1, probability 0, space 0, times 0 [ 412.723700][T10976] CPU: 0 UID: 0 PID: 10976 Comm: syz.0.1568 Tainted: G L syzkaller #0 PREEMPT(full) [ 412.723734][T10976] Tainted: [L]=SOFTLOCKUP [ 412.723742][T10976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 412.723759][T10976] Call Trace: [ 412.723768][T10976] [ 412.723777][T10976] dump_stack_lvl+0xe8/0x150 [ 412.723806][T10976] should_fail_ex+0x412/0x560 [ 412.723835][T10976] should_failslab+0xa8/0x100 [ 412.723858][T10976] __kmalloc_cache_noprof+0x88/0x660 [ 412.723886][T10976] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 412.723907][T10976] ? sctp_v6_cmp_addr+0x15/0xd0 [ 412.723927][T10976] ? sctp_add_bind_addr+0x8c/0x370 [ 412.723954][T10976] sctp_add_bind_addr+0x8c/0x370 [ 412.723979][T10976] sctp_copy_local_addr_list+0x314/0x4f0 [ 412.724005][T10976] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 412.724027][T10976] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 412.724052][T10976] ? sctp_v6_is_any+0x64/0x80 [ 412.724074][T10976] ? sctp_copy_one_addr+0x93/0x360 [ 412.724098][T10976] sctp_bind_addr_copy+0xb3/0x3c0 [ 412.724130][T10976] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 412.724164][T10976] sctp_connect_new_asoc+0x2ff/0x6b0 [ 412.724193][T10976] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 412.724226][T10976] ? __local_bh_enable_ip+0xd0/0x130 [ 412.724246][T10976] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 412.724275][T10976] ? security_sctp_bind_connect+0x7e/0x2c0 [ 412.724304][T10976] sctp_sendmsg+0x1576/0x2c50 [ 412.724344][T10976] ? __pfx_sctp_sendmsg+0x10/0x10 [ 412.724372][T10976] ? aa_sk_perm+0x6d5/0x900 [ 412.724402][T10976] ? __might_fault+0xaf/0x130 [ 412.724437][T10976] ? __pfx_aa_sk_perm+0x10/0x10 [ 412.724467][T10976] ? sock_rps_record_flow+0x19/0x350 [ 412.724511][T10976] ? inet_sendmsg+0x2f4/0x370 [ 412.724539][T10976] ____sys_sendmsg+0x80a/0x9f0 [ 412.724571][T10976] ? __pfx_____sys_sendmsg+0x10/0x10 [ 412.724597][T10976] ? kstrtoull+0x12f/0x1d0 [ 412.724636][T10976] ___sys_sendmsg+0x2a5/0x360 [ 412.724656][T10976] ? __lock_acquire+0x6b5/0x2cf0 [ 412.724684][T10976] ? __pfx____sys_sendmsg+0x10/0x10 [ 412.724708][T10976] ? get_pid_task+0x20/0x1f0 [ 412.724732][T10976] ? get_pid_task+0x20/0x1f0 [ 412.724756][T10976] ? get_pid_task+0x20/0x1f0 [ 412.724811][T10976] ? __fget_files+0x2a/0x420 [ 412.724835][T10976] ? __fget_files+0x3a0/0x420 [ 412.724871][T10976] __sys_sendmsg+0x183/0x260 [ 412.724895][T10976] ? __pfx___sys_sendmsg+0x10/0x10 [ 412.724940][T10976] __do_fast_syscall_32+0x23e/0x6f0 [ 412.724966][T10976] ? do_fast_syscall_32+0x33/0x70 [ 412.724987][T10976] ? lockdep_hardirqs_on+0x7a/0x110 [ 412.725007][T10976] ? asm_int80_emulation+0x1a/0x20 [ 412.725026][T10976] ? do_int80_emulation+0x29f/0x550 [ 412.725048][T10976] ? trace_irq_disable+0x3b/0x140 [ 412.725081][T10976] do_fast_syscall_32+0x33/0x70 [ 412.725105][T10976] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 412.725136][T10976] RIP: 0023:0xf7f7301c [ 412.725155][T10976] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 412.725172][T10976] RSP: 002b:00000000f543650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 412.725193][T10976] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000800 [ 412.725207][T10976] RDX: 0000000000048043 RSI: 0000000000000000 RDI: 0000000000000000 [ 412.725219][T10976] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 412.725231][T10976] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 412.725243][T10976] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 412.725274][T10976] [ 413.183166][T10980] binder: BINDER_SET_CONTEXT_MGR already set [ 413.192445][T10980] binder: 10977:10980 ioctl 4018620d 80004a80 returned -16 [ 413.206042][T10980] syz.3.1570 (10980): drop_caches: 2 [ 413.215838][T10980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.231702][ T6938] usb 2-1: USB disconnect, device number 102 [ 413.247657][T10980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.380946][T10987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.419268][T10987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.448908][T10987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.460989][T10987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.473695][T10987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.482812][T10987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.693810][T10987] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1573'. [ 413.748912][ T6938] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 413.870107][T10998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.889161][T10998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.906861][ T6938] usb 2-1: Using ep0 maxpacket: 16 [ 413.918802][ T6938] usb 2-1: config 1 interface 0 has no altsetting 0 [ 413.929115][ T6938] usb 2-1: New USB device found, idVendor=044f, idProduct=b320, bcdDevice= 0.40 [ 413.943378][ T6938] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.964747][ T6938] usb 2-1: Product: syz [ 413.978991][ T6938] usb 2-1: Manufacturer: syz [ 413.985236][ T6938] usb 2-1: SerialNumber: syz [ 415.204374][ T6938] usbhid 2-1:1.0: can't add hid device: -71 [ 415.230791][ T6938] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 415.254303][ T6938] usb 2-1: USB disconnect, device number 103 [ 416.062192][T11020] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.081560][T11020] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.176878][ T808] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 416.248168][T11023] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.260136][T11023] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.356811][ T808] usb 2-1: Using ep0 maxpacket: 32 [ 416.370290][ T808] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 416.393314][ T808] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 416.409154][ T808] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 416.419428][ T808] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 416.431448][ T808] usb 2-1: config 0 descriptor?? [ 416.441038][T11028] binder: BINDER_SET_CONTEXT_MGR already set [ 416.447713][T11028] binder: 11027:11028 ioctl 4018620d 80004a80 returned -16 [ 416.455414][ T808] hub 2-1:0.0: bad descriptor, ignoring hub [ 416.462306][ T808] hub 2-1:0.0: probe with driver hub failed with error -5 [ 416.471924][T11028] syz.3.1585 (11028): drop_caches: 2 [ 416.472657][ T808] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 416.488336][T11028] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.498624][T11028] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.612161][T11031] pimreg: entered allmulticast mode [ 416.735038][T11033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.744306][T11033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 417.225746][T11042] FAULT_INJECTION: forcing a failure. [ 417.225746][T11042] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 417.241194][T11042] CPU: 0 UID: 0 PID: 11042 Comm: syz.3.1589 Tainted: G L syzkaller #0 PREEMPT(full) [ 417.241225][T11042] Tainted: [L]=SOFTLOCKUP [ 417.241232][T11042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 417.241245][T11042] Call Trace: [ 417.241253][T11042] [ 417.241261][T11042] dump_stack_lvl+0xe8/0x150 [ 417.241290][T11042] should_fail_ex+0x412/0x560 [ 417.241316][T11042] prepare_alloc_pages+0x22a/0x650 [ 417.241353][T11042] __alloc_frozen_pages_noprof+0x12f/0x380 [ 417.241387][T11042] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 417.241419][T11042] ? __pfx_policy_nodemask+0x10/0x10 [ 417.241443][T11042] ? __lock_acquire+0x6b5/0x2cf0 [ 417.241467][T11042] alloc_pages_mpol+0x235/0x490 [ 417.241491][T11042] folio_alloc_mpol_noprof+0x39/0x160 [ 417.241513][T11042] vma_alloc_folio_noprof+0xe1/0x1e0 [ 417.241539][T11042] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 417.241559][T11042] ? __pte_offset_map+0x29/0x240 [ 417.241584][T11042] ? __pte_offset_map+0x29/0x240 [ 417.241610][T11042] do_pte_missing+0x159d/0x33f0 [ 417.241649][T11042] ? handle_mm_fault+0xf1/0x3170 [ 417.241676][T11042] handle_mm_fault+0x1bf2/0x3170 [ 417.241713][T11042] ? handle_mm_fault+0xf1/0x3170 [ 417.241742][T11042] ? __pfx_handle_mm_fault+0x10/0x10 [ 417.241783][T11042] ? lock_mm_and_find_vma+0xa7/0x340 [ 417.241813][T11042] do_user_addr_fault+0x75b/0x1340 [ 417.241848][T11042] exc_page_fault+0x6a/0xc0 [ 417.241874][T11042] asm_exc_page_fault+0x26/0x30 [ 417.241889][T11042] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 417.241908][T11042] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 417.241920][T11042] RSP: 0018:ffffc90005fd7a68 EFLAGS: 00050206 [ 417.241932][T11042] RAX: ffffffff84b1e301 RBX: 0000000000008000 RCX: 0000000000007424 [ 417.241942][T11042] RDX: 0000000000000000 RSI: ffff88804ba10bdc RDI: 000000008001a000 [ 417.241951][T11042] RBP: 0000000000010300 R08: ffff88804ba17fff R09: 1ffff11009742fff [ 417.241961][T11042] R10: dffffc0000000000 R11: ffffed1009743000 R12: 0000000080021424 [ 417.241971][T11042] R13: 00007ffffffff000 R14: ffff88804ba10000 R15: 0000000080019424 [ 417.241986][T11042] ? _copy_to_user+0x41/0xb0 [ 417.242007][T11042] _copy_to_user+0x8a/0xb0 [ 417.242025][T11042] sg_read_oxfer+0x269/0x4f0 [ 417.242048][T11042] sg_read+0x116a/0x15b0 [ 417.242071][T11042] ? __pfx_sg_read+0x10/0x10 [ 417.242085][T11042] ? apparmor_file_permission+0x1f4/0x300 [ 417.242109][T11042] ? bpf_lsm_file_permission+0x9/0x20 [ 417.242129][T11042] ? security_file_permission+0x75/0x260 [ 417.242146][T11042] ? rw_verify_area+0x2a6/0x4d0 [ 417.242165][T11042] ? __pfx_sg_read+0x10/0x10 [ 417.242180][T11042] vfs_read+0x20c/0xa70 [ 417.242205][T11042] ? __pfx_vfs_read+0x10/0x10 [ 417.242252][T11042] ? __fget_files+0x2a/0x420 [ 417.242277][T11042] ? __fget_files+0x2a/0x420 [ 417.242319][T11042] ? __fget_files+0x3a0/0x420 [ 417.242341][T11042] ? __fget_files+0x2a/0x420 [ 417.242364][T11042] ksys_read+0x150/0x270 [ 417.242386][T11042] ? __pfx_ksys_read+0x10/0x10 [ 417.242413][T11042] __do_fast_syscall_32+0x23e/0x6f0 [ 417.242430][T11042] ? do_fast_syscall_32+0x33/0x70 [ 417.242444][T11042] ? lockdep_hardirqs_on+0x7a/0x110 [ 417.242458][T11042] ? asm_int80_emulation+0x1a/0x20 [ 417.242472][T11042] ? do_int80_emulation+0x29f/0x550 [ 417.242486][T11042] ? trace_irq_disable+0x3b/0x140 [ 417.242509][T11042] do_fast_syscall_32+0x33/0x70 [ 417.242526][T11042] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 417.242543][T11042] RIP: 0023:0xf704f01c [ 417.242556][T11042] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 417.242567][T11042] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 417.242581][T11042] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001400 [ 417.242591][T11042] RDX: 00000000fffffeea RSI: 0000000000000000 RDI: 0000000000000000 [ 417.242601][T11042] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 417.242610][T11042] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 417.242619][T11042] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 417.242639][T11042] [ 418.357483][T11054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 418.367948][T11054] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.976564][T11065] xt_CT: You must specify a L4 protocol and not use inversions on it [ 419.047887][ T5727] usb 2-1: USB disconnect, device number 104 [ 419.055055][T11067] binder: BINDER_SET_CONTEXT_MGR already set [ 419.061322][T11067] binder: 11066:11067 ioctl 4018620d 80004a80 returned -16 [ 419.084703][T11067] syz.1.1598 (11067): drop_caches: 2 [ 419.303637][T11071] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1600'. [ 419.357029][ T6938] usb 2-1: new full-speed USB device number 105 using dummy_hcd [ 419.536989][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 419.546809][ T6938] usb 2-1: config 2 has an invalid interface number: 12 but max is 0 [ 419.555293][ T6938] usb 2-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 419.564348][ T6938] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 419.574733][ T6938] usb 2-1: config 2 has no interface number 0 [ 419.582451][ T6938] usb 2-1: config 2 interface 12 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 419.593685][ T6938] usb 2-1: config 2 interface 12 altsetting 7 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 419.605671][ T6938] usb 2-1: config 2 interface 12 altsetting 7 endpoint 0x8A has invalid wMaxPacketSize 0 [ 419.615636][ T6938] usb 2-1: config 2 interface 12 has no altsetting 0 [ 419.624694][ T6938] usb 2-1: New USB device found, idVendor=2040, idProduct=8265, bcdDevice=b5.a3 [ 419.633840][ T6938] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.641953][ T6938] usb 2-1: Product: syz [ 419.646142][ T6938] usb 2-1: Manufacturer: syz [ 419.650847][ T6938] usb 2-1: SerialNumber: syz [ 419.713801][T11074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.724207][T11074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.828141][T11077] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.841694][T11077] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.856851][T11077] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1602'. [ 419.881554][ T6938] em28xx 2-1:2.12: New device syz syz @ 12 Mbps (2040:8265, interface 12, class 12) [ 419.893688][ T6938] em28xx 2-1:2.12: Device initialization failed. [ 419.900986][ T6938] em28xx 2-1:2.12: Device must be connected to a high-speed USB 2.0 port. [ 419.914273][ T6938] usb 2-1: USB disconnect, device number 105 [ 420.185182][T11080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 420.196495][T11080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 420.210933][T11080] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1603'. [ 420.531142][T11086] sg_write: data in/out 422878/626 bytes for SCSI command 0x0-- guessing data in; [ 420.531142][T11086] program syz.3.1606 not setting count and/or reply_len properly [ 420.871885][T11095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 420.885091][T11095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.587125][T11099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.624159][T11099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.782477][T11104] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1612'. [ 421.920337][T11104] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1612'. [ 421.985762][T11109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.005220][T11109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.054284][T11111] binder: BINDER_SET_CONTEXT_MGR already set [ 422.061779][T11111] binder: 11110:11111 ioctl 4018620d 80004a80 returned -16 [ 422.093247][T11111] syz.0.1614 (11111): drop_caches: 2 [ 422.446800][ T808] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 422.521725][T11115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.532065][T11115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.596849][ T808] usb 2-1: Using ep0 maxpacket: 16 [ 422.611571][ T808] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 422.629575][ T808] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 422.639682][ T808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.648941][ T808] usb 2-1: Product: syz [ 422.653391][ T808] usb 2-1: Manufacturer: syz [ 422.659646][ T808] usb 2-1: SerialNumber: syz [ 422.668601][ T808] usb 2-1: config 0 descriptor?? [ 422.677242][ T808] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 422.687060][ T808] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 423.288280][T11123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.298502][ T808] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 423.314438][T11123] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.330194][T11123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.347461][T11123] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.358855][T11123] tc_dump_action: action bad kind [ 423.515611][T11113] netlink: 63 bytes leftover after parsing attributes in process `syz.1.1615'. [ 423.605179][ T808] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 423.611657][T11125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.614537][ T808] em28xx 2-1:0.0: board has no eeprom [ 423.630481][T11125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.696763][ T808] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 423.716858][ T808] em28xx 2-1:0.0: dvb set to bulk mode. [ 423.722520][ T5727] em28xx 2-1:0.0: Binding DVB extension [ 423.737192][ T808] usb 2-1: USB disconnect, device number 106 [ 423.758484][ T808] em28xx 2-1:0.0: Disconnecting em28xx [ 423.796438][ T5727] em28xx 2-1:0.0: Registering input extension [ 423.804445][ T808] em28xx 2-1:0.0: Closing input extension [ 423.826632][ T808] em28xx 2-1:0.0: Freeing device [ 424.675932][T11138] syzkaller0: entered promiscuous mode [ 424.698711][T11138] syzkaller0: entered allmulticast mode [ 425.527878][T11161] netlink: 'syz.1.1630': attribute type 153 has an invalid length. [ 425.669192][T11163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.689654][T11163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.710039][T11163] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1631'. [ 425.958367][ T5727] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 426.065791][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 426.065817][ T30] audit: type=1326 audit(1780975267.144:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.098751][ T30] audit: type=1326 audit(1780975267.144:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.125586][ T30] audit: type=1326 audit(1780975267.184:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=19 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.151434][ T5727] usb 2-1: Using ep0 maxpacket: 16 [ 426.157445][ T30] audit: type=1326 audit(1780975267.184:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.183931][ T5727] usb 2-1: config 1 interface 0 has no altsetting 0 [ 426.192726][ T5727] usb 2-1: New USB device found, idVendor=044f, idProduct=b320, bcdDevice= 0.40 [ 426.203351][ T5727] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.211627][ T30] audit: type=1326 audit(1780975267.184:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.236884][ T5727] usb 2-1: Product: syz [ 426.242718][ T5727] usb 2-1: Manufacturer: syz [ 426.249314][ T5727] usb 2-1: SerialNumber: syz [ 426.266900][T11167] IPVS: rr: FWM 3 0x00000003 - no destination available [ 426.276805][ T30] audit: type=1326 audit(1780975267.184:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=274 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.360588][ T30] audit: type=1326 audit(1780975267.184:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.398433][ T30] audit: type=1326 audit(1780975267.194:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.423946][ T30] audit: type=1326 audit(1780975267.194:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.449345][ T30] audit: type=1326 audit(1780975267.194:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11166 comm="syz.3.1633" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f01c code=0x7ffc0000 [ 426.711749][T11171] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 426.743246][T11171] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.103774][ T5727] usbhid 2-1:1.0: can't add hid device: -71 [ 427.110769][ T5727] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 427.131305][ T5727] usb 2-1: USB disconnect, device number 107 [ 427.749189][T11183] binder: BINDER_SET_CONTEXT_MGR already set [ 427.765723][T11183] binder: 11182:11183 ioctl 4018620d 80004a80 returned -16 [ 427.811254][T11183] syz.4.1638 (11183): drop_caches: 2 [ 427.867272][T11183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.884010][T11183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.932141][T11185] fuse: