last executing test programs: 16.734905546s ago: executing program 4 (id=9551): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@local, 0x800, 0x0, 0x103, 0x9}, 0x20) sendmsg$inet6(r0, &(0x7f0000000340)={&(0x7f0000000380)={0xa, 0x4e1e, 0x80000, @mcast2, 0x8}, 0x1c, 0x0, 0x0, &(0x7f00000000c0)=[@hoplimit={{0x10, 0x29, 0x34, 0xfffffffd}}], 0x10}, 0x4894) 16.597846689s ago: executing program 4 (id=9552): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)={0x20, r0, 0x100, 0x0, 0x0, {{0x67}, {@val={0x8}, @val={0x0, 0x99, {0x81f, 0x59}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0xffff, 0x0, 0x7, 0x8}, {0x12, 0x3, 0x0, 0x1, 0x1, 0x400}, 0xa5, 0x4, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0xd0f, 0x40000000, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xf}, {0xd, 0xa}, {0x6, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x2006, 0x10000, 0x647a4d08, 0x0, 0x1}, 0x1, 0x0, 0x8, 0x3, 0x88a, 0x9, 0x8e, 0x1b, 0x3, 0xff, {0x4415, 0xfffffffe, 0x2000800, 0x5, 0x4, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20004081}, 0x4000) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000e40)={@multicast1}, &(0x7f0000000e80)=0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000ec0)={'batadv0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000f00)={'veth1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000fc0)={'ip6tnl0\x00', &(0x7f0000000f40)={'ip6tnl0\x00', 0x0, 0x4, 0x0, 0x9, 0x7ff, 0x2, @remote, @dev={0xfe, 0x80, '\x00', 0xa}, 0x717, 0x80, 0x0, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000001080)={'syztnl1\x00', &(0x7f0000001000)={'ip6_vti0\x00', 0x0, 0x4, 0x5, 0x3, 0xf8, 0x49, @remote, @mcast1, 0x20, 0x7, 0x6, 0x1}}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) symlink(&(0x7f0000000100)='./bus/\x00', &(0x7f0000000140)='./bus\x00') openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./bus//file0\x00', 0x40002, 0x40) sendmsg$NL80211_CMD_GET_COALESCE(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r9, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r10, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32], 0x3c}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001240)=@newtfilter={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r10, {0x7}, {0x1, 0x1}, {0xa, 0x1}}, [@TCA_RATE={0x6, 0x5, {0xc9, 0x8}}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc084) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f0000001340)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001380)=ANY=[@ANYBLOB="b0010000", @ANYRES16=0x0, @ANYBLOB="02002cbd7000fddbdf250b0000002000018008000100", @ANYRES32=r5, @ANYBLOB="14000200776731000000000000000000000000007000018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="1400020069705f76746930000000000000000000140002006261746164765f736c6176655f30000008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468315f746f5f626f6e6400000008000100", @ANYRES32=0x0, @ANYBLOB="080003000000000030000180140002006361696630000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="080003000000000008000100", @ANYRES32=0x0, @ANYBLOB="6400018014000200766574683000000000000000000000001400020076657468315f746f5f6261746164760008000100", @ANYRES32=r3, @ANYBLOB="1400020067656e6576653100000000000000000014000200626f6e6430000000000000000000000008000100", @ANYRES32=r4, @ANYBLOB="2400018008000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="080003000100000008000300030000005400018008000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="1400020073797a6b616c6c6572310000000000000800010048800df6f2cd5aac4ecf5e2de5c20593ef0005b9ad6dbc0e428b0f7fbf13a3a0477a559ea5b816fe69b4f003eda62ef00d4d86b77645cdbf3b7a20e34e30d870a3f311147ee8869de06281c5789f01792f7f1e48de4fbc20d42e4066e2f48ef7ce9cbc06abb6ede5e7add0d68599a254ac68c8712f297e80ec88431c0025568030f70f7ac02d390679a206e9aaf5ed6e500882d7e8c83aea1527453671a524b8cec8f9997766e9a21536a9b80df84e7a42040c1a3f533105cc1f800472af4dde8936095c1137d6f347f753b0bfa4e59d098173e2bca83e007a87098db395afdb3ae4e60984de00000000000000", @ANYRES32=0x0, @ANYBLOB="140002006772657461703000000000000000000008000100", @ANYRES32=r10, @ANYBLOB="0800030003000000"], 0x1b0}, 0x1, 0x0, 0x0, 0xc081}, 0x800) r11 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000bc0)={'syztnl0\x00', &(0x7f0000000b80)={'gre0\x00', r10, 0x7800, 0x1, 0x1, 0x1, {{0x5, 0x4, 0x1, 0x9, 0x14, 0x64, 0x0, 0xcd, 0x2b, 0x0, @multicast1, @local}}}}) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000240)="b805000000090200e1490000320f01d9660ff7e31bf7ec05000000b90000c0fe0fae41d90100b9800000c00f3209083667dbd20f300f0826f30fc7b205000000660fc775022e0ffa600c980f320f3566b85700", 0x53}], 0x1, 0x17, 0x0, 0x0) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r11, r2, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r12, 0x4048ae9b, &(0x7f0000000080)={0xe0003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x80083, 0xffffffffefffff16, 0x3, 0x400000004, 0x1, 0x4]}}) ioctl$KVM_RUN(r12, 0xae80, 0x0) socket$kcm(0x29, 0x2, 0x0) 15.564465634s ago: executing program 4 (id=9555): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYRESOCT], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 15.535581308s ago: executing program 4 (id=9556): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x80000, {0x0, 0x0, 0x0, r6, {}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x3, 0x9, 0x7356, 0x5, 0x5}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000c061}, 0x200c000) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r7 = socket$netlink(0x10, 0x3, 0xf) sendmsg$nl_route_sched(r7, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000002f00)={&(0x7f0000002f80)=@deltclass={0x24, 0x29, 0x1, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xd, 0x3}, {0x2, 0x8}, {0xf, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x44080}, 0x80) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f0000000240)={0x0, 0x107000}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) dup(0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x679, @dev={0xfe, 0x80, '\x00', 0x3a}, 0x1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f40)=ANY=[@ANYBLOB="200000002900000032000000fe80000000"], 0x20}}], 0x2, 0x1000) 15.387147245s ago: executing program 4 (id=9557): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@bridge_delneigh={0x28, 0x1c, 0x1, 0x4, 0x0, {0x7, 0x0, 0x0, r1, 0x80, 0xf2, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}]}, 0x28}, 0x1, 0x1000000}, 0x0) (fail_nth: 5) 15.318784884s ago: executing program 4 (id=9558): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x3a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) r1 = socket$inet6(0xa, 0x80002, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xfff2}, {0xfff3}}}, 0x24}}, 0x0) (fail_nth: 11) 8.274010678s ago: executing program 0 (id=9595): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x440, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000010000d042abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000040000000240012800c0001006d6163766c616e0014000280080001000200000008000300000014"], 0x58}, 0x1, 0x0, 0x0, 0x91}, 0x8000) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x10001, 0x0, 0xdddd1000, 0x1000, &(0x7f000059e000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f00002b2000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(0xffffffffffffffff, 0x4048ae9b, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x18, &(0x7f0000000180)={0x40, 0xb, 0x3d, {0x3d, 0x3d, "52a2c4b0c5404e1783bc4df5c4ea336a2edcae439c9f71c89c4b6b53c9730129900d0686c2505f0adb9bfade33079229457545e605870adf0a4621"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x418}}, &(0x7f0000000240)={0x0, 0xf, 0x24, {0x5, 0xf, 0x24, 0x2, [@ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x2, 0xf0f, 0xfe00, [0xff0000, 0xf, 0x3f00]}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x0, 0xb, 0x5}]}}, 0x0, &(0x7f0000000340)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf, 0x8, 0x4, 0x40, 0x8, 0x6, 0xff01}}}, &(0x7f0000000980)={0x44, &(0x7f0000000440)={0x0, 0xb, 0xe1, "c3975181270fb9f6841c41ec5d561960fbc6b67cb1ebd6b946f60480f620922eded802153e4dfb84ddd1840d8429385cc51521aa60947fb6c7d94c8ed09eb974f2b543b45ef0965b9d188b85f7fa5f322b18b27a06912b4af140ee0a436a825e4dbc9baae033c1322ce78fe278b47382307688951a83e56b4d8a7ccf390ff87fac0909cfe74a441973354e84f1aa0f065ca4d003515894214101077735322336fbff8776ad81b988337ba806fadceb5d809201981330a96d4fae99b0256da859e9086b028f512815d3912b4f2efe8facdc8658ef98cfadf846d80437dcf2917cae"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x10}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x4, 0x1}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xf}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "cc63"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0xb}, &(0x7f0000000740)={0x40, 0x13, 0x6, @multicast}, 0x0, &(0x7f0000000840)={0x40, 0x19, 0x2, '(.'