Unknown parameter ' ' [ 428.045430][T11187] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1639'. [ 428.457569][T11197] netlink: 'syz.0.1642': attribute type 29 has an invalid length. [ 428.486906][ T5727] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 428.525392][T11200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.543275][T11200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.555786][T11200] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1644'. [ 428.660538][ T5727] usb 2-1: Using ep0 maxpacket: 32 [ 428.668917][ T5727] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 428.680128][ T5727] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 428.690152][ T5727] usb 2-1: New USB device found, idVendor=0b05, idProduct=1807, bcdDevice= 0.00 [ 428.699421][ T5727] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.709739][ T5727] usb 2-1: config 0 descriptor?? [ 429.209802][ T5727] usbhid 2-1:0.0: can't add hid device: -71 [ 429.209910][ T5727] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 429.218391][ T5727] usb 2-1: USB disconnect, device number 108 [ 429.488915][T11211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.499700][T11211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.518439][T11213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.530013][T11213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.543730][T11211] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.560788][T11211] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.030523][T11220] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.048203][T11220] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.186881][ T5727] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 430.223037][T11223] FAULT_INJECTION: forcing a failure. [ 430.223037][T11223] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 430.236825][T11223] CPU: 0 UID: 0 PID: 11223 Comm: syz.5.1653 Tainted: G L syzkaller #0 PREEMPT(full) [ 430.236854][T11223] Tainted: [L]=SOFTLOCKUP [ 430.236861][T11223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 430.236871][T11223] Call Trace: [ 430.236879][T11223] [ 430.236887][T11223] dump_stack_lvl+0xe8/0x150 [ 430.236915][T11223] should_fail_ex+0x412/0x560 [ 430.236939][T11223] _copy_from_user+0x2d/0xb0 [ 430.236964][T11223] snd_rawmidi_kernel_write1+0x3ab/0x640 [ 430.237006][T11223] snd_rawmidi_write+0x5cd/0xc00 [ 430.237028][T11223] ? kstrtouint+0x6e/0xe0 [ 430.237059][T11223] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 430.237082][T11223] ? __pfx_default_wake_function+0x10/0x10 [ 430.237100][T11223] ? apparmor_file_permission+0x1f4/0x300 [ 430.237121][T11223] ? bpf_lsm_file_permission+0x9/0x20 [ 430.237144][T11223] ? security_file_permission+0x75/0x260 [ 430.237164][T11223] ? rw_verify_area+0x255/0x4d0 [ 430.237185][T11223] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 430.237209][T11223] vfs_write+0x29a/0xb90 [ 430.237239][T11223] ? __pfx_vfs_write+0x10/0x10 [ 430.237262][T11223] ? __fget_files+0x2a/0x420 [ 430.237283][T11223] ? __fget_files+0x2a/0x420 [ 430.237300][T11223] ? __fget_files+0x3a0/0x420 [ 430.237317][T11223] ? __fget_files+0x2a/0x420 [ 430.237340][T11223] ksys_write+0x150/0x270 [ 430.237364][T11223] ? __pfx_ksys_write+0x10/0x10 [ 430.237392][T11223] __do_fast_syscall_32+0x23e/0x6f0 [ 430.237409][T11223] ? do_fast_syscall_32+0x33/0x70 [ 430.237425][T11223] ? lockdep_hardirqs_on+0x7a/0x110 [ 430.237440][T11223] ? asm_int80_emulation+0x1a/0x20 [ 430.237454][T11223] ? do_int80_emulation+0x29f/0x550 [ 430.237469][T11223] ? trace_irq_disable+0x3b/0x140 [ 430.237495][T11223] do_fast_syscall_32+0x33/0x70 [ 430.237512][T11223] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 430.237531][T11223] RIP: 0023:0xf70af01c [ 430.237544][T11223] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 430.237558][T11223] RSP: 002b:00000000f549d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 430.237574][T11223] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000000 [ 430.237584][T11223] RDX: 00000000fffffd2c RSI: 0000000000000000 RDI: 0000000000000000 [ 430.237594][T11223] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 430.237603][T11223] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 430.237612][T11223] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 430.237634][T11223] [ 430.576850][ T5727] usb 2-1: device descriptor read/64, error -71 [ 430.687784][T11226] binder: BINDER_SET_CONTEXT_MGR already set [ 430.700046][T11226] binder: 11225:11226 ioctl 4018620d 80004a80 returned -16 [ 430.724848][T11226] syz.5.1654 (11226): drop_caches: 2 [ 430.746849][T11226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.769967][T11226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.834704][ T5727] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 430.937783][T11230] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.947481][T11230] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.966440][T11230] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1656'. [ 430.987056][ T5727] usb 2-1: device descriptor read/64, error -71 [ 431.108552][ T5727] usb usb2-port1: attempt power cycle [ 431.466330][T11241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 431.475031][ T5727] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 431.484265][T11241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.517528][ T5727] usb 2-1: device descriptor read/8, error -71 [ 431.616467][T11244] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1662'. [ 431.672620][T11246] ip6gretap2: entered promiscuous mode [ 431.782055][ T5727] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 431.813864][T11252] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 431.823467][T11252] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.833578][ T5727] usb 2-1: device descriptor read/8, error -71 [ 431.947338][ T5727] usb usb2-port1: unable to enumerate USB device [ 432.855956][T11265] binder: BINDER_SET_CONTEXT_MGR already set [ 432.870218][T11265] binder: 11264:11265 ioctl 4018620d 80004a80 returned -16 [ 432.908538][T11265] syz.3.1669 (11265): drop_caches: 2 [ 432.931777][T11265] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.943117][T11265] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.416901][ T5727] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 433.577276][ T5727] usb 2-1: Using ep0 maxpacket: 32 [ 433.593566][ T5727] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 433.613672][T11271] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 433.616830][ T5727] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 433.624153][T11271] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.651241][ T5727] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 433.678350][ T5727] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.700249][ T5727] usb 2-1: config 0 descriptor?? [ 433.709531][T11274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 433.712006][ T5727] hub 2-1:0.0: USB hub found [ 433.726293][T11274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.749716][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 433.749733][ T30] audit: type=1326 audit(1780975274.834:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 433.781101][ T30] audit: type=1326 audit(1780975274.834:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 433.806016][ T30] audit: type=1326 audit(1780975274.864:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 433.830888][ T30] audit: type=1326 audit(1780975274.864:210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 433.856103][ T30] audit: type=1326 audit(1780975274.864:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 433.885289][ T30] audit: type=1326 audit(1780975274.884:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=182 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 433.910407][ T30] audit: type=1326 audit(1780975274.914:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 433.937655][ T5727] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 433.955079][ T30] audit: type=1326 audit(1780975274.914:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 433.983505][ T30] audit: type=1326 audit(1780975274.934:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 434.008026][ T30] audit: type=1326 audit(1780975274.934:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11273 comm="syz.4.1673" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af01c code=0x7ffc0000 [ 434.344252][ T5727] hid-generic 0003:046D:C31C.0010: unknown main item tag 0x0 [ 434.358623][ T5727] hid-generic 0003:046D:C31C.0010: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.1-1/input0 [ 434.577431][T11269] xt_CT: You must specify a L4 protocol and not use inversions on it [ 434.627384][T11286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.644158][T11286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.719966][T11290] netlink: 'syz.5.1678': attribute type 10 has an invalid length. [ 434.728148][T11290] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1678'. [ 434.737600][ T5727] usb 2-1: USB disconnect, device number 113 [ 434.758377][T11290] team0: Port device geneve1 added [ 435.063666][T11299] netlink: 63 bytes leftover after parsing attributes in process `syz.0.1680'. [ 435.096792][ T5727] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 435.247400][ T5727] usb 2-1: Using ep0 maxpacket: 32 [ 435.253465][ T5727] usb 2-1: no configurations [ 435.258739][ T5727] usb 2-1: can't read configurations, error -22 [ 435.382553][T11305] binder: BINDER_SET_CONTEXT_MGR already set [ 435.387508][ T5727] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 435.396076][T11305] binder: 11304:11305 ioctl 4018620d 80004a80 returned -16 [ 435.470448][T11310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.491216][T11310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.548535][T11305] syz.4.1682 (11305): drop_caches: 2 [ 435.557011][ T5727] usb 2-1: Using ep0 maxpacket: 32 [ 435.573103][ T5727] usb 2-1: no configurations [ 435.594050][ T5727] usb 2-1: can't read configurations, error -22 [ 435.613851][ T5727] usb usb2-port1: attempt power cycle [ 435.966792][ T5727] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 435.998844][ T5727] usb 2-1: Using ep0 maxpacket: 32 [ 436.007052][ T5727] usb 2-1: no configurations [ 436.011796][ T5727] usb 2-1: can't read configurations, error -22 [ 436.150267][ T5727] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 436.177150][T10322] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 436.225974][ T5727] usb 2-1: device descriptor read/8, error -71 [ 436.357530][ T5727] usb usb2-port1: unable to enumerate USB device [ 436.649658][T11328] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 436.655719][T11328] syzkaller0: linktype set to 773 [ 436.664353][T11328] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1688'. [ 436.804038][T11332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.836995][T11332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.857095][ T6938] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 436.981237][T11294] Bluetooth: hci2: command 0x0406 tx timeout [ 437.036784][ T6938] usb 2-1: Using ep0 maxpacket: 8 [ 437.048305][ T6938] usb 2-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 437.061024][ T6938] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.069412][ T6938] usb 2-1: Product: syz [ 437.073817][ T6938] usb 2-1: Manufacturer: syz [ 437.078760][ T6938] usb 2-1: SerialNumber: syz [ 437.478636][T11344] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1694'. [ 437.492500][ T6938] mxuport 2-1:254.0: mxuport_recv_ctrl_urb - short read (0 / 4) [ 437.501542][ T6938] mxuport 2-1:254.0: probe with driver mxuport failed with error -5 [ 437.895264][T11348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 437.910299][ T5727] usb 2-1: USB disconnect, device number 118 [ 437.928462][T11348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 437.955385][T11349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 437.966234][T11349] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 437.982233][T11349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 437.997679][T11349] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.017827][T11349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.030931][T11349] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.041681][T11349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.051881][T11349] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.061078][T11349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.070847][T11349] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.133440][T11352] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.157365][T11352] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.172278][T11355] binder: BINDER_SET_CONTEXT_MGR already set [ 438.178885][T11355] binder: 11354:11355 ioctl 4018620d 80004a80 returned -16 [ 438.186859][T11352] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1697'. [ 438.203533][T11355] syz.3.1696 (11355): drop_caches: 2 [ 438.225091][T11355] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.249718][T11355] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.550671][T11364] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1701'. [ 438.560175][T11364] tipc: Invalid UDP bearer configuration [ 438.560227][T11364] tipc: Enabling of bearer rejected, failed to enable media [ 438.829934][T11371] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.871659][T11371] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.974760][T11375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.999946][T11375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.061800][T11375] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.088901][T11375] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.709766][T11384] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1707'. [ 439.898942][T11391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.912247][T11391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 440.019103][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.025494][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.156905][ T5727] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 440.306778][ T5727] usb 2-1: Using ep0 maxpacket: 8 [ 440.316392][ T5727] usb 2-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 440.326234][ T5727] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.335423][ T5727] usb 2-1: Product: syz [ 440.342117][ T5727] usb 2-1: Manufacturer: syz [ 440.347051][ T5727] usb 2-1: SerialNumber: syz [ 440.361044][T11397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 440.371692][T11397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 440.386406][T11397] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1713'. [ 440.535409][T11399] binder: BINDER_SET_CONTEXT_MGR already set [ 440.542199][T11399] binder: 11398:11399 ioctl 4018620d 80004a80 returned -16 [ 440.556405][T11399] syz.4.1714 (11399): drop_caches: 2 [ 440.567562][T11399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 440.582802][T11399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 440.766898][ T5727] mxuport 2-1:254.0: mxuport_recv_ctrl_urb - short read (0 / 4) [ 440.775280][ T5727] mxuport 2-1:254.0: probe with driver mxuport failed with error -5 [ 441.117507][ T6938] usb 2-1: USB disconnect, device number 119 [ 441.996974][ T29] usb 2-1: new full-speed USB device number 120 using dummy_hcd [ 442.082442][T11427] netlink: 63 bytes leftover after parsing attributes in process `syz.0.1722'. [ 442.167376][ T29] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 442.193513][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.209330][ T29] usb 2-1: Product: syz [ 442.216306][ T29] usb 2-1: Manufacturer: syz [ 442.225330][ T29] usb 2-1: SerialNumber: syz [ 442.242337][ T29] usb 2-1: config 0 descriptor?? [ 442.398861][T11432] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 442.416888][T11432] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 442.466376][ T29] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 442.541506][ T29] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 442.583466][ T29] usb 2-1: USB disconnect, device number 120 [ 442.726389][T11438] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1725'. [ 442.971352][T11449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 442.999077][T11449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 443.306470][T11458] netlink: 'syz.1.1730': attribute type 2 has an invalid length. [ 443.385563][T11462] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1732'. [ 443.607305][T11459] bridge_slave_0: left allmulticast mode [ 443.630526][T11459] bridge_slave_0: left promiscuous mode [ 443.654750][T11459] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.686024][T11459] bridge_slave_1: left allmulticast mode [ 443.704293][T11459] bridge_slave_1: left promiscuous mode [ 443.730590][T11459] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.840425][T11459] bond0: (slave bond_slave_0): Releasing backup interface [ 443.877357][T11459] bond0: (slave bond_slave_1): Releasing backup interface [ 443.996125][T11459] team0: Port device team_slave_0 removed [ 444.403829][T11459] team0: Port device team_slave_1 removed [ 444.414842][T11459] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 444.424198][T11459] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 444.439974][T11459] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 444.455656][T11459] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 444.469630][T11459] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 444.911670][T11481] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1738'. [ 445.678464][T11491] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 445.696868][T11491] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 445.919210][T11495] binder: BINDER_SET_CONTEXT_MGR already set [ 445.926217][T11495] binder: 11494:11495 ioctl 4018620d 80004a80 returned -16 [ 445.953762][T11495] syz.1.1742 (11495): drop_caches: 2 [ 446.114846][T11497] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1743'. [ 446.236836][ T5760] usb 2-1: new full-speed USB device number 121 using dummy_hcd [ 446.315416][T11499] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 446.325116][T11499] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 446.424133][T11502] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 446.434323][T11502] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 446.443903][ T5760] usb 2-1: config 2 has an invalid interface number: 12 but max is 0 [ 446.455780][ T5760] usb 2-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 446.455798][ T5760] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 446.455812][ T5760] usb 2-1: config 2 has no interface number 0 [ 446.455841][ T5760] usb 2-1: config 2 interface 12 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 446.455859][ T5760] usb 2-1: config 2 interface 12 altsetting 7 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 446.455876][ T5760] usb 2-1: config 2 interface 12 altsetting 7 endpoint 0x8A has invalid wMaxPacketSize 0 [ 446.455891][ T5760] usb 2-1: config 2 interface 12 has no altsetting 0 [ 446.458607][ T5760] usb 2-1: New USB device found, idVendor=2040, idProduct=8265, bcdDevice=b5.a3 [ 446.458635][ T5760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.458657][ T5760] usb 2-1: Product: syz [ 446.458668][ T5760] usb 2-1: Manufacturer: syz [ 446.458678][ T5760] usb 2-1: SerialNumber: syz [ 446.686591][ T5760] em28xx 2-1:2.12: New device syz syz @ 12 Mbps (2040:8265, interface 12, class 12) [ 446.710285][ T5760] em28xx 2-1:2.12: Device initialization failed. [ 446.727868][ T5760] em28xx 2-1:2.12: Device must be connected to a high-speed USB 2.0 port. [ 446.749656][ T5760] usb 2-1: USB disconnect, device number 121 [ 447.203788][T11514] gtp0: entered allmulticast mode [ 447.391950][T11520] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1750'. [ 448.729243][T11535] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.742149][T11535] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.791612][T11537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.819362][T11537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 449.483998][T11541] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 449.497921][T11541] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 449.592218][T11543] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 449.610604][T11543] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 449.877082][T11550] syzkaller0: entered promiscuous mode [ 449.906733][T11550] syzkaller0: entered allmulticast mode [ 450.030455][T11549] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 450.108525][T11553] tipc: Started in network mode [ 450.121861][T11553] tipc: Node identity 82064654c425, cluster identity 4711 [ 450.139606][T11553] tipc: Enabled bearer , priority 0 [ 450.175320][T11548] tipc: Resetting bearer [ 450.231068][T11548] tipc: Disabling bearer [ 450.263133][T11557] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1762'. [ 450.465106][T11562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 450.482579][T11562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 450.897638][T11570] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 450.918905][T11570] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.411647][T11582] FAULT_INJECTION: forcing a failure. [ 451.411647][T11582] name failslab, interval 1, probability 0, space 0, times 0 [ 451.426234][T11582] CPU: 1 UID: 0 PID: 11582 Comm: syz.4.1770 Tainted: G L syzkaller #0 PREEMPT(full) [ 451.426264][T11582] Tainted: [L]=SOFTLOCKUP [ 451.426271][T11582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 451.426282][T11582] Call Trace: [ 451.426290][T11582] [ 451.426298][T11582] dump_stack_lvl+0xe8/0x150 [ 451.426327][T11582] should_fail_ex+0x412/0x560 [ 451.426353][T11582] should_failslab+0xa8/0x100 [ 451.426373][T11582] __kmalloc_cache_noprof+0x88/0x660 [ 451.426402][T11582] ? nf_tables_updchain+0x871/0x21f0 [ 451.426433][T11582] nf_tables_updchain+0x871/0x21f0 [ 451.426458][T11582] ? __pfx_nft_chain_lookup+0x10/0x10 [ 451.426504][T11582] ? __pfx_nf_tables_updchain+0x10/0x10 [ 451.426532][T11582] ? nft_pernet+0x23/0x240 [ 451.426563][T11582] nf_tables_newchain+0xdbd/0x2890 [ 451.426600][T11582] ? __pfx_nf_tables_newchain+0x10/0x10 [ 451.426637][T11582] ? __pfx___nla_validate_parse+0x10/0x10 [ 451.426664][T11582] ? nfnetlink_rcv+0x8bc/0x27b0 [ 451.426697][T11582] ? nfnl_pernet+0x23/0x240 [ 451.426722][T11582] ? nfnl_pernet+0x23/0x240 [ 451.426754][T11582] ? __nla_parse+0x40/0x60 [ 451.426788][T11582] nfnetlink_rcv+0x123e/0x27b0 [ 451.426845][T11582] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 451.426908][T11582] ? netlink_deliver_tap+0x2e/0x1b0 [ 451.426947][T11582] ? netlink_deliver_tap+0x2e/0x1b0 [ 451.426974][T11582] ? netlink_deliver_tap+0x2e/0x1b0 [ 451.427007][T11582] netlink_unicast+0x75c/0x8e0 [ 451.427043][T11582] netlink_sendmsg+0x813/0xb40 [ 451.427070][T11582] ? __pfx_netlink_sendmsg+0x10/0x10 [ 451.427091][T11582] ? aa_sock_msg_perm+0xf1/0x1b0 [ 451.427120][T11582] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 451.427149][T11582] ____sys_sendmsg+0x972/0x9f0 [ 451.427177][T11582] ? __pfx_____sys_sendmsg+0x10/0x10 [ 451.427218][T11582] ? kstrtoull+0x12f/0x1d0 [ 451.427256][T11582] ___sys_sendmsg+0x2a5/0x360 [ 451.427275][T11582] ? __lock_acquire+0x6b5/0x2cf0 [ 451.427301][T11582] ? __pfx____sys_sendmsg+0x10/0x10 [ 451.427323][T11582] ? get_pid_task+0x20/0x1f0 [ 451.427348][T11582] ? get_pid_task+0x20/0x1f0 [ 451.427370][T11582] ? get_pid_task+0x20/0x1f0 [ 451.427421][T11582] ? __fget_files+0x2a/0x420 [ 451.427444][T11582] ? __fget_files+0x3a0/0x420 [ 451.427479][T11582] __sys_sendmsg+0x183/0x260 [ 451.427502][T11582] ? __pfx___sys_sendmsg+0x10/0x10 [ 451.427543][T11582] __do_fast_syscall_32+0x23e/0x6f0 [ 451.427568][T11582] ? do_fast_syscall_32+0x33/0x70 [ 451.427588][T11582] ? lockdep_hardirqs_on+0x7a/0x110 [ 451.427608][T11582] ? asm_int80_emulation+0x1a/0x20 [ 451.427627][T11582] ? do_int80_emulation+0x29f/0x550 [ 451.427648][T11582] ? trace_irq_disable+0x3b/0x140 [ 451.427680][T11582] do_fast_syscall_32+0x33/0x70 [ 451.427703][T11582] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 451.427728][T11582] RIP: 0023:0xf70af01c [ 451.427747][T11582] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 451.427771][T11582] RSP: 002b:00000000f549d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 451.427793][T11582] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 451.427807][T11582] RDX: 0000000024000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 451.427820][T11582] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 451.427832][T11582] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 451.427844][T11582] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 451.427875][T11582] [ 451.772927][T11584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.781826][T11584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.296120][T11587] binder: BINDER_SET_CONTEXT_MGR already set [ 452.302528][T11587] binder: 11586:11587 ioctl 4018620d 80004a80 returned -16 [ 452.317250][T11587] syz.4.1773 (11587): drop_caches: 2 [ 452.329582][T11587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.344443][T11587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.009409][T11596] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.022344][T11596] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.086893][ T5760] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 453.133252][T11601] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1777'. [ 453.239003][ T5760] usb 2-1: config 0 has no interfaces? [ 453.246499][ T5760] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 453.258004][ T5760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.266066][ T5760] usb 2-1: Product: syz [ 453.270421][ T5760] usb 2-1: Manufacturer: syz [ 453.275189][ T5760] usb 2-1: SerialNumber: syz [ 453.282364][ T5760] usb 2-1: config 0 descriptor?? [ 453.521954][ T5760] usb 2-1: USB disconnect, device number 122 [ 453.750315][T11606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.759537][T11606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.971638][T11610] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1781'. [ 454.019756][T11612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.030736][T11612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.254575][T11612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.269599][T11612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.283913][T11617] binder: BINDER_SET_CONTEXT_MGR already set [ 454.299841][T11617] binder: 11616:11617 ioctl 4018620d 80004a80 returned -16 [ 454.312655][T11617] syz.5.1784 (11617): drop_caches: 2 [ 454.324300][T11617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.340195][T11617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.407066][ T5727] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 454.566871][ T5727] usb 2-1: Using ep0 maxpacket: 16 [ 454.579643][ T5727] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 454.593216][ T5727] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 454.618933][T11624] netlink: 'syz.4.1785': attribute type 2 has an invalid length. [ 454.627285][ T5727] usb 2-1: New USB device found, idVendor=06cb, idProduct=81a7, bcdDevice= 0.00 [ 454.637181][ T5727] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.649728][ T5727] usb 2-1: config 0 descriptor?? [ 454.737336][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 454.860998][T11614] warning: `syz.1.1783' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 454.893536][T11614] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 454.927613][T11614] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 454.977209][ T5727] usbhid 2-1:0.0: can't add hid device: -71 [ 454.992585][ T5727] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 455.004302][ T5727] usb 2-1: USB disconnect, device number 123 [ 455.141162][T11629] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1788'. [ 455.438353][T11633] ipip0: entered promiscuous mode [ 455.443607][T11633] ipip0: entered allmulticast mode [ 455.520536][T11633] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1789'. [ 455.541605][T11633] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1789'. [ 455.587953][T11633] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1789'. [ 455.802290][T11637] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.824266][T11637] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.862684][T11637] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1791'. [ 455.926894][ T5760] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 456.089854][ T5760] usb 2-1: Using ep0 maxpacket: 16 [ 456.108996][ T5760] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 456.131702][ T5760] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 456.146728][ T5760] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.165124][ T5760] usb 2-1: Product: syz [ 456.177831][ T5760] usb 2-1: Manufacturer: syz [ 456.190119][ T5760] usb 2-1: SerialNumber: syz [ 456.211980][ T5760] usb 2-1: config 0 descriptor?? [ 456.222120][ T5760] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 456.232172][ T5760] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 456.836436][ T5760] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 