}, &(0x7f0000000880)={0x40, 0x1a, 0x2, 0xfffa}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x3}}) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000000)={&(0x7f0000000380)=[{0x1, 0xc401, 0x4f, &(0x7f0000000780)="2fa4aaca555c80e980979899f7a2e96c76e007198cf35a3e86a08a361ab693d4b578c5ca80b3dcebae4a9ec3d2084a95f036c2dab0a8e13b7f4757b2a22bf27639286b466ddcf6b2cae2a5a1d1fe21"}], 0x1}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 7.794401787s ago: executing program 1 (id=9596): openat$vcs(0xffffffffffffff9c, &(0x7f0000000580), 0x200a00, 0x0) r0 = syz_usb_connect_ath9k(0x3, 0xb3, &(0x7f0000000400)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x38e38e38e38dfe6, [{{0x9, 0x2, 0xfffffffffffffe98}}]}}, 0x0) syz_usb_connect(0x0, 0x6d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003cda2a200a111022"], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[], 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x2000) ioctl$SNDRV_PCM_IOCTL_UNLINK(r1, 0x40044160, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r2, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = socket(0x2d, 0x2, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x11d, 0x1b, 0x0, 0x0) setsockopt$inet6_int(r4, 0x29, 0x19, &(0x7f0000000080)=0x3, 0x4) ioctl$F2FS_IOC_GARBAGE_COLLECT(r3, 0x4004f506, &(0x7f0000000140)) syz_emit_ethernet(0x214, &(0x7f00000005c0)={@random="e33110495bfd", @empty, @void, {@mpls_mc={0x8848, {[{0x3, 0x0, 0x1}, {0x6}, {0x400}, {}, {}], @ipv6=@dccp_packet={0x6, 0x6, "ed8ed2", 0x1ca, 0x21, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @mcast2, {[@hopopts={0x2f, 0x4, '\x00', [@enc_lim={0x4, 0x1, 0x1}, @generic={0x27, 0x1c, "c1f151f5b71fc3fcb8c3e87e6b5cefa12dcd76e0361f7dd7ebca4fe1"}, @pad1, @enc_lim={0x4, 0x1, 0xbe}]}, @hopopts={0x2c, 0x24, '\x00', [@generic={0x8, 0xe0, "c67f06481cd4343e0c36092ee226d9cd20533165b0ed6b56fcc7861e7063561258b3125242d0bc57355d7c9735edc06d528f03826b890520f106e34050795a7b0febdc92227ead98cbf0456bc778e1d957f913ade7e7ca559e98cbd93cb760db51e0908bd5b8ff03cb84d503749d50d53a0eaeafd8e53e35c37d29de3cede335776b4463bb8be9e318f76caaee8369332cefe19493cac4dd381eaaed36e0f7a910389dec0926a70ff3a83da8bd04308fdd00af048df5ef74f64cf4a2dfe7216c8e25317445ac89e2c8fc219efa59fa2aafde75c5393a6f350fc34cdfdcead66a"}, @generic={0x0, 0x1a, "fb2e093129ed3b7a8a53116c28967aba7093b896ad0400b1815a"}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @private0}, @ra={0x5, 0x2, 0x5}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x2}]}, @hopopts={0x2e, 0x3, '\x00', [@padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @padn={0x1, 0x2, [0x0, 0x0]}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @pad1, @ra={0x5, 0x2, 0x1ff}]}], {{0x4e21, 0x4e22, 0x4, 0x1, 0x5, 0x0, 0x0, 0x2, 0x3, "53c2e8", 0x5, "86a603"}, "ef1dfba715b109be4aec93d78500f7ac2bd645803314b84e08d7525d45aa44058a9b436ffb4aaf5d51f94ebe25ff48190131"}}}}}}}, 0x0) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x400000000000247, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000ec0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x8800}}], 0x2, 0x0) close(r2) 7.597210255s ago: executing program 2 (id=9597): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000780)={@val={0x0, 0x86dd}, @val={0x2, 0x3, 0x5, 0xfdcd, 0xa, 0x40}, @mpls={[], @ipv6=@generic={0x8, 0x6, "3739ed", 0x28, 0x89, 0xff, @local, @mcast2, {[], "59c0ac5a142dbdbec6b7f2b65327cfd00f8bd3acba38414fcc35f63d64902ea8bb580250f9fdb4ec"}}}}, 0xfdef) 7.406389811s ago: executing program 2 (id=9599): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_usb_connect(0x3, 0x24f, &(0x7f00000006c0)=ANY=[@ANYBLOB="12011001088c2608da0400252e830102030109023d0202050400040904b901053830c6070a24060001a90ac29f2c0524005b060d240f0103000000060006000806241a0800000a240101800f00020102052404050b09050500100009000e09050b000800040a51990d81a64188800c4eb1ca04366e7f37650bbb4894ec218fa5fc70064bd9d052d8a786250af48210d425a4a3c70dea3367303ec213a20b24afa8baad8b8c830c83778b38d6ec3cd7f67d5a108644ce83f4ee891ab73f5639f9bbb77584d14b7bb17506f3313d6bd0831983e913559538718ad1d6ab3ed480767053ee209077486c28163c3e84dadbcf31ed83e9a157864f31ef066fbc6a906e09050c0300001cab03090503002000091804a6317ee0f5695289ab2a3d301933ac7b06d4d4012a23743e9c10392c39fe9e0ab882ae492162a2bcfb4be2728783884e0e10cf60b3a9a27c0e08f5342361c151a34c5fb44dbe28ba732af70bc8fdd4c76459b690be00d69e3d4469c2023329a279894bb97de26c0840e1b8f6e3e51889e39727789a166776c54d93f7b6a50b1c1fed56f566563b9885d2f9df8203df40c58daaea79f1e06c30c9bb6c2c5aaf6df8942bf7581ad28eb53b0606b487abc0ea168b40a5b3ce864d04e2edb4c2358c530e04d9bd4c68a11347e5e2982f993e7a533db1426ba81fa0c7b361ef806131560769daaad6f1f35c6fc1dac569af922e197128ecfd33f9c35f07639335fabae236840925011000040180040904d7a002ed6293180905030300023b040909050b00100008810807250100060c00"], &(0x7f0000000b00)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x400, 0x2, 0xa3, 0x7, 0xff, 0x5}, 0x101, &(0x7f00000004c0)={0x5, 0xf, 0x101, 0x3, [@generic={0xd5, 0x10, 0x4, "39242ccbcff5eec4d1af0424135c81402896101aa2817ff8a99d7e1ea5192fb0cdc38e5c45c367c135e160087897a867c368ba14286d75e1b98579dc9e51f1dfc6ed572a25fa4a782e330ead3f84b6c41af4dc24a64cd37292d0fbb88b1424c9fe22551caf14bdd21be179137175903ee90c90ce4ba3ea9dd2c19c84f616fe23fb43126ef19ccad9fdeb7a596e5f6f1adc0ca28d1680e4a8093cb5a158653b25882fa50b463041a8e98c37b25f274c13ff3d42d92349823f9a4f8a7c274205e2db97ee55ecdb85efee74a20d16b6a5eb365a"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x50, 0x5, 0x2, 0xa8a, 0xe0}, @ssp_cap={0x1c, 0x10, 0xa, 0x5, 0x4, 0x8000, 0xf, 0xc, [0xc00f, 0x30, 0x6000, 0xf]}]}, 0x9, [{0x1a, &(0x7f00000003c0)=@string={0x1a, 0x3, "c8eba30235c789539aeab992f30ed339c3549488f28270c0"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x4e}}, {0x1c, &(0x7f0000000600)=@string={0x1c, 0x3, "19c34f013453a1ff6ea889014814f361809ea47f09452392643d"}}, {0xa3, &(0x7f0000000940)=@string={0xa3, 0x3, "4ac4d25824185dd17d19debfb38f181d01f66b0b67eaa3e44d195fb3a07af1b441add1ded9d56f7e34adc65e190e0367e2cbb2f052731b624a310a9c7942b4b71d9bb5fc2cabd1c850f69413830aef0efa22a0aeb25058191e30c1b41bb0f0fb8f13623089874e187417d0a160388751985387f98931d68807b4b7f5d61eb1c52e4314910a2c686f78fb3921d59c5d520f2d8d1b38b6e4e1cbaac82f8d7977bb74"}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x100a}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x402}}, {0x2, &(0x7f0000000a40)=ANY=[@ANYBLOB='\v\x00']}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x40f}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x40b}}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r2, 0x89a2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000b80)={0x0, @in6={{0xa, 0x4e21, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4}}, 0x101, 0x5, 0x2800000, 0xb, 0x10}, &(0x7f0000000c40)=0x98) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000001d80)={r4, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xfff, 0x2, 0x0, 0x2, 0x3b2, 0x94}, 0x9c) shutdown(r3, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000380)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0218000e0b0000000000fbdbdf25040018007fe61600eca0b4157cacb3f1f6dfca15a6c9fba858324f148b3a000005001a0000000000f40000000000fffffffffffffc02000000000000000000000000000029001010"], 0x58}}, 0x40040) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r6) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x10, &(0x7f0000000900)=[@in={0x2, 0x4e23, @private=0xa010100}]}, &(0x7f0000000100)=0xc) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, 0x0, &(0x7f0000002280)='//\xf2b\x06\b\xba\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b///\x00\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x97\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8DD\x9bp\x01\xcc:\xa6\xc5n\x9f\xfb\x81 \x10\x0fQ\x90}Zd\xeb\xab\xf70\x99\xef\x8b0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x80000, {0x0, 0x0, 0x0, r5, {}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x3, 0x9, 0x7356, 0x5, 0x5}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000c061}, 0x200c000) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = socket$netlink(0x10, 0x3, 0xf) sendmsg$nl_route_sched(r6, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000002f00)={&(0x7f0000002f80)=@deltclass={0x24, 0x29, 0x1, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xd, 0x3}, {0x2, 0x8}, {0xf, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x44080}, 0x80) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f0000000240)={0x0, 0x107000}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) dup(0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x679, @dev={0xfe, 0x80, '\x00', 0x3a}, 0x1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f40)=ANY=[@ANYBLOB="200000002900000032000000fe80000000"], 0x20}}], 0x2, 0x1000) 6.963433582s ago: executing program 0 (id=9601): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe800000", @ANYRESOCT], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 6.754107639s ago: executing program 0 (id=9602): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e13d6a206419010015d40102030109"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) syz_usb_control_io(r0, &(0x7f00000003c0)={0x18, &(0x7f0000000180)={0x40, 0xb, 0x3d, {0x3d, 0x3d, "52a2c4b0c5404e1783bc4df5c4ea336a2edcae439c9f71c89c4b6b53c9730129900d0686c2505f0adb9bfade33079229457545e605870adf0a4621"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x418}}, &(0x7f0000000240)={0x0, 0xf, 0x24, {0x5, 0xf, 0x24, 0x2, [@ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x2, 0xf0f, 0xfe00, [0xff0000, 0xf, 0x3f00]}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x0, 0xb, 0x5}]}}, 0x0, &(0x7f0000000340)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf, 0x8, 0x4, 0x40, 0x8, 0x6, 0xff01}}}, &(0x7f0000000980)={0x44, &(0x7f0000000440)={0x0, 0xb, 0xe1, "c3975181270fb9f6841c41ec5d561960fbc6b67cb1ebd6b946f60480f620922eded802153e4dfb84ddd1840d8429385cc51521aa60947fb6c7d94c8ed09eb974f2b543b45ef0965b9d188b85f7fa5f322b18b27a06912b4af140ee0a436a825e4dbc9baae033c1322ce78fe278b47382307688951a83e56b4d8a7ccf390ff87fac0909cfe74a441973354e84f1aa0f065ca4d003515894214101077735322336fbff8776ad81b988337ba806fadceb5d809201981330a96d4fae99b0256da859e9086b028f512815d3912b4f2efe8facdc8658ef98cfadf846d80437dcf2917cae"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x10}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x4, 0x1}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xf}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "cc63"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0xb}, &(0x7f0000000740)={0x40, 0x13, 0x6, @multicast}, 0x0, &(0x7f0000000840)={0x40, 0x19, 0x2, '(.'