457.120801][T11651] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.131606][T11651] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.310088][ T5760] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 457.318866][ T5760] em28xx 2-1:0.0: board has no eeprom [ 457.419776][T11657] binder: BINDER_SET_CONTEXT_MGR already set [ 457.436344][T11657] binder: 11656:11657 ioctl 4018620d 80004a80 returned -16 [ 457.456214][T11657] syz.3.1797 (11657): drop_caches: 2 [ 457.469918][T11657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.484588][T11657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 458.075863][T11674] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1803'. [ 458.222410][T11674] team0: Port device bond0 removed [ 458.322956][T11679] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 458.344392][T11679] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 458.386163][T11674] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 458.477086][ T5760] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 458.489229][ T5760] em28xx 2-1:0.0: dvb set to bulk mode. [ 458.497812][ T5711] em28xx 2-1:0.0: Binding DVB extension [ 458.550127][ T5711] em28xx 2-1:0.0: Registering input extension [ 458.775140][ T5711] usb 2-1: USB disconnect, device number 124 [ 458.798038][ T5711] em28xx 2-1:0.0: Disconnecting em28xx [ 458.810217][ T5711] em28xx 2-1:0.0: Closing input extension [ 458.851510][ T5711] em28xx 2-1:0.0: Freeing device [ 459.044877][T11694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.058054][T11694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.192854][T11701] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1812'. [ 460.459705][T11710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.473928][T11710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.898765][ T29] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 461.066712][ T29] usb 2-1: Using ep0 maxpacket: 16 [ 461.077695][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 461.104011][ T29] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 461.118493][T11727] ipip0: entered promiscuous mode [ 461.123610][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.123635][ T29] usb 2-1: Product: syz [ 461.123651][ T29] usb 2-1: Manufacturer: syz [ 461.123667][ T29] usb 2-1: SerialNumber: syz [ 461.145740][T11727] ipip0: entered allmulticast mode [ 461.205388][ T29] usb 2-1: config 0 descriptor?? [ 461.234381][ T29] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 461.254907][ T29] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 461.271201][T11727] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1821'. [ 461.288247][T11727] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1821'. [ 461.301228][T11727] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1821'. [ 461.841802][ T29] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 462.205468][T11738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.229734][T11738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 462.265794][T11738] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1825'. [ 462.276346][T11715] netlink: 63 bytes leftover after parsing attributes in process `syz.1.1817'. [ 462.292453][ T29] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 462.308651][ T29] em28xx 2-1:0.0: board has no eeprom [ 462.376770][ T29] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 462.386810][ T29] em28xx 2-1:0.0: dvb set to bulk mode. [ 462.398850][ T5727] em28xx 2-1:0.0: Binding DVB extension [ 462.417288][ T29] usb 2-1: USB disconnect, device number 125 [ 462.433977][ T29] em28xx 2-1:0.0: Disconnecting em28xx [ 462.463151][ T5727] em28xx 2-1:0.0: Registering input extension [ 462.478779][ T29] em28xx 2-1:0.0: Closing input extension [ 462.503248][ T29] em28xx 2-1:0.0: Freeing device [ 462.859012][T11741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.883558][T11741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.683288][T11749] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 463.707267][T11749] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.736024][T11749] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1829'. [ 464.488644][T11768] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1837'. [ 464.701772][T11773] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1839'. [ 464.976509][T11776] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.996448][T11776] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.792649][T11789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.805824][T11789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.820153][T11789] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1846'. [ 465.907053][ T5727] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 466.076865][ T5727] usb 2-1: Using ep0 maxpacket: 8 [ 466.085857][ T5727] usb 2-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 466.095234][ T5727] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.103398][ T5727] usb 2-1: Product: syz [ 466.107776][ T5727] usb 2-1: Manufacturer: syz [ 466.112411][ T5727] usb 2-1: SerialNumber: syz [ 466.257477][T11793] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1848'. [ 466.531189][ T5727] mxuport 2-1:254.0: mxuport_recv_ctrl_urb - short read (0 / 4) [ 466.539752][ T5727] mxuport 2-1:254.0: probe with driver mxuport failed with error -5 [ 466.653628][T11804] binder: BINDER_SET_CONTEXT_MGR already set [ 466.663411][T11804] binder: 11803:11804 ioctl 4018620d 80004a80 returned -16 [ 466.723491][T11804] syz.4.1853 (11804): drop_caches: 2 [ 466.737378][T11804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.752424][T11804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 466.930483][ T29] usb 2-1: USB disconnect, device number 126 [ 467.418885][T11816] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1854'. [ 468.024055][T11826] faux_driver vgem: [drm] Unknown color mode 181; guessing buffer size. [ 468.186808][T11838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.186840][T10322] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 468.239649][T11838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.393039][T11842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.410714][T11842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.910997][T11847] xfrm0: entered promiscuous mode [ 468.928293][T11847] xfrm0: entered allmulticast mode [ 468.937616][T11846] binder: BINDER_SET_CONTEXT_MGR already set [ 468.946831][T11846] binder: 11844:11846 ioctl 4018620d 80004a80 returned -16 [ 468.971439][T11846] syz.5.1866 (11846): drop_caches: 2 [ 469.004485][T11846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.020952][T11846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.166927][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 469.166943][ T30] audit: type=1326 audit(1780975310.244:233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11849 comm="syz.1.1868" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703f01c code=0x0 [ 469.985317][T11865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 470.002304][T11865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 470.034626][T11868] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 470.489499][T11885] netlink: 63 bytes leftover after parsing attributes in process `syz.3.1880'. [ 470.866225][T11887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 470.879900][T11887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 471.162244][T11896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 471.176016][T11896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 471.626740][ T6938] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 471.779296][ T6938] usb 2-1: config 0 has no interfaces? [ 471.784876][ T6938] usb 2-1: New USB device found, idVendor=056e, idProduct=010d, bcdDevice= 0.00 [ 471.794824][ T6938] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.805704][ T6938] usb 2-1: config 0 descriptor?? [ 472.028924][T11902] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1887'. [ 472.038629][T11902] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1887'. [ 472.058435][ T6938] usb 2-1: USB disconnect, device number 127 [ 472.115141][T11917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 472.124916][T11917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 472.137483][T11917] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1892'. [ 472.763549][T11925] xt_connbytes: Forcing CT accounting to be enabled [ 472.784292][T11925] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1895'. [ 472.981348][T11932] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1896'. [ 473.044529][T11933] netlink: 'syz.1.1893': attribute type 4 has an invalid length. [ 473.112524][T11933] netlink: 'syz.1.1893': attribute type 4 has an invalid length. [ 473.604288][T11941] binder: BINDER_SET_CONTEXT_MGR already set [ 473.618139][T11941] binder: 11940:11941 ioctl 4018620d 80004a80 returned -16 [ 473.658225][T11941] syz.3.1898 (11941): drop_caches: 2 [ 473.699933][T11941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.721391][T11941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.749733][T11945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.768507][T11945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.318830][T11963] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1906'. [ 474.335323][T11961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.354789][T11961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.372244][T11961] netlink: 63 bytes leftover after parsing attributes in process `syz.5.1905'. [ 474.402840][T11965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.411722][T11965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.602234][T11972] netlink: 63 bytes leftover after parsing attributes in process `syz.0.1909'. [ 475.052072][T11976] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1911'. [ 475.068717][T11978] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1912'. [ 475.420124][T11988] binder: BINDER_SET_CONTEXT_MGR already set [ 475.426375][T11988] binder: 11987:11988 ioctl 4018620d 80004a80 returned -16 [ 475.441544][T11988] syz.4.1916 (11988): drop_caches: 2 [ 475.461717][T11988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.475572][T11988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.556775][ T29] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 475.726711][ T29] usb 2-1: Using ep0 maxpacket: 8 [ 475.738153][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 475.766703][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 475.777954][ T29] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8 [ 475.806751][ T29] usb 2-1: New USB device found, idVendor=056e, idProduct=00fe, bcdDevice= 0.00 [ 475.817236][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.840825][ T29] usb 2-1: config 0 descriptor?? [ 476.051678][T11986] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.063045][T11994] FAULT_INJECTION: forcing a failure. [ 476.063045][T11994] name failslab, interval 1, probability 0, space 0, times 0 [ 476.083285][T11986] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.092314][T11994] CPU: 0 UID: 0 PID: 11994 Comm: syz.5.1918 Tainted: G L syzkaller #0 PREEMPT(full) [ 476.092341][T11994] Tainted: [L]=SOFTLOCKUP [ 476.092349][T11994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 476.092361][T11994] Call Trace: [ 476.092432][T11994] [ 476.092523][T11994] dump_stack_lvl+0xe8/0x150 [ 476.092698][T11994] should_fail_ex+0x412/0x560 [ 476.092792][T11994] should_failslab+0xa8/0x100 [ 476.092843][T11994] ? vm_area_alloc+0x24/0x140 [ 476.092906][T11994] kmem_cache_alloc_noprof+0x87/0x650 [ 476.092933][T11994] ? __pfx_vma_merge_new_range+0x10/0x10 [ 476.092960][T11994] vm_area_alloc+0x24/0x140 [ 476.092986][T11994] mmap_region+0x11c6/0x22a0 [ 476.093005][T11994] ? unwind_get_return_address+0x4d/0x90 [ 476.093062][T11994] ? __pfx_mmap_region+0x10/0x10 [ 476.093096][T11994] ? mas_next_slot+0xc3b/0xd10 [ 476.093274][T11994] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 476.093340][T11994] ? cap_mmap_addr+0xaf/0x100 [ 476.093424][T11994] ? bpf_lsm_mmap_addr+0x9/0x50 [ 476.093467][T11994] ? shmem_mapping+0xd/0x50 [ 476.093490][T11994] ? memfd_check_seals_mmap+0xc5/0x200 [ 476.093525][T11994] do_mmap+0xc39/0x10c0 [ 476.093562][T11994] ? __pfx_do_mmap+0x10/0x10 [ 476.093582][T11994] ? down_write_killable+0x180/0x240 [ 476.093608][T11994] ? __pfx_down_write_killable+0x10/0x10 [ 476.093631][T11994] ? apparmor_mmap_file+0x2da/0x3e0 [ 476.093711][T11994] vm_mmap_pgoff+0x2c9/0x4f0 [ 476.093740][T11994] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 476.093761][T11994] ? __fget_files+0x2a/0x420 [ 476.093797][T11994] ? __fget_files+0x2a/0x420 [ 476.093821][T11994] ? __fget_files+0x2a/0x420 [ 476.093848][T11994] ksys_mmap_pgoff+0x51e/0x760 [ 476.093879][T11994] __do_fast_syscall_32+0x23e/0x6f0 [ 476.093924][T11994] ? do_fast_syscall_32+0x33/0x70 [ 476.093944][T11994] ? lockdep_hardirqs_on+0x7a/0x110 [ 476.093987][T11994] ? asm_int80_emulation+0x1a/0x20 [ 476.094021][T11994] ? do_int80_emulation+0x29f/0x550 [ 476.094041][T11994] ? trace_irq_disable+0x3b/0x140 [ 476.094080][T11994] do_fast_syscall_32+0x33/0x70 [ 476.094099][T11994] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 476.094121][T11994] RIP: 0023:0xf70af01c [ 476.094165][T11994] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 476.094205][T11994] RSP: 002b:00000000f549d410 EFLAGS: 00000206 ORIG_RAX: 00000000000000c0 [ 476.094248][T11994] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000080000 [ 476.094262][T11994] RDX: 0000000000000003 RSI: 0000000000008001 RDI: 0000000000000007 [ 476.094275][T11994] RBP: 0000000000010000 R08: 0000000000000000 R09: 0000000000000000 [ 476.094287][T11994] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 476.094299][T11994] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 476.094326][T11994] [ 476.392466][T11997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.404034][T11997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.502422][T12000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.502972][T12000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.218150][T12006] __nla_validate_parse: 2 callbacks suppressed [ 477.218236][T12006] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1924'. [ 477.544426][T12018] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 477.685147][T12023] binder: BINDER_SET_CONTEXT_MGR already set [ 477.692219][T12023] binder: 12022:12023 ioctl 4018620d 80004a80 returned -16 [ 477.708254][T12023] syz.3.1929 (12023): drop_caches: 2 [ 477.720046][T12023] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.730522][T12023] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.856363][T12027] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.868077][T12027] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.881211][T12027] netlink: 63 bytes leftover after parsing attributes in process `syz.4.1931'. [ 478.297492][ T29] usbhid 2-1:0.0: can't add hid device: -71 [ 478.318383][ T29] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 478.352953][ T29] usb 2-1: USB disconnect, device number 2 [ 478.402296][T12033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.424527][T12033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 478.451301][T12035] netlink: 'syz.5.1933': attribute type 10 has an invalid length. [ 478.484262][T12035] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1933'. [ 478.504790][T12035] dummy0: entered promiscuous mode [ 478.519507][T12035] bridge0: port 1(dummy0) entered blocking state [ 478.537102][T12035] bridge0: port 1(dummy0) entered disabled state [ 478.549262][T12035] dummy0: entered allmulticast mode [ 478.578906][T12035] bridge0: port 1(dummy0) entered blocking state [ 478.585392][T12035] bridge0: port 1(dummy0) entered forwarding state [ 478.703267][T12045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.715411][T12045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 478.884391][T12051] loop5: detected capacity change from 0 to 7 [ 478.893914][T12051] loop5: [ 478.897415][T12051] loop5: partition table partially beyond EOD, truncated [ 479.916737][ T5711] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 479.999034][T12073] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.007949][T12073] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 480.066752][ T5711] usb 2-1: Using ep0 maxpacket: 16 [ 480.075253][ T5711] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 480.093945][ T5711] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 480.104161][ T5711] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.113563][ T5711] usb 2-1: Product: syz [ 480.119124][ T5711] usb 2-1: Manufacturer: syz [ 480.124864][ T5711] usb 2-1: SerialNumber: syz [ 480.135398][ T5711] usb 2-1: config 0 descriptor?? [ 480.162047][ T5711] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 480.178040][ T5711] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 480.266347][T12076] netlink: 'syz.3.1949': attribute type 22 has an invalid length. [ 480.755202][ T5711] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 480.977068][ T31] INFO: task kworker/1:5:5698 blocked for more than 143 seconds. [ 480.986780][ T31] Tainted: G L syzkaller #0 [ 480.993486][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 481.002830][ T31] task:kworker/1:5 state:D stack:21880 pid:5698 tgid:5698 ppid:2 task_flags:0x4288060 flags:0x00080000 [ 481.015396][ T31] Workqueue: usb_hub_wq hub_event [ 481.023517][ T31] Call Trace: [ 481.029935][ T31] [ 481.035601][ T31] __schedule+0x1821/0x5740 [ 481.046147][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 481.057255][ T31] ? __pfx___schedule+0x10/0x10 [ 481.067002][ T31] ? schedule+0x90/0x360 [ 481.076543][ T31] schedule+0x164/0x360 [ 481.083206][ T31] schedule_timeout+0xc3/0x2c0 [ 481.083806][T12087] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1954'. [ 481.091515][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 481.102986][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 481.111199][T12087] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1954'. [ 481.120436][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 481.125798][ T31] ? wait_for_completion+0x274/0x5e0 [ 481.133633][ T31] wait_for_completion+0x2cc/0x5e0 [ 481.144268][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 481.155703][ T31] i2c_del_adapter+0x5c0/0x790 [ 481.166245][ T31] ? kasan_quarantine_put+0xbb/0x1f0 [ 481.176345][ T5711] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 481.178301][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 481.200462][T12069] netlink: 63 bytes leftover after parsing attributes in process `syz.1.1947'. [ 481.202484][ T5711] em28xx 2-1:0.0: board has no eeprom [ 481.215223][ T31] ? kfree+0x1c5/0x640 [ 481.225027][ T31] ? em28xx_release_resources+0xde/0x240 [ 481.233489][ T31] em28xx_i2c_unregister+0x4b/0x60 [ 481.238994][ T31] em28xx_release_resources+0x13b/0x240 [ 481.245070][ T31] em28xx_usb_disconnect+0x19f/0x2f0 [ 481.250828][ T31] usb_unbind_interface+0x26e/0x910 [ 481.256282][ T31] ? kernfs_remove_by_name_ns+0x101/0x140 [ 481.275872][ T31] ? __pfx_usb_unbind_interface+0x10/0x10 [ 481.286468][ T31] device_release_driver_internal+0x4d9/0x870 [ 481.294707][ T31] bus_remove_device+0x455/0x570 [ 481.300139][ T31] ? __pfx_bus_remove_device+0x10/0x10 [ 481.305752][ T31] ? kernfs_remove_by_name_ns+0x101/0x140 [ 481.314640][ T31] device_del+0x527/0x8f0 [ 481.320229][ T31] ? __pfx_device_del+0x10/0x10 [ 481.325390][ T31] ? kobject_put+0x51d/0x560 [ 481.330783][ T31] usb_disable_device+0x3d4/0x8d0 [ 481.336013][ T31] usb_disconnect+0x32f/0x990 [ 481.336864][ T5711] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 481.341247][ T31] hub_event+0x1cc9/0x4f30 [ 481.361737][ T5711] em28xx 2-1:0.0: dvb set to bulk mode. [ 481.364142][ T31] ? do_raw_spin_unlock+0xf5/0x210 [ 481.372842][ T31] ? __pfx_hub_event+0x10/0x10 [ 481.376742][ T6938] em28xx 2-1:0.0: Binding DVB extension [ 481.380413][ T31] ? process_scheduled_works+0xa70/0x1860 [ 481.389760][ T31] ? process_scheduled_works+0xa70/0x1860 [ 481.406707][ T31] ? process_scheduled_works+0xa70/0x1860 [ 481.411234][ T5711] usb 2-1: USB disconnect, device number 3 [ 481.420833][ T31] process_scheduled_works+0xb5d/0x1860 [ 481.427992][ T5711] em28xx 2-1:0.0: Disconnecting em28xx [ 481.434149][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 481.446948][ T31] ? assign_work+0x3d5/0x5e0 [ 481.456753][ T31] worker_thread+0xa53/0xfc0 [ 481.463271][ T31] kthread+0x389/0x470 [ 481.467517][ T31] ? __pfx_worker_thread+0x10/0x10 [ 481.472816][ T31] ? __pfx_kthread+0x10/0x10 [ 481.473557][ T6938] em28xx 2-1:0.0: Registering input extension [ 481.477576][ T31] ret_from_fork+0x514/0xb70 [ 481.489146][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 481.489776][ T5711] em28xx 2-1:0.0: Closing input extension [ 481.494307][ T31] ? load_gs_index+0x97/0xc0 [ 481.494339][ T31] ? __switch_to+0xc79/0x1410 [ 481.494370][ T31] ? __pfx_kthread+0x10/0x10 [ 481.514939][ T31] ret_from_fork_asm+0x1a/0x30 [ 481.520051][ T31] [ 481.528936][ T31] [ 481.528936][ T31] Showing all locks held in the system: [ 481.538156][ T5711] em28xx 2-1:0.0: Freeing device [ 481.543332][ T31] 1 lock held by khungtaskd/31: [ 481.548469][ T31] #0: ffffffff8e95cd20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 481.558788][ T31] 2 locks held by klogd/4988: [ 481.563690][ T31] 2 locks held by getty/5388: [ 481.568716][ T31] #0: ffff8880361400a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 481.579131][ T31] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 481.589771][ T31] 6 locks held by kworker/1:5/5698: [ 481.595126][ T31] #0: ffff88801eaad140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 481.607099][ T31] #1: ffffc900045efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 481.619421][ T31] #2: ffff888029d711d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 481.628547][ T31] #3: ffff88804658e1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xf8/0x990 [ 481.638183][ T31] #4: ffff888032bb21a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 [ 481.649656][ T31] #5: ffff88807ff59cf0 (&dev->lock#3){+.+.}-{4:4}, at: em28xx_release_resources+0x75/0x240 [ 481.660278][ T31] 3 locks held by kworker/0:4/5711: [ 481.665684][ T31] #0: ffff88801eaad140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 481.677324][ T31] #1: ffffc90004defc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 481.690235][ T31] #2: ffff88802a0341d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 481.699370][ T31] 4 locks held by udevd/6965: [ 481.725313][ T31] #0: ffff888034847998 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 [ 481.738223][ T31] #1: ffff888031b19080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 [ 481.749665][ T31] #2: ffff888042f5fb48 (kn->active#31){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 481.760659][ T31] #3: ffff88804658e1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 481.771190][ T31] 2 locks held by syz.4.1938/12048: [ 481.776437][ T31] #0: ffff88807870c740 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 481.786982][ T31] #1: ffffffff8e963028 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 481.799013][ T31] [ 481.801866][ T31] ============================================= [ 481.801866][ T31] [ 481.818897][ T31] NMI backtrace for cpu 1 [ 481.818916][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 481.818941][ T31] Tainted: [L]=SOFTLOCKUP [ 481.818948][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 481.818959][ T31] Call Trace: [ 481.818967][ T31] [ 481.818975][ T31] dump_stack_lvl+0xe8/0x150 [ 481.819001][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 481.819028][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 481.819074][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 481.819103][ T31] sys_info+0x135/0x170 [ 481.819166][ T31] watchdog+0xfd3/0x1030 [ 481.819209][ T31] ? watchdog+0x1c9/0x1030 [ 481.819239][ T31] kthread+0x389/0x470 [ 481.819263][ T31] ? __pfx_watchdog+0x10/0x10 [ 481.819287][ T31] ? __pfx_kthread+0x10/0x10 [ 481.819310][ T31] ret_from_fork+0x514/0xb70 [ 481.819332][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 481.819351][ T31] ? __switch_to+0xc79/0x1410 [ 481.819380][ T31] ? __pfx_kthread+0x10/0x10 [ 481.819404][ T31] ret_from_fork_asm+0x1a/0x30 [ 481.819439][ T31] [ 481.819447][ T31] Sending NMI from CPU 1 to CPUs 0: [ 481.940074][ C0] NMI backtrace for cpu 0 [ 481.940092][ C0] CPU: 0 UID: 0 PID: 10322 Comm: kworker/u8:5 Tainted: G L syzkaller #0 PREEMPT(full) [ 481.940114][ C0] Tainted: [L]=SOFTLOCKUP [ 481.940120][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 481.940130][ C0] Workqueue: krds_cp_wq#4/0 rds_connect_worker [ 481.940236][ C0] RIP: 0010:unwind_next_frame+0x534/0x2550 [ 481.940258][ C0] Code: 0f b6 04 08 84 c0 75 27 49 63 07 4c 01 f8 49 8d 4f 04 4c 39 e0 48 0f 46 e9 49 8d 47 fc 48 0f 47 d8 4d 0f 46 ef 48 39 dd 76 a2 7b fd ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 7c cc 4c 89 ff 48 [ 481.940271][ C0] RSP: 0018:ffffc9001bc2f378 EFLAGS: 00000202 [ 481.940283][ C0] RAX: ffffffff90a1edf0 RBX: ffffffff90a1edf4 RCX: ffffffff90a1edf8 [ 481.940295][ C0] RDX: ffffffff90a1edf4 RSI: ffffffff914a3980 RDI: ffffffff8c28b980 [ 481.940306][ C0] RBP: ffffffff90a1edf8 R08: 0000000000000003 R09: ffffffff8e95cd20 [ 481.940317][ C0] R10: ffffc9001bc2f498 R11: ffffffff81b0e210 R12: ffffffff89724ab1 [ 481.940328][ C0] R13: ffffffff90a1edf4 R14: ffffc9001bc2f448 R15: ffffffff90a1edf4 [ 481.940340][ C0] FS: 0000000000000000(0000) GS:ffff8881252a0000(0000) knlGS:0000000000000000 [ 481.940373][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 481.940384][ C0] CR2: 000055b8a5a5ec78 CR3: 000000001cbe4000 CR4: 00000000003526f0 [ 481.940398][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 481.940408][ C0] DR3: 00000000fee0000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 481.940419][ C0] Call Trace: [ 481.940425][ C0] [ 481.940435][ C0] ? unwind_next_frame+0xa6/0x2550 [ 481.940455][ C0] ? __sk_destruct+0x702/0x9d0 [ 481.940503][ C0] ? __sk_destruct+0x702/0x9d0 [ 481.940518][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 481.940549][ C0] arch_stack_walk+0x11b/0x150 [ 481.940570][ C0] ? __sk_destruct+0x702/0x9d0 [ 481.940587][ C0] stack_trace_save+0xa9/0x100 [ 481.940609][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 481.940635][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 481.940651][ C0] kasan_save_track+0x3e/0x80 [ 481.940673][ C0] ? kasan_save_track+0x3e/0x80 [ 481.940692][ C0] ? kasan_save_free_info+0x46/0x50 [ 481.940710][ C0] ? __kasan_slab_free+0x5c/0x80 [ 481.940731][ C0] ? kfree+0x1c5/0x640 [ 481.940748][ C0] ? security_sk_free+0xa4/0x180 [ 481.940819][ C0] ? __sk_destruct+0x702/0x9d0 [ 481.940855][ C0] kasan_save_free_info+0x46/0x50 [ 481.940873][ C0] __kasan_slab_free+0x5c/0x80 [ 481.940895][ C0] kfree+0x1c5/0x640 [ 481.940913][ C0] ? security_sk_free+0xa4/0x180 [ 481.940932][ C0] security_sk_free+0xa4/0x180 [ 481.940949][ C0] __sk_destruct+0x702/0x9d0 [ 481.940966][ C0] inet_release+0x143/0x190 [ 481.941027][ C0] sock_release+0x85/0x150 [ 481.941064][ C0] rds_tcp_conn_path_connect+0x78c/0x930 [ 481.941139][ C0] ? __pfx_rds_tcp_conn_path_connect+0x10/0x10 [ 481.941163][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 481.941190][ C0] ? process_scheduled_works+0xa70/0x1860 [ 481.941208][ C0] ? process_scheduled_works+0xa70/0x1860 [ 481.941230][ C0] rds_connect_worker+0x1d8/0x290 [ 481.941250][ C0] ? process_scheduled_works+0xa70/0x1860 [ 481.941269][ C0] process_scheduled_works+0xb5d/0x1860 [ 481.941300][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 481.941321][ C0] ? assign_work+0x3d5/0x5e0 [ 481.941340][ C0] worker_thread+0xa53/0xfc0 [ 481.941368][ C0] kthread+0x389/0x470 [ 481.941386][ C0] ? __pfx_worker_thread+0x10/0x10 [ 481.941400][ C0] ? __pfx_kthread+0x10/0x10 [ 481.941419][ C0] ret_from_fork+0x514/0xb70 [ 481.941435][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 481.941448][ C0] ? load_gs_index+0x97/0xc0 [ 481.941469][ C0] ? __switch_to+0xc79/0x1410 [ 481.941490][ C0] ? __pfx_kthread+0x10/0x10 [ 481.941514][ C0] ret_from_fork_asm+0x1a/0x30 [ 481.941539][ C0] [ 482.331249][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 482.338154][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 482.348856][ T31] Tainted: [L]=SOFTLOCKUP [ 482.353199][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 482.363297][ T31] Call Trace: [ 482.366591][ T31] [ 482.369534][ T31] vpanic+0x56c/0xa60 [ 482.373525][ T31] ? __pfx___schedule+0x10/0x10 [ 482.378378][ T31] ? __pfx_vpanic+0x10/0x10 [ 482.382881][ T31] ? nmi_trigger_cpumask_backtrace+0x1f4/0x300 [ 482.389074][ T31] panic+0xc5/0xd0 [ 482.392810][ T31] ? __pfx_panic+0x10/0x10 [ 482.397235][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 482.402634][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 482.408800][ T31] watchdog+0x102c/0x1030 [ 482.413162][ T31] ? watchdog+0x1c9/0x1030 [ 482.417583][ T31] kthread+0x389/0x470 [ 482.421657][ T31] ? __pfx_watchdog+0x10/0x10 [ 482.426328][ T31] ? __pfx_kthread+0x10/0x10 [ 482.430913][ T31] ret_from_fork+0x514/0xb70 [ 482.435504][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 482.440622][ T31] ? __switch_to+0xc79/0x1410 [ 482.445327][ T31] ? __pfx_kthread+0x10/0x10 [ 482.449973][ T31] ret_from_fork_asm+0x1a/0x30 [ 482.454780][ T31] [ 482.458445][ T31] Kernel Offset: disabled [ 482.462784][ T31] Rebooting in 86400 seconds..