}, &(0x7f0000000880)={0x40, 0x1a, 0x2, 0xfffa}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x3}}) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000000)={&(0x7f0000000380)=[{0x1, 0xc401, 0x4f, &(0x7f0000000780)="2fa4aaca555c80e980979899f7a2e96c76e007198cf35a3e86a08a361ab693d4b578c5ca80b3dcebae4a9ec3d2084a95f036c2dab0a8e13b7f4757b2a22bf27639286b466ddcf6b2cae2a5a1d1fe21"}], 0x1}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 6.732307412s ago: executing program 3 (id=9603): syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, 0x0, 0x0) r1 = socket$kcm(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bond_slave_0\x00', 0x10) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @broadcast}, 0x10) r2 = socket$kcm(0x2, 0x2, 0x73) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x12) ioctl$UI_SET_SNDBIT(r5, 0x4004556a, 0x1) ioctl$UI_DEV_CREATE(r5, 0x5501) write$uinput_user_dev(r4, &(0x7f00000004c0)={'syz0\x00', {0x7, 0x3, 0x1, 0x9}, 0x7, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0xc1f, 0x1, 0x7f5d, 0x3, 0x6, 0x5, 0x10000, 0x2, 0x3, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x3, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x0, 0xf, 0xcc, 0x5, 0x80, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x4, 0x80000000, 0x1, 0x9, 0x7, 0x0, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x5, 0x1000002, 0x8], [0x2, 0x1, 0x10000, 0x7, 0x9, 0x2, 0x5, 0x4, 0x9, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x7, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0x5, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x5, 0x5, 0xfffffb66, 0xfb5, 0x2, 0x4, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x8, 0x6f, 0x80b, 0x1, 0x6, 0x525ba681, 0x4f74, 0x7, 0x1, 0x1, 0x8, 0x100, 0x6, 0x10000, 0x1306, 0x8b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x40, 0x4, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0xc, 0x8, 0x7fffffff, 0x1, 0x1, 0x4, 0x8, 0xfffffffa, 0x7, 0x9, 0x6, 0x4, 0xfffffff7, 0xa3, 0x3, 0x0, 0x0, 0x3, 0x4e, 0x3, 0x5, 0x2, 0x0, 0x9, 0x13, 0x0, 0x2, 0xfff, 0x6, 0x100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x6, 0x47, 0xfa1, 0x0, 0x11, 0x3, 0xffd, 0x7, 0x7, 0x8000, 0x7ff, 0x10, 0x2, 0x10001, 0x1, 0x0, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x3, 0x40, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x9, 0x5, 0x5, 0xa, 0x79a, 0x40, 0x9, 0x9, 0xc41f, 0x80000001, 0x6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x53, 0x78d, 0x4, 0x1, 0xffffb027, 0xfffffff8, 0x9, 0x7, 0x6, 0x101, 0x7, 0x7, 0x4, 0x0, 0xb, 0x400, 0x8, 0x0, 0x8, 0x7, 0x9a33247, 0x8, 0x0, 0x1, 0x808001, 0xfffffff7, 0x5]}, 0x45c) read$hiddev(r5, &(0x7f0000000040)=""/117, 0x75) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='veth1\x00', 0x10) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x10) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8920, &(0x7f0000001140)={'veth1_vlan\x00', @remote}) r6 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x6) fcntl$addseals(r6, 0x409, 0xa) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x200000d, 0x11, r6, 0xffffd000) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000140)=@req3={0x4, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r8, &(0x7f0000000b00)={'syz0\x00', {0x5, 0x7, 0x3, 0x7}, 0x3e, [0x2, 0x9, 0x0, 0x1, 0xc, 0xea45, 0xd, 0x1, 0x0, 0x0, 0x800008, 0xc, 0x3, 0x0, 0x1, 0xb, 0x3, 0x7fffffff, 0x51, 0x5, 0x803, 0xfffffffa, 0x3ff, 0x2, 0x9, 0xffffffff, 0x3, 0x0, 0x8, 0x6, 0x9, 0x7, 0x9, 0x4, 0x8000, 0x1, 0x5, 0x4, 0x10000, 0x4, 0xa, 0x8, 0x0, 0x8, 0x0, 0x2, 0xffff, 0x6, 0x939, 0x5, 0x9, 0x2, 0x4f, 0x40004, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x2, 0x56f00ca9, 0x5, 0x2a, 0x1, 0x22], [0x1, 0x9, 0x9, 0x1, 0x5, 0xe, 0x800, 0xc, 0xfffffffa, 0x2329, 0xfd8, 0x1, 0x5, 0x5, 0x0, 0x24e, 0x1, 0xfffffff7, 0x2, 0x3, 0x5, 0x9, 0x82, 0x4000008, 0x1, 0x40, 0xa3, 0x8, 0xffffffff, 0x5, 0x10000, 0x1, 0xffffff00, 0x7ff, 0x26, 0x7, 0x0, 0xa9, 0x101, 0x10, 0x2, 0x7, 0x7, 0x8, 0x5, 0x8000, 0x800, 0x5, 0xc5, 0x6, 0x1, 0x9, 0x8, 0x3, 0xfffffff7, 0x3, 0x24b, 0x1fd, 0x2a0, 0x5, 0x6, 0x8, 0x7, 0x80000007], [0x2, 0x5, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x6, 0x5, 0x8005, 0x0, 0x1, 0x2, 0x7fffffff, 0x8000, 0x4, 0x1, 0x5, 0x4, 0x2, 0x2b0, 0x5, 0x97f82544, 0x8, 0x0, 0x9, 0x5, 0x5, 0x4, 0x9, 0xc93, 0xffffff3c, 0x8b2, 0x7, 0x0, 0xff, 0x8, 0x2, 0x4, 0xd, 0x9, 0x6, 0x4007, 0x7c13, 0x9, 0x1, 0x7, 0x7, 0xe, 0xf3, 0x4, 0x8, 0x0, 0xffffff00, 0x100, 0x7, 0x2, 0x0, 0x9, 0xdd, 0xfe83, 0x9, 0xc3, 0x7751c64, 0x800007a3], [0x7, 0x3889, 0xffff9a7f, 0x200, 0x3, 0x2, 0x3, 0x1, 0x5, 0x4, 0x3, 0x1f, 0x3, 0x6, 0x6, 0x2, 0x9, 0x7, 0x2, 0x66608000, 0x9, 0x807ff, 0x6, 0x5, 0xa476, 0x5, 0x9, 0xffff, 0xd, 0x0, 0xfff7ff81, 0x5, 0x10001, 0x61, 0x10, 0x1000, 0x8, 0x100, 0x1, 0x20000000, 0x8, 0x1d, 0x4000b329, 0xec000000, 0x2, 0x1904, 0x4, 0x9, 0x8, 0x7ff, 0x80, 0x5, 0xfffffffb, 0x7, 0x7, 0x8, 0x10000, 0x9371, 0x4f89, 0x7, 0x580, 0x10001, 0x80, 0x8]}, 0x45c) 6.05581114s ago: executing program 3 (id=9604): syz_emit_ethernet(0x2a, &(0x7f0000000100)={@multicast, @random="8a0a63cdec59", @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}, @remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x14}, @remote}}}}, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) syz_usb_connect(0x0, 0x4f, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000a6ff0540cdabe3cdb9050000000109023d0c020000000009049c00030103510009050a0000000000"], 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x200006, 0x8, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000540), 0x10) sendmsg$can_bcm(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4000804}, 0x8040) keyctl$session_to_parent(0x12) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000007c0)=ANY=[@ANYBLOB="440000001000390400"/20, @ANYRES32=r3, @ANYBLOB="01980200000000001800128008000100677265000c00028008000100", @ANYRES16=r1], 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r5, @ANYBLOB="0800a0009e09000008009f000400000008002600800900000800a10005"], 0x3c}}, 0x0) sendto$packet(r0, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x11, 0xc, r3, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}}, 0x14) 4.440542011s ago: executing program 3 (id=9605): syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) socket$inet6(0xa, 0x1, 0x8010000000000084) socket$nl_route(0x10, 0x3, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cpuinfo\x00', 0x0, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) pipe2$watch_queue(0x0, 0x80) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r2 = syz_open_dev$evdev(&(0x7f0000001900), 0x0, 0xa2a00) ioctl$EVIOCGSW(r2, 0x8040451b, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'veth1\x00'}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x604000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) fsopen(&(0x7f00000003c0)='gfs2meta\x00', 0x1) r5 = syz_open_dev$vbi(&(0x7f0000002100), 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000000)={0x3, 0x5, 0x1, 0x0, 0x2}) ioctl$VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000040)={0x7, @win={{0xde, 0x2, 0x6, 0x9}, 0x7, 0x4, &(0x7f0000000200)={{0xffffff07, 0x4, 0x7, 0x8}}, 0x5, &(0x7f00000002c0), 0x3}}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r6, 0x8955, &(0x7f0000000780)={{0x2, 0x4e20, @multicast1}, {0x7, @broadcast}, 0x0, {0x2, 0x4e2b, @remote}, 'bridge0\x00'}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x9, 0x3, 0x248, 0x0, 0xffffffff, 0xffffffff, 0xb8, 0xffffffff, 0x1e0, 0xffffffff, 0xffffffff, 0x1e0, 0xffffffff, 0x3, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x5, {0xfffffffffffffff9}}}}, {{@uncond, 0x0, 0x94, 0xfc, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x1}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x3, 0x8e3f, 0x3, 0x9, 'syz0\x00', 'syz1\x00', {0x16}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x2a4) 4.123327024s ago: executing program 2 (id=9606): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) file_getattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x400) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x54, r3, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x6}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x108}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0xffffffff}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x10}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000010}, 0x40000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fcntl$getown(r1, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x6, r4, 0x1, 0x0) r5 = io_uring_setup(0x58f7, &(0x7f0000000380)={0x0, 0xf321, 0x200, 0x0, 0x3ac}) r6 = syz_io_uring_setup(0x74a0, &(0x7f00000000c0)={0x0, 0xdd1d, 0x100, 0x0, 0x1000272, 0x0, r5}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r9 = socket$inet6_sctp(0xa, 0x801, 0x84) syz_io_uring_submit(r7, r8, &(0x7f0000000180)=@IORING_OP_SEND={0x1a, 0x28, 0x0, r9, 0x0, 0x0, 0x0, 0x10, 0x1}) io_uring_enter(r6, 0x627, 0x4c1, 0x43, 0x0, 0x0) 3.604168492s ago: executing program 1 (id=9607): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000001c0)) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x7}, 0x1c) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x82}, [@ldst={0x4}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x82, &(0x7f0000000180)={0x54d, 0x9, 0x6bd2, 0x7864}, &(0x7f00000001c0)=0x10) sendto$packet(r1, &(0x7f00000002c0)="2cbf9cfd537493c3b0c8a4eaee16f18001d9fc4399ea7ea03b4a5c61d36b1160949d85305410ee90b1091336c0733541ece7574030eaaf92db0a0a3d3ccbc7835e4d5e43a8a2587e00ea68c577926f771673cf7b367b1f91c781ad6ffa2d1a7bdb8df48b67a3e6f60a19370976072fb0fb01bf5e3816e53b93a1607b3a954a8eb1289be83b8f11a61d6ae87f685a9a1da3eec42b6361492dc3010ca167128a06c2ec48fc0f544ad0a10c07484463549f", 0xb0, 0x240458d1, &(0x7f0000000200)={0x11, 0xf7, r2, 0x1, 0x85, 0x6, @broadcast}, 0x14) r4 = socket(0x400000000010, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) unshare(0x400) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000240)='net/netfilter\x00') sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newtfilter={0x38, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0xf}, {0x0, 0x9}, {0xf, 0xc}}, [@filter_kind_options=@f_bpf={{0x8}, {0xc, 0x2, [@TCA_BPF_FD={0x8, 0x6, r8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000040}, 0x20040054) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x20000000) ioctl$VIDIOC_SUBDEV_S_CROP(0xffffffffffffffff, 0xc038563c, &(0x7f0000000240)={0x0, 0x0, {0xd, 0x5, 0x4, 0x7}}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0xc, 0xc}, {0x7, 0xfff1}, {0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4000044) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e21, 0x400, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}}, 0x0, 0x0, 0x50, 0x0, "54621861ed65d3de26d2f6089943fd9191e7899b830aba772dc28e6a603c439190bfd5c50cefbf963521bb8261f17290ede767597fbc559caaea0e87b1f1a96e5e3a8a5b1dd47e0e538dd9987c18b280"}, 0xd8) 3.427207406s ago: executing program 0 (id=9608): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001100)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000400000000000e1ff95000000000000002ba76bb3019c1341056bd8174b79603123751c4e345c652fbc1626cca2a2ad75806150ae0209e62751ee00aa19ce670d25010000020000040000009fc404000000c788b277beee1cbf9b0a4def23d410f6accd3641110bec4e90a6341965dac05c04683712a0b09ec39e9ef8f6e396ad200e011ea665c45a3449abe802f5ab3e89cf40b8580218ce740068720000074e468eea3fcfcf498278a315f5b87e1c26433a8acd715f5888b2007f00000000000000000100000000000000010015d60605000053350000000034a70c2ab40c7cf5691db43a5c00000000000000f030007ce2c6f800000000000000e75a89faff01218087560cce39bf405f1e846c1242000000000040cad326ad7add65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bef5d7d617da7a6520655a805608df4d431623c850af895abba14f6fbd7fb5e2a431ab9142f3a06d55740a43088696daaed74b9c5c29647d2f950a959cf050000008600a62e96b7cb8e52cbdc2ba9d580609e31c30879d6fce424c2208af6c3784a1975fa657de38a3a32e4fd67ce446adb431d07db79241aca1dd9ba02453bbb5ee8babe1745e645f091231b986e952afdac972f342c6f184777d05d988d6edc71df0100000013a38300cabf2b554380ad215c789bef4cc574109b8df8d9a9db669557b3809d8c396d2c0361629d1822f722ec23812770d72cd00100000078a75dea785be550dbb420287e0789b8c7044f563a1f68d4efe895fdbc463f747c08f40105869035000000000000"], &(0x7f0000000140)='GPL\x00'}, 0x94) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000001f80)=r0, 0x4) syz_emit_ethernet(0x66, &(0x7f0000000880)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4a300", 0x30, 0x3a, 0x1, @local, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x6, {0xc, 0x6, "f6cd53", 0x200, 0x2c, 0xff, @mcast2, @local}}}}}}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x80) fchdir(r5) symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') r6 = syz_io_uring_setup(0x109, &(0x7f0000000000)={0x0, 0x114df, 0x0, 0x1, 0xa6}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x29c780}) io_uring_enter(r6, 0x3518, 0xaddf, 0x2, 0x0, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) r10 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000001080), 0x2, 0x0) ioctl$vim2m_VIDIOC_G_FMT(r10, 0xc0d05604, &(0x7f00000010c0)={0x1, @pix={0x3, 0x8000, 0x32315659, 0x8, 0x10, 0x6, 0x5, 0x6, 0x1, 0x7, 0x2, 0x6}}) setsockopt$sock_int(r9, 0x1, 0x3c, &(0x7f00000002c0)=0x1, 0x4) ioctl$vim2m_VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc0f8565c, &(0x7f0000000180)={0xa20, 0x1, 0x2, {0x2, @sdr={0x37303250, 0x7f00000}}, 0x6}) sendmmsg$inet(r9, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000080)='\x00', 0x1}], 0x23}}, {{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f00000001c0)='}', 0x1}], 0x1}}], 0x2, 0x2400c042) r11 = openat$fuse(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@multicast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f00000002c0)=0xe4) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0, {0xee01, 0x0}}, './file0\x00'}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0}, &(0x7f0000000380)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@mcast1, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@loopback}}, &(0x7f00000004c0)=0xe4) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x120002, &(0x7f0000000500)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r12}, 0x2c, {'group_id', 0x3d, r13}, 0x2c, {[{@allow_other}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0x1800}}], [{@euid_eq={'euid', 0x3d, r14}}, {@subj_user={'subj_user', 0x3d, '#%&:\'\x14*'}}, {@obj_type={'obj_type', 0x3d, 'GPL\x00'}}, {@smackfsroot={'smackfsroot', 0x3d, ')'}}, {@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@audit}, {@fowner_eq={'fowner', 0x3d, r15}}]}}, 0x0, 0x0, &(0x7f0000000680)="c045cbd41e2cba9ce8cd16f6242186c026c91ed5e240b73c79a2e6a4e98d5973cf5239cdf146cacaa5262827c2d350fcdb8d17f43adcd244516fd8b07293d00b2dd315179d9c5e2370e29f1fab09476cba") 3.422442843s ago: executing program 1 (id=9609): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0xf8, 0x65, 0x300, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0xd8}]}}, @TCA_RATE={0x6, 0x5, {0xb, 0x40}}, @filter_kind_options=@f_basic={{0xa}, {0xac, 0x2, [@TCA_BASIC_EMATCHES={0xa8, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x48, 0x2, 0x0, 0x1, [@TCF_EM_META={0x44, 0x3ffc, 0x0, 0x0, {{0xf, 0x4, 0x2}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x89c6, 0xb2}, {0x9, 0x0, 0x1}}}, @TCA_EM_META_LVALUE={0x4}, @TCA_EM_META_LVALUE={0x8, 0x2, [@TCF_META_TYPE_INT=0x8]}, @TCA_EM_META_RVALUE={0x11, 0x3, [@TCF_META_TYPE_INT=0xa, @TCF_META_TYPE_VAR='0', @TCF_META_TYPE_INT=0x6, @TCF_META_TYPE_INT=0xa]}, @TCA_EM_META_LVALUE={0x9, 0x2, [@TCF_META_TYPE_INT=0x9, @TCF_META_TYPE_VAR=')']}]}}]}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x401, 0x7, 0xf}, {{0x4, 0x0, 0x1}, {0x0, 0x1}}}}]}, @TCA_EMATCH_TREE_LIST={0x44, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0xb, 0x3, 0xfffa}, {0x80000001, 0x9, 0x6, 0x62af}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0xf36d, 0x7, 0x8000}, {{0x0, 0x1, 0x1, 0x1}, {0x4, 0x0, 0x1, 0x1}}}}, @TCF_EM_NBYTE={0x10, 0x3, 0x0, 0x0, {{0x7f}, {0x1}}}]}]}]}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x40008c5}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x3b9aca00}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 3.392865573s ago: executing program 3 (id=9610): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e13d6a206419010015d4010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) syz_usb_control_io(r0, &(0x7f00000003c0)={0x18, &(0x7f0000000180)={0x40, 0xb, 0x3d, {0x3d, 0x3d, "52a2c4b0c5404e1783bc4df5c4ea336a2edcae439c9f71c89c4b6b53c9730129900d0686c2505f0adb9bfade33079229457545e605870adf0a4621"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x418}}, &(0x7f0000000240)={0x0, 0xf, 0x24, {0x5, 0xf, 0x24, 0x2, [@ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x2, 0xf0f, 0xfe00, [0xff0000, 0xf, 0x3f00]}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x0, 0xb, 0x5}]}}, 0x0, &(0x7f0000000340)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf, 0x8, 0x4, 0x40, 0x8, 0x6, 0xff01}}}, &(0x7f0000000980)={0x44, &(0x7f0000000440)={0x0, 0xb, 0xe1, "c3975181270fb9f6841c41ec5d561960fbc6b67cb1ebd6b946f60480f620922eded802153e4dfb84ddd1840d8429385cc51521aa60947fb6c7d94c8ed09eb974f2b543b45ef0965b9d188b85f7fa5f322b18b27a06912b4af140ee0a436a825e4dbc9baae033c1322ce78fe278b47382307688951a83e56b4d8a7ccf390ff87fac0909cfe74a441973354e84f1aa0f065ca4d003515894214101077735322336fbff8776ad81b988337ba806fadceb5d809201981330a96d4fae99b0256da859e9086b028f512815d3912b4f2efe8facdc8658ef98cfadf846d80437dcf2917cae"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x10}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x4, 0x1}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xf}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "cc63"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0xb}, &(0x7f0000000740)={0x40, 0x13, 0x6, @multicast}, 0x0, &(0x7f0000000840)={0x40, 0x19, 0x2, '(.'}, &(0x7f0000000880)={0x40, 0x1a, 0x2, 0xfffa}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x3}}) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000000)={&(0x7f0000000380)=[{0x1, 0xc401, 0x4f, &(0x7f0000000780)="2fa4aaca555c80e980979899f7a2e96c76e007198cf35a3e86a08a361ab693d4b578c5ca80b3dcebae4a9ec3d2084a95f036c2dab0a8e13b7f4757b2a22bf27639286b466ddcf6b2cae2a5a1d1fe21"}], 0x1}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) listen(0xffffffffffffffff, 0x100) 3.33283893s ago: executing program 1 (id=9611): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x440, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000010000d042abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000040000000240012800c0001006d6163766c616e0014000280080001000200000008000300000014"], 0x58}, 0x1, 0x0, 0x0, 0x91}, 0x8000) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x10001, 0x0, 0xdddd1000, 0x1000, &(0x7f000059e000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f00002b2000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(0xffffffffffffffff, 0x4048ae9b, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) syz_usb_control_io(0xffffffffffffffff, &(0x7f00000003c0)={0x18, &(0x7f0000000180)={0x40, 0xb, 0x3d, {0x3d, 0x3d, "52a2c4b0c5404e1783bc4df5c4ea336a2edcae439c9f71c89c4b6b53c9730129900d0686c2505f0adb9bfade33079229457545e605870adf0a4621"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x418}}, &(0x7f0000000240)={0x0, 0xf, 0x24, {0x5, 0xf, 0x24, 0x2, [@ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x2, 0xf0f, 0xfe00, [0xff0000, 0xf, 0x3f00]}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x0, 0xb, 0x5}]}}, 0x0, &(0x7f0000000340)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf, 0x8, 0x4, 0x40, 0x8, 0x6, 0xff01}}}, &(0x7f0000000980)={0x44, &(0x7f0000000440)={0x0, 0xb, 0xe1, "c3975181270fb9f6841c41ec5d561960fbc6b67cb1ebd6b946f60480f620922eded802153e4dfb84ddd1840d8429385cc51521aa60947fb6c7d94c8ed09eb974f2b543b45ef0965b9d188b85f7fa5f322b18b27a06912b4af140ee0a436a825e4dbc9baae033c1322ce78fe278b47382307688951a83e56b4d8a7ccf390ff87fac0909cfe74a441973354e84f1aa0f065ca4d003515894214101077735322336fbff8776ad81b988337ba806fadceb5d809201981330a96d4fae99b0256da859e9086b028f512815d3912b4f2efe8facdc8658ef98cfadf846d80437dcf2917cae"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x10}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x4, 0x1}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xf}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0x5}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "cc63"}, &(0x7f0000000700)={0x40, 0xf, 0x2, 0xb}, &(0x7f0000000740)={0x40, 0x13, 0x6, @multicast}, 0x0, &(0x7f0000000840)={0x40, 0x19, 0x2, '(.'}, &(0x7f0000000880)={0x40, 0x1a, 0x2, 0xfffa}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x3}}) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000000)={&(0x7f0000000380)=[{0x1, 0xc401, 0x4f, &(0x7f0000000780)="2fa4aaca555c80e980979899f7a2e96c76e007198cf35a3e86a08a361ab693d4b578c5ca80b3dcebae4a9ec3d2084a95f036c2dab0a8e13b7f4757b2a22bf27639286b466ddcf6b2cae2a5a1d1fe21"}], 0x1}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 3.219379673s ago: executing program 0 (id=9612): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000010d804dd00000000000001090224000100000000090400000103000000092105000001220500090581030002"], 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@delneigh={0x30, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x0, 0x96, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, @NDA_VLAN={0x6, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000200)="91") r3 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x34, 0x40, 0x107, 0x70bd2b, 0x25dfdbfe, {0x2, 0x7c}, [@nested={0x18, 0x1c2, 0x0, 0x1, [@typed={0x14, 0x1, 0x0, 0x0, @ipv6=@private1}]}, @nested={0x8, 0x9, 0x0, 0x1, [@nested={0x4, 0xff}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4c090}, 0x400c800) syz_usb_control_io$uac1(r3, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0003b8000000b803"]}, 0x0) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000300)={0x7, &(0x7f00000002c0)=[{0x2, 0x2, 0x3, 0xc35e}, {0x6, 0x7, 0xd, 0x8}, {0x0, 0x8, 0x46, 0x7fff}, {0xf, 0x7, 0x8, 0x2}, {0x2, 0x0, 0xf2, 0x400}, {0x5, 0xe, 0x6, 0x7}, {0x0, 0x0, 0x9, 0xfff}]}, 0x8) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) syz_usb_control_io$sierra_net(r3, &(0x7f0000000180)={0xc, &(0x7f0000000000)={0x20, 0x11, 0xc4, {0x64, 0x21, "1837d1d8f40410029cec5944e48fb0e7d80950d3df65202dd2c67f94f6d33859f428ce12b080596b90c8bed5894a614fe2d79afd59c0b4b03cdb2c32fe74967557bba24f6ca7502dfa442881d75da966241d7a18f1d55d76f05b86a7a341e53e0ba2"}}, &(0x7f0000000080)={0x0, 0x3, 0x5b, @string={0x5b, 0x3, "18051ecda3dd578a7ef6b0d4ef1b20cee93f40ff0e4201938a39a30bda2f3be8ec19bae2fb55ff41d89bab04e7409e8b41730e14e59d46870ab3bc88c6710ed3b7106f10d0ed9dc3bf0a997e893b50828d4a2c2d26376a2e0e"}}}, &(0x7f0000000280)={0x10, &(0x7f00000001c0)=ANY=[@ANYRES16=r3], &(0x7f0000000400)={0xa1, 0x1, 0x400, "7921fffec733d139d0f66960d9422cb0f20619d233fa3645270a0c31197149077cfcec0b1735d49030a031d2465ef4a2ccf25aec5258a52bf00b5aeafd119f04a104c71441aeeb1b8d4f67ed6ef7eea0b9564815712317cb29cebd00fce379ef38933322f888e58c66f84beefab112ae6809e19143e5bde059d84460d0a0a884bbfa67d824e3c02d59f7b064185b076777a1b4e6d7a0768e60f8962f23cdf16ed81edb5288737ca09aff252588472a9ff5c74130d9b64bebb090bd5dfb91d463604708ea755d3ed547f9809922a3d0706be03f0422d3624822a45d42f3c6d2807a7094c60de7a042dd92f70346ae86a1fb60dfcd958fb4a242fb4bab5f122d51200c3290156e5fa11c85360d1de9cbc8eefc5e21d783e280ec6937bf49fcaeca01250c65f601ec9ba3c1841b9754a06d0dc1356006bae18022ccd9aeb8485ca319589da8a477dc06af2e725b4360b6ac0aba2d87a7092c14a564819b97e2ff8db9f128210975331a67152802e58b9360c741e407015da9135f2c78e0e5cde96ca390d8f341c43e2870219619e91a02f86692946531e49871693423e3638df17dbe334403527ff1a389a421180680775892f698f4435ed1f390f586cdc9c92c68aa97f83e78590563f1ce5d613b521b525a101cf805962c281588f88fdb23365ba90feb19335ebb4f62dc875998f207ab1b26747b06ac73e1b5eba6dda18c359155b7e8a63fa4636bb3b20c1c98fcd5ec5cb98abbcb65f1eceb49b35d458718d9f4d47f0ab4f653d7bdbc9a8119b45e9ba5ea257a09d651ab8c6db1335017e2ad633041db655c6174fc0cdb9939d66eaf7159046f7fb70c99932dc4e5842b182fcd0ab9f5bb7943fd0a0fc55bddc393f293d2c35b1b40ba5a24744742742e930f5db34dfb3cd5eed9b390ffbe3ed970b65efd7d2b4ce7f02f34cb0c942b891fa4fd2ea6d6131d0026c0d12292da512eaad30749b6266a4b1a7246a41dfb806fafecc618917d29eb37ebdce3807edc7894728c293c2435395e3b352f2e02e3d7d64cc1e840dcc6c4851fc5ec11eae38baefd5ef5c2baaaec1c48f80baa278a61e0c9f778fdef834c0de1db112f24cb2b2b5896e8c25c8a9013fb701007ad6d5f353464a3ff190a3b39e66ce2d50016f783b933d8a1de173f757c1aff8d47eb35d80b3ab03362aa182e3e8471f7e1d6b8dd0d42fed76b19fea47048b83aab66288ebca3ea19dedf58291eca3be1ce4ff4072b2b2b90789efa2f6642cf0e588c8e9417a038b95d07db5e1ca98fdf96149ba0d1921453b61e5510a68c3fb7079b7c890ffca522a328ed9f5da62650f4e135295e2ab64ee03f31a68b426db974dadee79cfb28522b5a84b2309a488aa88ee137f1d0cd19ef263c4a6364bcc94e68481b254b806b00625daa7fd24f184905dc3d68e1261a2574372eba43a94f9edb6049"}, &(0x7f0000000240)={0x21, 0x0, 0x3, "f89488fe"}}) 3.119874974s ago: executing program 2 (id=9613): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x80000, {0x0, 0x0, 0x0, r5, {}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x3, 0x9, 0x7356, 0x5, 0x5}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000c061}, 0x200c000) ioctl$SIOCSIFHWADDR(r0, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = socket$netlink(0x10, 0x3, 0xf) sendmsg$nl_route_sched(r6, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000002f00)={&(0x7f0000002f80)=@deltclass={0x24, 0x29, 0x1, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xd, 0x3}, {0x2, 0x8}, {0xf, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x44080}, 0x80) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f0000000240)={0x0, 0x107000}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) dup(0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x679, @dev={0xfe, 0x80, '\x00', 0x3a}, 0x1}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003a00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f40)=ANY=[@ANYBLOB="200000002900000032000000fe80000000"], 0x20}}], 0x2, 0x1000) 2.97466353s ago: executing program 2 (id=9614): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x400400, 0x0) r2 = syz_open_dev$dvb_frontend(0x0, 0x0, 0x40002) ioctl$FE_GET_EVENT(r2, 0x80286f4e, 0x0) syz_open_procfs(0x0, 0x0) r3 = socket$qrtr(0x2a, 0x2, 0x0) keyctl$search(0xa, 0x0, &(0x7f0000000240)='user\x00', 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000002b40)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="240000001e00230700000000000000001400a98008002600640101000000000000000000"], 0x24}], 0x1, 0x0, 0x0, 0x24008015}, 0x4) connect$qrtr(r3, &(0x7f0000000200)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4004}}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000804}, 0x40) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000006c0)="2e00000010008188e6b62aa73f72cc9f0ba1f848140000005e140602000000000e000a000f00000002800000129487a71fe2c251244961f2a74ac35ff5fc", 0x3e}], 0x1}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001206", 0x2e}], 0x1}, 0x48000) r8 = syz_io_uring_setup(0x498, &(0x7f0000000540)={0x0, 0x465e, 0x400, 0x3, 0x285, 0x0, r2}, &(0x7f00000004c0)=0x0, &(0x7f0000000480)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r3, 0x0, 0x0}) io_uring_enter(r8, 0x3498, 0x969, 0x0, 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(0xffffffffffffffff, 0x3b8c, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) 1.917985778s ago: executing program 1 (id=9615): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) r0 = userfaultfd(0x801) rename(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00') ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_emit_ethernet(0xd81, &(0x7f00000001c0)={@local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xd73, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0xd5f, 0x0, @wg=@data={0x4, 0x4, 0xffffffff80000000, "0445aaeec060ebaa9d70d4f933e1a19a504f011380eb8fdd22a4983b4b279e5ba3b2334932ec3ea0a23f40e04dcc2b612936116499de95faf211ae830c22b9532624f8b0138f365ee38298a4c1002dc3c93dea0e5c7483d59fa99bb7a30b49498c92886961f6c3e0d424646959550eeee21ab77bda2b2bf6dca87c7cb6fe31cdd2e91b1e2df4c1da67b3c3388b57622d1dfe709c2d14acb5b4b7670d809ecfb008236df4ca4151a8fbf221910ad312d815f9509d1445863fc4123d6ac864a5d9ff58b9f6e90afda8e347b139af4bdf1da01471f4bc9faa6771bd588bd872b7fb1208b8308a117659031732517b2f1d14a0faa2a908030d74d92101e00fe628ad652f6b513654bd0667f4bb04548801045020cdefc36e88391236358c1b7e877bab8bf213698df237b62e0247825fff2bdd080885d0d6cbc28c7fc49b857223db0903734dd76740e45b2cd760680741727f4c79464dd26113a4a7cfbd2582d7662171bf00f7025f760dd3cc200b0b76ccd2dc60d25b4d2f60192e630c95433b1016dd9a780f531265f28d6ac504711332f463ac3e3cde0409dc11409fd00f247068e95339238061f48e8bbb42f97bf9d66cfaa455fe4591f0588f77dbc1fbbb7dde77bc2cbd439176119341702e33241308311f9a8e4bd4dd24a45c9797202f676be12a64eea060d70120e917bbed28fcf02ce9ebb2687e7acfb479a8dc1e9e61ac6c93a8a51551055f0f78d49639b2802ec7d345c8335143f50a23a5595588c92cc04a856257b4b3deb656a9e5c19f067b6ffda9e54a948f2f18b87532478c37096a487cbad5ecfedf346d6ca3bf004c87db7c7b66d473022960eb655c4d7945b8293b39a7397dff8479a0029ec61c28b5228540ec87e0821aa60f1748aa671a7e052693be99edd2a05a0fb1d9c1a4654727423456a54d0476a11076e7bdc53a56ec13bfcd723de88c75b501a0fdd3eeae52f8b0aea755019d2a435f4e42c48668f564064cc2266615bdf9d030cfea9d9896f39757e93a6e1f8e10f76e5f00f7fc24504c8f4f253c91e8dce8eefa4d4d66dc7e58799b56148f692e69b58b9e31205e20b42d03117a6cf045847beff7b45bfd0aa8ee2b5416179d7941383c12b1d9e7bdbc50c6dc348aa743d2f0387328de9eb406240cbf257037422e1c9cbdb10f339f88ba5ba397a6626934a5505b2c32ab13507fc74ac61fe0147c53cc6d657bf22cb2cf24dadaf7e4653fed5e51ca668619fea730739036b905bc812542c8b4a836eecddebe97b01ded917648d54522878bf7698a5c795165f59423fd9cad69bb75199b9689a9314e01787e28304487cf3360922f85e1905b32da847763f45f6e53efb30d1e63d4694b4e6ac50f9663c9c7bf537c22409578c98e136ce0017b320e03eb694e2cfb895315698291f55aa8628c2b9459024dd287adf8136ab637ba15a1d9da8fe49f4aab27e5af610a2cc4b41ffabef4690ae3cc0680366dd52b1729c8eb7fa265aa590da7745d4f1be2f8824b0725a300d8e63fdbf320a0de0a0902a3a784e4c0465a4ffd1c4599aedef91f51f139d6734b200a465344b20899c554b966d1cca9d598b5abb6064d9c2c4f38f5e52067d0e41a8abe9576287e8bb00c7b565be351478c63eb7e202cbd38b1511b38626eeeaf699220d9037fdeaf6b0345cd56883badbfd2995423492488e536dcee0e99b20a1cb35ec6f76ee86ec209db9a0f2f095b305ed1a1a1a01917e5ae3f7793903809e48193f9d2df8d9c895c8658404ec39aa429a250b8d22829bd6665a8396ec5ce0b003ad22fbde8e26d6830fe687ce57703d428aacb0118092f6ac3492edb2d0fe3a9fa6aa935c90090cb00e12125092603b4fcd66bd3056c1eaf80b125edc2f3bb517c0775544c403244119b2d6134e9b5cf2ed5416d07ba88617b3efd99732974c30489ba77b90cfeae4c5502b3426491a586364af80d05a46d42e4bae7e4474fd9ede7c9b72684ea0b89bcc155f17828ed7bf6089f061c3fb731881581548989bb7f883bd23cf1d73a0b77dcfa1551199e38703430b18ac3bc830d171ca81cc23b2565c289c517b5970600c9e990976f5ba1bd17c2d46f87c1b00b0d9f65c361eddff7e36a54c14dd37c1e362b4055f675f8dcce1701152781c510b4b9a02890394d9fec653be39ed701fc31e29f13cf847e62027344b715cefa5f844a0c41aade58a00ebf61865c1f1ed16791b0975a3114c079409892c74f1e7d0461ba81f092c769b76c4e387b219aea0052e94c46d0bbff996aaef5a3be6fa5f530af067062c74140f7a5c1d02a3b56cee238bdd59ba8b3eac5a37ec01ea80b496cbd26309825bca32024252f6c59c28720913d54f74e4b36e59a1e073513ae5fc22dd8b704e09b96e7a90f1fe35fb66dd6c8aed887d7c422e9b03510292b454d4f45365c60f17d233dca76de7c2254d9c1f241d16df12cb25eb61450ab7d266799ceaa222ef117e5964d857b03170cef5fe6f1264c6c0023a1a20613690cde8c25dbaae8164ffc5bacc76d186d4e1c99f0675ffa298d71e911ee201a7bc51095e4edbcc72e4a76d1ebe107c0f1690a8e8da53d9f7b7ffa4028d646349c97b161a09b9418ee2be69f07dc22ee4ea85fccc7fc5fab93e27f3be0960c9fe0cad358c520f44d81a2eabd814c1c5dd3bdd721daa8b2da990d92435801d42c94736931fbf11b67d00552e9b4c5334ac1ffc9305293c1da2d6e9090a98d43d4af1d7eb04a144c8fd1fec39f8325cc6219d1401094abe3a7e5da21099da231719a225d4fe0ff3c72dd11913bdcf5afe45c7e2ef890b3d7dbe2963c7530426ee42161dd3bbd08411abf54bbe3d9e3a020d9673f7b5911f7979d24f9b6ecb28d3dad8c2d8e43e870aca6d4a7d360927a401fe1e8d8a176f4482187832c0c368a299b7a6539420d299a208f4ffaaf28a4b8207b8ff9257c5c1868eb6239a55a69c871fc76aaf450062b7e72636495e9241ab1bacddda2f6910a11caf9fda11c04a3b45f5d196cef8d98f832cfe577c334e3a0dcfcb6f8d9f078cce4a45d013962eb583341222e1c529033391c52a5df5df44a65dafbe1924c4d7b907f9381478d83683f042bebd38354a29626fcdfe108656f991dd199965b1c4ad1982e4e78c98bd2bfc671bf9b1c466f271a19ae5f735cacf0f03f889ed5d81b90fb56df5bb6ce8c68c79ab6b7e36f009f3a5d9a5572da3de3e9fdcdfb5d38690b8ba07df7ead63388c701a931c9fb7839bbe15ffbd1719c63f90356f2c1f8846bf7908496a2a36c642f381ed7d255399eabc1f68315074bf053272b83de978c4c41aeb1c3794f3546e328c7d09e8b097fd0f8872bd66de07eecd591e67753977f9604079bfd8d268f46f2b84cdea8590d25a6c40e3572f1d0f94d80cbeab626691ce1d497ddb0a9b171e0a3b4a01ec242b5903f09fa535462c1cfc86bbbce102d794428eb14fa8bfcc77b9776ab3a78612f866fa436db2cc70bcb274a7f163722d20693eb80e82f43f2e3f28de3dcbf348e1a7a6ad59c49aae1a1197276b554026b731a838b07cf1622ec31a405a5de6d7ab01b13a578cd5699192d789211de9030e3eadd2a22f7bc943311198a2e372daa0ec64a5a03a874995cad8dd9aed59a435984916d6c93f9b2da0393649e0915a7d386337aff219a5dbfebf5b2b5eb7614db0465683668292b112f6d9e9eec47301a9152e453b774c23c3abe683cb00335bcab156883fa0d0c2fbe01931e283e52f69781dc1c6e0f68e869ad940030dd3a32dd4f37d0ec57093b5aaa660a467664cb0a784ffd2c38aa975d00cc0809247c5beaa9d16b50ca0cb520ce963a4073920e2e4c06c5b459d969712980bd04725fd1a27448ea3b89e078bbb5e37749070749cac8cf21c42bf9eabce306afc064929053dd552ecf8bcc0fbd6c03aaef705410527878d66caa12047f7df280365d00fcf7a9970db7d18184edb1cc34a7048d0fc4f2429abc158d2ec96d36d400d05bf8878fd62cc26fe559f8cad348d6f0b3f1b8f7ee195d83393b78d86b802f056b862e3d010668e9351377cf65b35425d3ae31763fa51a5126f80c8ca607a977e8ad127c2917dc7e766b6e03bae1766be495b87c8604e6f410622280f917891fcfd68c3a2549809d4787c03c02ce9edb9e31b6f25683c0407e35be3941f3568725168f83c885440f617268fb8bd588da1d0386c116b1e93ca09e9b98222db9d67899aa2bda2c55fb4c91b650d1d9cb2a1823dfd7e63abb34d66143a56c0ae165e8dbe1a77878d2360c9d9e5c01c8f276f4d2994e30a990915a947a793a14d768b57dfc677203d23426a97a2ab86be266e370a02d85c3d5c39da9cf6cc703567a0b20fb45db72ddaef880bcad49f6098eead6635c2b1fd7a310fecc6f80284b4164ce7544febd307f706bdf7e7e4aeea9b58799d3b5cf5d0102638b09e043448408be8c5c983762ae85381296bbdd355486aef86c80d18b75db23f947b2907bb9c5682725e919fe99ce13f5871e022c30f3560a063947e4dd5d337c73f1ed45b2b7a2961e29bfacec52aea25dd82d3b86a2b76873d67ff9064c9b31d1383bd9be97c818ee4411bff66c5f9f2eb64a6c0ccd0f1b8647493bbde4b53e4b5002b6065df57316a8d391c470310baaafb2814630f25430a5a4b17dce699d6b650bed6ed1df7b6ab981749d477a6310b37a886a77e3c9022c275dac9e97d2fae8bddd413786e5e818c04cb63b585eb3e4100b5ec4d5e8ca66a09dd798b563c25c0a5a9c1e3eb4b88bfbaaa3b3ce6bcf196f989f52b647ed1b6b684283efe8"}}}}}}, 0x0) syz_emit_ethernet(0x33, &(0x7f0000000040)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x25, 0x0, 0xe000, 0x4, 0x11, 0x0, @empty, @empty}, {0x4, 0x4e60, 0x11, 0x0, @opaque="a7a6f4fcbe3dfc8151"}}}}}, 0x0) 1.731905997s ago: executing program 2 (id=9616): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_usb_connect(0x3, 0x24f, &(0x7f00000006c0)=ANY=[@ANYBLOB="12011001088c2608da0400252e830102030109023d0202050400040904b901053830c6070a24060001a90ac29f2c0524005b060d240f0103000000060006000806241a0800000a240101800f00020102052404050b09050500100009000e09050b000800040a51990d81a64188800c4eb1ca04366e7f37650bbb4894ec218fa5fc70064bd9d052d8a786250af48210d425a4a3c70dea3367303ec213a20b24afa8baad8b8c830c83778b38d6ec3cd7f67d5a108644ce83f4ee891ab73f5639f9bbb77584d14b7bb17506f3313d6bd0831983e913559538718ad1d6ab3ed480767053ee209077486c28163c3e84dadbcf31ed83e9a157864f31ef066fbc6a906e09050c0300001cab03090503002000091804a6317ee0f5695289ab2a3d301933ac7b06d4d4012a23743e9c10392c39fe9e0ab882ae492162a2bcfb4be2728783884e0e10cf60b3a9a27c0e08f5342361c151a34c5fb44dbe28ba732af70bc8fdd4c76459b690be00d69e3d4469c2023329a279894bb97de26c0840e1b8f6e3e51889e39727789a166776c54d93f7b6a50b1c1fed56f566563b9885d2f9df8203df40c58daaea79f1e06c30c9bb6c2c5aaf6df8942bf7581ad28eb53b0606b487abc0ea168b40a5b3ce864d04e2edb4c2358c530e04d9bd4c68a11347e5e2982f993e7a533db1426ba81fa0c7b361ef806131560769daaad6f1f35c6fc1dac569af922e197128ecfd33f9c35f07639335fabae236840925011000040180040904d7a002ed6293180905030300023b040909050b00100008810807250100060c00"], &(0x7f0000000b00)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x400, 0x2, 0xa3, 0x7, 0xff, 0x5}, 0x101, &(0x7f00000004c0)={0x5, 0xf, 0x101, 0x3, [@generic={0xd5, 0x10, 0x4, "39242ccbcff5eec4d1af0424135c81402896101aa2817ff8a99d7e1ea5192fb0cdc38e5c45c367c135e160087897a867c368ba14286d75e1b98579dc9e51f1dfc6ed572a25fa4a782e330ead3f84b6c41af4dc24a64cd37292d0fbb88b1424c9fe22551caf14bdd21be179137175903ee90c90ce4ba3ea9dd2c19c84f616fe23fb43126ef19ccad9fdeb7a596e5f6f1adc0ca28d1680e4a8093cb5a158653b25882fa50b463041a8e98c37b25f274c13ff3d42d92349823f9a4f8a7c274205e2db97ee55ecdb85efee74a20d16b6a5eb365a"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x50, 0x5, 0x2, 0xa8a, 0xe0}, @ssp_cap={0x1c, 0x10, 0xa, 0x5, 0x4, 0x8000, 0xf, 0xc, [0xc00f, 0x30, 0x6000, 0xf]}]}, 0x9, [{0x1a, &(0x7f00000003c0)=@string={0x1a, 0x3, "c8eba30235c789539aeab992f30ed339c3549488f28270c0"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x4e}}, {0x1c, &(0x7f0000000600)=@string={0x1c, 0x3, "19c34f013453a1ff6ea889014814f361809ea47f09452392643d"}}, {0xa3, &(0x7f0000000940)=@string={0xa3, 0x3, "4ac4d25824185dd17d19debfb38f181d01f66b0b67eaa3e44d195fb3a07af1b441add1ded9d56f7e34adc65e190e0367e2cbb2f052731b624a310a9c7942b4b71d9bb5fc2cabd1c850f69413830aef0efa22a0aeb25058191e30c1b41bb0f0fb8f13623089874e187417d0a160388751985387f98931d68807b4b7f5d61eb1c52e4314910a2c686f78fb3921d59c5d520f2d8d1b38b6e4e1cbaac82f8d7977bb74"}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x100a}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x402}}, {0x2, &(0x7f0000000a40)=ANY=[@ANYBLOB='\v\x00']}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x40f}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x40b}}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r2, 0x89a2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000b80)={0x0, @in6={{0xa, 0x4e21, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4}}, 0x101, 0x5, 0x2800000, 0xb, 0x10}, &(0x7f0000000c40)=0x98) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000001d80)={r4, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xfff, 0x2, 0x0, 0x2, 0x3b2, 0x94}, 0x9c) shutdown(r3, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000380)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0218000e0b0000000000fbdbdf25040018007fe61600eca0b4157cacb3f1f6dfca15a6c9fba858324f148b3a000005001a0000000000f40000000000fffffffffffffc02000000000000000000000000000029001010"], 0x58}}, 0x40040) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r6) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x10, &(0x7f0000000900)=[@in={0x2, 0x4e23, @private=0xa010100}]}, &(0x7f0000000100)=0xc) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, 0x0, &(0x7f0000002280)='//\xf2b\x06\b\xba\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b///\x00\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x97\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8DD\x9bp\x01\xcc:\xa6\xc5n\x9f\xfb\x81 \x10\x0fQ\x90}Zd\xeb\xab\xf70\x99\xef\x8b0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) write$char_usb(r2, &(0x7f0000000100)="05", 0x1) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0) openat(r3, &(0x7f00000000c0)='./file0\x00', 0xea1c2, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000200)={0x84000020, 0x2}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00010000000000000000001c0000000000", @ANYRES8=0x0, @ANYRES32], 0x30}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[], 0x30}}, 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x5) bind$alg(r3, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'blake2s-128\x00'}, 0x58) write$char_usb(r2, &(0x7f0000000140)="f4e43c", 0x3) syz_usb_disconnect(r0) 93.949162ms ago: executing program 3 (id=9618): syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) r1 = socket$kcm(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @broadcast}, 0x10) r2 = socket$kcm(0x2, 0x2, 0x73) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000440)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x12) ioctl$UI_SET_SNDBIT(r5, 0x4004556a, 0x1) ioctl$UI_DEV_CREATE(r5, 0x5501) write$uinput_user_dev(r4, &(0x7f00000004c0)={'syz0\x00', {0x7, 0x3, 0x1, 0x9}, 0x7, [0x4, 0x6, 0x802, 0xe9a2, 0x1, 0x0, 0xa9ba, 0xc1f, 0x1, 0x7f5d, 0x3, 0x6, 0x5, 0x10000, 0x2, 0x3, 0x0, 0x3, 0xe, 0x3, 0x0, 0x2, 0xd9, 0x2, 0x6, 0x3, 0x3, 0x9, 0xfff, 0x8a0, 0x6, 0x8001, 0x33b5, 0x1, 0xfffffffc, 0x0, 0x0, 0xf, 0xcc, 0x5, 0x80, 0x401, 0x5, 0x5, 0xfffffffd, 0x8, 0xb, 0x3, 0xffff8001, 0x6, 0x4, 0x80000000, 0x1, 0x9, 0x7, 0x0, 0x5, 0xfff, 0x1, 0x7fe, 0x7fff, 0x5, 0x1000002, 0x8], [0x2, 0x1, 0x10000, 0x7, 0x9, 0x2, 0x5, 0x4, 0x9, 0x7, 0x5, 0xdd5a, 0x6, 0x5, 0x7, 0x8, 0x5, 0xcc, 0xbc1, 0x80000, 0x0, 0x5e81339d, 0xffffc256, 0x5, 0x80000001, 0x0, 0x0, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x5, 0x5, 0xfffffb66, 0xfb5, 0x2, 0x4, 0x7, 0x2, 0x8000, 0x7fff, 0x1, 0x9425, 0x8, 0x6f, 0x80b, 0x1, 0x6, 0x525ba681, 0x4f74, 0x7, 0x1, 0x1, 0x8, 0x100, 0x6, 0x10000, 0x1306, 0x8b, 0x10000, 0xfe4, 0x3ff], [0x2, 0x40, 0x4, 0xfffffff9, 0x7aa, 0x10, 0x80, 0x8001, 0x5, 0x0, 0xc, 0x8, 0x7fffffff, 0x1, 0x1, 0x4, 0x8, 0xfffffffa, 0x7, 0x9, 0x6, 0x4, 0xfffffff7, 0xa3, 0x3, 0x0, 0x0, 0x3, 0x4e, 0x3, 0x5, 0x2, 0x0, 0x9, 0x13, 0x0, 0x2, 0xfff, 0x6, 0x100, 0x7c83, 0xd, 0x1, 0x4, 0xf, 0x6, 0x47, 0xfa1, 0x0, 0x11, 0x3, 0xffd, 0x7, 0x7, 0x8000, 0x7ff, 0x10, 0x2, 0x10001, 0x1, 0x0, 0x6, 0x71c], [0x81, 0x3, 0x10, 0x4e26, 0x3, 0x40, 0xfffffff3, 0x497, 0x4, 0x1, 0x3, 0x5, 0x56, 0xc28, 0x9, 0x5, 0x5, 0xa, 0x79a, 0x40, 0x9, 0x9, 0xc41f, 0x80000001, 0x6, 0xffffffff, 0x0, 0x0, 0x6a, 0x9, 0x0, 0x0, 0x1000, 0x10, 0xd, 0x6, 0x8000, 0x53, 0x78d, 0x4, 0x1, 0xffffb027, 0xfffffff8, 0x9, 0x7, 0x6, 0x101, 0x7, 0x7, 0x4, 0x0, 0xb, 0x400, 0x8, 0x0, 0x8, 0x7, 0x9a33247, 0x8, 0x0, 0x1, 0x808001, 0xfffffff7, 0x5]}, 0x45c) read$hiddev(r5, &(0x7f0000000040)=""/117, 0x75) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='veth1\x00', 0x10) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x10) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8920, &(0x7f0000001140)={'veth1_vlan\x00', @remote}) r6 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x6) fcntl$addseals(r6, 0x409, 0xa) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x200000d, 0x11, r6, 0xffffd000) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000140)=@req3={0x4, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r8, &(0x7f0000000b00)={'syz0\x00', {0x5, 0x7, 0x3, 0x7}, 0x3e, [0x2, 0x9, 0x0, 0x1, 0xc, 0xea45, 0xd, 0x1, 0x0, 0x0, 0x800008, 0xc, 0x3, 0x0, 0x1, 0xb, 0x3, 0x7fffffff, 0x51, 0x5, 0x803, 0xfffffffa, 0x3ff, 0x2, 0x9, 0xffffffff, 0x3, 0x0, 0x8, 0x6, 0x9, 0x7, 0x9, 0x4, 0x8000, 0x1, 0x5, 0x4, 0x10000, 0x4, 0xa, 0x8, 0x0, 0x8, 0x0, 0x2, 0xffff, 0x6, 0x939, 0x5, 0x9, 0x2, 0x4f, 0x40004, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x2, 0x56f00ca9, 0x5, 0x2a, 0x1, 0x22], [0x1, 0x9, 0x9, 0x1, 0x5, 0xe, 0x800, 0xc, 0xfffffffa, 0x2329, 0xfd8, 0x1, 0x5, 0x5, 0x0, 0x24e, 0x1, 0xfffffff7, 0x2, 0x3, 0x5, 0x9, 0x82, 0x4000008, 0x1, 0x40, 0xa3, 0x8, 0xffffffff, 0x5, 0x10000, 0x1, 0xffffff00, 0x7ff, 0x26, 0x7, 0x0, 0xa9, 0x101, 0x10, 0x2, 0x7, 0x7, 0x8, 0x5, 0x8000, 0x800, 0x5, 0xc5, 0x6, 0x1, 0x9, 0x8, 0x3, 0xfffffff7, 0x3, 0x24b, 0x1fd, 0x2a0, 0x5, 0x6, 0x8, 0x7, 0x80000007], [0x2, 0x5, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x6, 0x5, 0x8005, 0x0, 0x1, 0x2, 0x7fffffff, 0x8000, 0x4, 0x1, 0x5, 0x4, 0x2, 0x2b0, 0x5, 0x97f82544, 0x8, 0x0, 0x9, 0x5, 0x5, 0x4, 0x9, 0xc93, 0xffffff3c, 0x8b2, 0x7, 0x0, 0xff, 0x8, 0x2, 0x4, 0xd, 0x9, 0x6, 0x4007, 0x7c13, 0x9, 0x1, 0x7, 0x7, 0xe, 0xf3, 0x4, 0x8, 0x0, 0xffffff00, 0x100, 0x7, 0x2, 0x0, 0x9, 0xdd, 0xfe83, 0x9, 0xc3, 0x7751c64, 0x800007a3], [0x7, 0x3889, 0xffff9a7f, 0x200, 0x3, 0x2, 0x3, 0x1, 0x5, 0x4, 0x3, 0x1f, 0x3, 0x6, 0x6, 0x2, 0x9, 0x7, 0x2, 0x66608000, 0x9, 0x807ff, 0x6, 0x5, 0xa476, 0x5, 0x9, 0xffff, 0xd, 0x0, 0xfff7ff81, 0x5, 0x10001, 0x61, 0x10, 0x1000, 0x8, 0x100, 0x1, 0x20000000, 0x8, 0x1d, 0x4000b329, 0xec000000, 0x2, 0x1904, 0x4, 0x9, 0x8, 0x7ff, 0x80, 0x5, 0xfffffffb, 0x7, 0x7, 0x8, 0x10000, 0x9371, 0x4f89, 0x7, 0x580, 0x10001, 0x80, 0x8]}, 0x45c) 32.297903ms ago: executing program 32 (id=9558): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x3a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) r1 = socket$inet6(0xa, 0x80002, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x0, 0xfff2}, {0xfff3}}}, 0x24}}, 0x0) (fail_nth: 11) 0s ago: executing program 0 (id=9620): mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x20, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r0, &(0x7f0000004280)={0x2020, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r0, &(0x7f00000062c0)="23db5037805f177d136115e6a1a5903469af39c1fb9cb38215fe64cff9f2f0444a57e22b0cc5cb4f74c9792365400d9e1c68539ea5eff0a5ed0864814d39251bee8dfea69aa052d900bc0c792e1c9752b7d3a3222f6a1ad3e44c1f65617b128aea51911861ca36ba7c96b96b2fba0fdaa49ffb2612f3e81fe565327dd9965a60046442c9dcd0d552c6a00388be3b438a08883c7349761531880294ad9887db97d8c2f74921c57910cf1f5cc528e17bd5c3746b6202f26d621535aac5f7872c2cb3295e42524b5acb249b2d1ac1b53a4e31271decfca3fad2e2f740768adf00875c18cb7d115150f83ceb73f77a1f61f1666c2bb9f6bd9f0fb55b3a619446e32bae2a1d99aa49e5f3822e048f8be44b707f2db10d7916ec9a10a695d573d871cf24959c3d15e61344a68309d186956537c6ea8532fc2e1c7649f8409d8dcde4c8ee1530470ac9c870f9f1837574e444ba6addf5ddb2dec67c0e76df79f265b403818dddb4efc27c90985ed69a48b12056e548f9c99edf80d2b195d26acb1127661727a0600257f4b2546513d03930a0638a71bd3223e51fbb75c832ef737907f2f4d3f0505f431ea02783c798b5c4579c99961fb73dc623a0d99c1b306435464d413b537d42c6444851b36482597140b22fbc0ebc7e795b2f96739bf139f5823bc869ede547da4f394fa1b1787836095e1013264042e53d5006ea059d0488cb2f5ccd44b30d25ea53c2dda71d112d7d441dbfc9f8462c99c098b1958c80b237d83c32f2759c9a9c081d7d7666a477cfda59354309b09f2a8b9f6c3077b0df1e8d0c71ac07232de4f437107cb0eb9b47b2267efe31938a337cf11cadad72ced56895bb14763cca5bdadd245d801e829a1eb3bb4ed851a345918efd2dcf8d38f66badc773068e6a2ef59b2bb838abd8b043cf6ac54550f3fde1bbb9e761095e4b8ef1891757d376be1f778142610c0acbbfc697f51fbb7a1602ed46e82813c74f41ee2bae818174809f3692084bea7310ebec3d6166702ae62aad84313e19b4d145167185ea8d53cb21d099fb592d7d7f8bc305dd375b5c0cd73be44f49ff53cee220085d4706bbf50c6f63b02e7e805e8fa4c73046a57a8700886da29ea53e5a316e7b011c44a0f7be5cc5cb5641ba0069ff591eee18966c7f005ef40046a5fe2bf325b2545b009867761264aa9611d184fa372ba3c5c33d9a50717210f7cec7f6dc4418a87a797eb6aaf6ab3892bd3f559547c88d8c29646c8173fad1588f52beb34ff863be65e7ec1598cfb465f270bd5532fa7035aae077eedbc846058fa19f58ffb1cf0f1863f6d33f2e5c454d18b66be766ca369af2cc9656fa34c6c10e4d4da44ce5e2370aaf60c4e130da331d3489e8f44c600246323409fdd35d11da27128c9d64be65dd3a90c1546a6eb9185cb6d3a4a9cfad0e41ea03896fd2346f745eb3563d7a79fd345b037c040e56f0677840bf9b0d295bcfa98b931464c5ce9fcaf745720deac2d8b4edeffc0fe6f089ed7c3880959fcf8e31f7b7054bc4f5c9d3ed3f66c968d0bc20b2d66c374f030f3f1965f43a98519e527caf693362412d523eeb38c8b016ff77f78f833d7513e4b5a53d5ed5143916673f822ceac9967b8788bc6428283181eaf8d99e48286aacf4f658a903e9f08659450f7f9483807c2e013a1d9d199f18886a8cb4e14d41c71e5731455a4394551281eca12a1bb6ae717f5da2949175d0f1f3d718b761dfc1099c7d9d8928c899ac8e936e69d19fcbfcfdee83b68ef8e15eed41a8ac0d54aa92d7d2ee58bb4799f378225ec9ba4709e5ce2b77208ecc85c22c64967a9ef3360c54d311b8917ceb7b432c90cc5e98de9327c1400f8ec89261b1d77d8874b0bbdd2c5eb59df415705de52b08b0e12c07fb7367c6d461c19f282d51e482cb4fb9ceb0249ac2d6400ca170fbd6c0063224179c616bb030a5c10102aa2eea92f1e6f5828590b250b09e6d1a9535c298a68160b7c281fecdd295dc3396c4e6eb3395d5a677d5fa95a732dfdef81f4346545dd1a74bb3aa9b516699bdf0a59165077ab459a5ffe0dbb3ef8afa7a8382a8441e0c36ffabbed8f93f4bbeb97e5f6a704bf63a0de9ccf8fef643ebc530a80920931002003b027014de317c42f861d98ef4fef66d232d9706e6bd263347384dadadaa43a7e106bbb21bd822d468ace171b3f04b996112135b63dcbd612b5888ec40da583ab549c340ddaf5d7406c3e99322c68874214356c1fd9b5f84348e629cc3487a901d1b7a2fa531b1509ac1c93de3da9f1c3773e3a2aba2b29d2419f240ae6d24ed9f14bf0b9b0f1e740a2db06dab64d6386f950bff4e4c94160ef4b832bbde3af4937b7528658b5c16a51cb22193fe99385721ce5b048d9338e289dcb40683140c413eca52c8e4b64b306f47569477379c864cfb3aa3e349262407d3935ab9a0916eb0f6db2be71a7eb8f9968dfac44995d5bff8ef617fceeaa448f5e5f8d4b39e3512fe7ae9ee1d8a0d5912b6148969ab0325f3f76e2340fbd67ce156bdf638140b3ccdb08e5049db15957915cb05db8901249b10c59cc5c3ff836290e3334eee2df387e44c57b4d6198c3749f5dc57f6c3de115ced6b43cbddd762b58f1fb40b2baf3b381febdc073142e30d2e9a1a69e8d86314221e540f195509d223b206173dc5406865d8064817c30c284c034035a63190ab86df3bae4168c58e01d2251748fd5d9d610024129e83a5730fe83cf0918790e6854ab765c78649b91c06655f0cb9e26d8432df78bbadd99583b6a8afcf177ed6f339e08c0b36a16c6d31d8a24cb6f2bc3ba58d7711b6f8b988dc3e3144be619548457d4f40509f17eeb186cb93a2928ecb951593d1907c8bbb9f4c8999caba3059c8e73dce54ad6f87bcd51d559f7759902b14e68d3b845c0b179b38f4e6f0bd3a89cbcd5ebed9972102048647da1eda5c8456442369f4ae871d4037ba26f27d27371ce57e23adca5af8dc93f934f2ef8d69ad3b2db66657b3868dd839c2b522f5461f24407ef091b77242fc70a48b7eec45f3bcbcfbc6bdc36e4b67295020a345233a32a0a0af4d03a53ef67e69716d5ae35342722afbe7558946475a9ebf5b39c18558a0011f68bc8a78590b0cb63618379a512790c42d94bb239dd3ef5b8d1036cf0391aded8802a7a447c38f231ae611aeeab9bba44cd14369473758b64108d0bc9b6bc9e9b497c2d1d2acbae7c620a55c226cf371331688eaddec61fe961c5fcef71dad45820ed0ac8dc7641d82150f1318ac15aa41e7be585b6a50da1b3cd95239ee61cfde15aba80ae8ebc21ba4540883c6f44cd35b6b97da4640c97f5a2b6efa8d184fec823abc754ab8a0db6c45c2293e90d9c154c4a3e0b9ec2b6113ce6583b80f0d234dec9a9815067244733e2134b9ba93bb9692fb44200bb5501bb109f2401e8baaf0115d795bb0346dfafaf953bed8e9a52a5b9b02d490c55fd89daf311ad5e08b070a9571f696d6df4715c8b69b840e4e03d6f361326e20d9546c47b3a63163e7df9bd260621358c166177ee7c69ed63a8c43dd4a78543aa9f922c0ef527f4aa61ff65bb14595f518412ce25a1e103df89cd4b363593da16c11d80a23a9b5ad8e3a7be8f697cecf82c8fbd889a4f743c839b67f7ba5453b10bbf59b1e4f4e821872c061a4125c0c15c1ca5164efe61a58bb54dcedc849800a6021a448d4660c3b85e2362b7cd8ce95156fbf408a09a30a8ccfc3554004e9f9a35382907eec00617e2ae1f8803146bc8c28b4f3bf3c6b183ae9248e7f05c4adce3e0b7ff29252b5be9b19431e3fe612d471f52c5c34cc12c83049189f4d2e5ca516df78766ba3449d07ef9436c68052c986d9dde8802c931194e2ce34acb8cc26663a09348b15c6c145d26306bded0d1f482803ae6dee26562b03fcb183b69ee4a0491e8776ecdadfca395cb4eac2948d4d64321a4e669f2f663eb54f05f12ed9c685835c3e79f982152dbe701073b9a4ab2932b46ee2424a5e18bbe5f25ce0b898ff6937927f4670defe430ac86021226ae055daf39b535cdc0899fcc99d15e67d66bd2dd89bb21b8d2689a8af10a1b0bd44103c469922c36fc0228d7b6febf5e366dceecf8bb1db385c8ab95d86ff09b76c2fa6282de81fd6864c495a4c8295df61a2548e1b81c3e3f30d7a41216801d6c2d1743f66ae2055756083e8bf403d436b8244ac214f4d84a693d13f299ba267401d094f2df70840e8a980622794212f0992ecf5a47980ab2cf7d5a6f12b0a489af3c3c847ac59bc89f36fbb0e08bf283b68213a17de38b3a45eade6f0b198def408f7711c16367bcc0ded794a9a323c7e7f07fad96ea9c4d7344c26e43844a27c21076b8d7cd07677602d91eac825eb5fd0631755c2dd1dbf7bce3eb3c3f7377fc6080ecd0b894e29769845725943e25932d4249abb4ab78d4e2ff2e2df42c8d884cd6bd13886cef080c6491c217abae0eec6e9d4d49eab6657f15cfd38e6cd6d0bd33198c4685ab302d0f46e42f4a5d5bb7d2840a0a8817b98a856700d4de74351896fe7d7d5a0d1bc57fb4c828aa51f9637807aeb905780f239527ed4affd83f68be8b7ad1e10d9e797ba39cdee24f7be0a0ab0ac22ea3968dac61eb4bdd522c9ce570edf63a439abfd9954bf6a16c88d86157d05477200a83255cde279b454979cee4de00e81cb44acdc4295c877566a749ab5b91d250f03d46ecc14210c196700338eea028c930ce104f20a9e7fabb0ad1d314ec1a2d97d1d1b9e09114dee0e3e513eacede01971ff85dc98634156073df4e8acd6c3aadd615adaffa7a81573813bc4ca21886ddd532021bba5c84b34c34665534db48d61903a03c1cca4ed955ca92c1e33b7664b494e3db6d1e637a49e537808a2669ebeca301691acd4fab0af197b9c7db01b7862466b568ab3a4712a25210264fb297a6b679dfc3fceb65bddd1a23d5b507a0d6da83d73b716d971c5179a92e57b9b93451eb943845a549de737f2d082a83682c32649b4941e787758ead9d2c256b2b4ed1e0255952ce83cccecc39e5bbdd38490f1960b26e5379943be3d9a64b5149c84d577e5fd099560baa292befa06ce9065fb03ed432a9e055ca4ad0e952f8368b3d230fd5239726f79f4c98a0b4a9648382b245d324cb61049562f765f923fc657ef36747658494d78590a1e27a2d09856acf50c3b26271c6d5aa96e8ff9bdb9043859665e21ea53a050c335cac414bbf27b0328ac2c7450acb26b093bf232358afd1135ee50ac3fb26b5f0256ccdd37033c8a59740607cfd549d4c6540afe4a6b4425ae1f633872dcfb5da8d0547cf0c4888817b71fbc7c45b2a641e9c1a76b6a6be124402422ada35edc02ed997d6b87b361aee95a16d2c528d89a52fe40dfd83434969bd86f02e63fc1ae72941209af39a08cfbb4c320bc47d853f5dbaf0cd60ec54608aadbc382fa6b5cab3e9cac57bea26609f4c79f6a6b4eb4a9336fa95783b0c0c366f36d5d6b8310b3cfdb800207919a131bc7f984f7fa11fd0bf2c89e060e9d1286e453fe97363ef72bd6eba29a85ffeccdc3bee72e12284333a5a40622c01619558d2750fc45abfa22059ebdf743f8e50ad29770d19f84d8a34232d6918514769b3bb2a1ea5e59e9556332ba669675764458e9349a1835c501a93e91dd3b31018979880a9913f54ec1e8526b8cffcb776b97fbb9424faa5c5eb60d2ac74955bba4b5182571d0d9f84f0df1baa722b20a78c9c0011c667f688b58489c9e450d83e40ac5eb41c5564b6d76a226448abe4a3f499927074125aa9c0e7e704c36df5bb110a0f15f8433a470e81db414827d5ce21ca1da1c8d51d746d1e1ca110127c15e92afd75d3cd05ce0b632cfa03745de3cdd4b57373d46676583c89f045c26c6fc5793e5489555ced08f83ba351135834a2028113c319af30cc85bc01a7f8208822d7d607aed0d2e12c80aa009100441b75beaccfe0adbda7e8bb870edf4963158794c8c3a5baacf6eec7b5efaefb7602dab8409d161beeb281cba21f1da0ccdc092d0433fb940d79699ffeb87ea775829a6e7e3b308a2ee0b7aec8ac5f35eed61be374c7c77196f7119a8882deff68230f461cb917b0ccb2b8597efcbdd1003b7b77b2c601ebd4b45c35b8426f7b9138ab3df0ec00819604ab8e1e64cf2aa2282b1269585af127a268cd207f964edff172e555398a16df44bdc52889538c3a27f8fbfffb61f7aeb55b259952bbfea81d73058d8b0f78ece9dc08e660437d21d4e3ec38b19e5afda7a6e33023f9158db8a1c14dabd9b8b307ddc66927f7b19df5e0da2237d98ddd890b81f1963808977d02198e8ae2e97419dbb1f8e51cad36a3424b955500fbdaab6ff8dbf028708b1f951fe43864b59b6c2368b816c98023d4480a91b3f1059e9c214bf55a7f8c7da907f79ff5568fd787d3aa022ab9d03cde551f7e3295f02c4f3aa37e4cebdd968c0f82f09eb004fbdb1a4ef3a0d426691bde3964c29ea65622f5d3ffd854053545ba1ec164495e4bef4845439c058f9438d13be7922b656db499c246ee6176a15b97e6a68e42f0c703033b699504e1f92b43054c7237199bd013d96faab47433b6b3f91dc66368706439d4ef7da3942ce8b9c1c9a9d0643fc4540e7d3f1c3821267e866cacd3e904be9f9df80381eec09eb2b0d745ff03ffb199b917a14fdd8fbfbffe8bfb0cf7023aa7183301a8a41e7097ff9f5247f8b78f7d08bbfc596a81047807cf0929677222e7e9e921b294e04088c3746d8dc19294645f1c093a21b4c5e6d92e54dd90465b11dd5d9d42af849070edff4ec63970f4088daaa33afdebb28d01df5ee043a8150ab1b25d864ef31e20c84696596cfbea92d02ea29c4a3933c41ec68aee7d68d7eea7f30d8920e14e62be42bcf856d7a58f46fdb2438b023e974f77281c5a462553627e9614504cbd3f1cae6e0fd9f7e89d9bce48946d0508616fbe542303dc542982c61d7bb4afbf3e76bf1fb2381cdc99f2175ef944dcd826aabdca2b7678db5262733c69ce504c38e7deb7adfb9b6d8bb00d8e4251e0438417ea615cde58bd76c2427b3d7a0578bbbff9fde2abbc5d60307aff0050b18176158aaedb34e283886378ff798b4f74e0a0c95d64271f1916280dd247304d9201c67f5e2640d9706add8703cac81795a0190107e2bb2941ed13738595da1c86ba0f68e2283a435cb5f162c74071a13dfe2266d05abaef080dd6b1dade115e883e04f0bb4be4d91f535ae6f822b02e814e65d2b7807d199a23d3f26209f6c9f93602a3a93ccfdebb5f8161b7928059674e15820d1848a980c8d1af5a73aadc5c402fbb6e730ba51227913ca27f0d78d331d6325d0a7926c238296b2a22b10a69cdffeb087dfe175511ed8e2cde8d7dae140e4ce92f892b129d9940e4a30b19f822ef7611b8750eaea8e55502604b7d2358c09a217af8be6c86d67cf6ff6130c971c9765d56631fe6224fbe1e833d497b534fbf6b030af93691f59295279aa1bdfb5d5d9d4668d5aea70e2b8fc117df0042e91c7e6225f27329727ed6e14a87c7943c040dfee4e5c06a20251c39a45ab4865951b0daefb9c05571fdcc21d1761945bd2b8047ccedd6f1e708646fbe61e75bb2728e8cee893d7e6f642119e786155a6cbab057d6d83b77716145119e974ad7355179d2adc3d748fa249cb58e32e6791d646240c05da4427b2f359976c8fd1486c604cb7ee647e24633d8fca8314cf1f85110ca6351156a2b26e44b040f7d2810acd36f45a3969c1fafd1a7e0bc14fd9b26593375be8e750c3f6534ffb85904d15d75fba05dac4a673de97f7543ee931724cd35474cd7ff5cf3e8abaf206f3030e92895633fa9d8499ea763601560260109dad18bd64b990531fc5377e6eaa5da050b98e1c6515ea48c7de1a15b63283d4a694cbad379356bfdac50e6c343879e29f6b9ab425600d51f257ceb35d0ca00f83cf5bd734223de716747614666ba1f1a8fa756e5f3ff0fc94fa4bd4073bddb0098cf565ee40af5732ee9218d262e5b64ad6b8118c54eeaf7072f2e15514a401779b425fa89d8abb1750e56cc3108dffdcf2d3fd86b8af4560d56f7ff0702154211f9949e3992d93e66892b297fa2d4bfe18de3fd74e96c9d30eb14fd458fdbc9e9a34e00f3280dd732520147fa2a8fa83e91dd0687501466a300015bf888c03fc08190c2753d7719acf6f84885c4c5642f466c1984f15a7716a9b608ee5f1b395726bcc8519766667d24d11e396e62ea39640c9e73e4e9e9e5076d7019ca1bebbd7097807f46b3b6fcb96ed4b433b25ec551fb176a5fa252ed1d81b0350cfdfb8069c9916495bef3a262b6668910896c0b37eee40547c663a901e92f41b417ac50e88d058d021a8f9a5783bd936cca4962bec1c9886689cc547970f9215232596392515182e563f720bb79d29baaabf0e2697de6500bc677e346847011ee3450358c0b16ca528368b5cbb8df5ab974a3cef072d20c9906fa585e0f3083ec6d8507b8561f64e65aa1aecf825fc47ad1459c87771549fd5c9a9cc094e7b1179ee1e90eff7158f28f59f029d90e708f4ec50b4f67d8b4bb7140065528354a7e25d63e92977183a0284ec22aa923210f0bfea89cca53547137381e5de0f60bc484bc2daf129b0380244f1ed4bfb674eb2791e76dce33cae684ad36620d5d67cb587f840caed316b7439b0e8c3de0e065e62680f3997369be3466670278168c9a1a644d870e3a8d0a79b2b720e8c3c51bb9133532beee64319e98714bb2e6d5c0b723962d923b0ef454361d4b3cb470bf8c39031ed4a75267f499741be15aacac92d8e6afdcb01a2e7d2dbf549ceb2a2108c4079c620f05ca1bd31d631c2c8d35ca0d73155f56ed020c25e389db356edf510ae088d11b5e4fed51d0dce4d3aa04924b09c28200ede5bec1a8f38cc5f081055e0f28d75afc4d588ca0e828d00085d150beafdda17b8df9e7d9218ea7d81f2e076412901c5ae04d6929d717fea2fcc8e5a1e69dbd7b5258799a2fa5eb108b6cc35dfab599fb27e6d75f1030b83f452af8137830337141f031942eba83123d3f87b5f01623d4613e5a44b4952c300baf3d4d3dbbfb0ad024a19b3810a174ef8453d85a25822f66e45eba2490f29de1077683ccc32e3517f88b51e010672a982f7c8591450c9ab1573143aefb61c17ebb0c92dcb0494d116b970c2a827a6b3608ae10d583d1f7d092263fa873de9f31cd59bc9491ff012059b63a9120af89477f2ccc34eee7bd66de60af64730c879128b49d31da6400c2471e0d5abf707e560574b477b8e20ca45d92182d639eb434e14aea1a3f91ad8fb60e4859b77389753990513181ea3a82884235e8520294359435cfba220502b591fc28ac36ec697442657d290bd7aad7fce53a3f1766f2bf7d55c24d7c0e9c7a71d6f1282ea1478e0a36378b50e4fee281f686bc53f50138036e2a5d6199d40caff084fde7b63b3c0a47da0791107c3218330f7c2e2c7609aba202fae5290243b6033379eb15edc572eee452008e04c9b53efd5f3d88327317b38934745bc3de4c55bd818febc7a7953bf03c4029f77177c2a974310f0485aa46252f1000dc71934947287c38ea5854f29c7b82f630afb8caf1fd880670307b155a6e7feddc019cfbbbdc18f3bc03da3bd371d93ccbf56bcb39eea55c2d113efc148127c30089d21ce6a5088dbfbcf8f8d75c19456bc962c371548634a95382acb5a0886efc46a87bdc111dc0d1e54084cea0d58054f00762c91d7fe0f0fbcf4c280f29f9cd5999a5e8c6f507f8080d7c7ea9a8685be50722cf1a082f3728dec8d6152cdc72f8da6b1805643c042f4f6780ba79cc8a2165d9d7acec8ab2f421bc3e77b51c62c4bbb262b5674ea7d2dcf9acb894d050e91b052364322a5b08bd9667249571c004fb495da7e24fc5620adda3af6848ccf238911a52bdbff766e4e279ac274afa2c2302faba25b5fe98d972a04aa13f77c0c05d7dd82b0a19f1ded8cf5f99c80e392b0aab1264a29e9fbcf0b69f6b0a9f2332e09ab74dea7277106d0883bb264e279c67e5bc69009225bf4fd1a8532f9392a011b55a73a7cf8d16a59d695b2a65b57fad64a2041f8c28804ee1a48845c5dab757d04f1d95520aa9ddb69904d6529c0e14bd789dfe37067073b3e0e136ae2aebb1c34c55b94ce942f786be4b45f801f35f7c768d91a460b92ffa57ff675f0b4b00437a07f871a8650f21b2bf7c722c1d9e860e8955fef5699ee53a5f6fe46fb9e5e17a1c69fe2538af4718b7215ad2c00c3d420589a8653ee511b809945451fb8205b19ce377c8d0253b05493c557cf2bd8ef208e8fc01beceea1acca38d025f328f28d69bcfaa3adc6d9573a3832dc3f3c758fe08cf9cd0c32acfddae81b3682869e8aa9725b64336252aeb2ee8eb78f0721aa3158217a3009948adb297c5ea45ec26cb6d963c7be47ee1b93fa136ebe73a21936df0148fa311206f8bca2e80719aeca8745ff74ddaad5182644762c66333f942d9a93c467d5f9fd5d0dbbe57480362d4bb0f760294f4eba3e1b08047d256dbda157635d21a43aff3a71f6ad574b402bb36e5270d7ed082c6fbae07771721513ae9ddb22d23b00733046c898ee6ac05ef8a51ce41919e1f241cb98e0592ace68214620ba1a748ef81131661f58f1635713ca2873e150a3e848c8d2ebd039769fda112b73050efa4d1c35dbb46ca5a7b7ccbed1dcded36af272f6838b4c1e7e6778e7e9ca3d794f275d49c9e32e768097349118d2337e7c031ada38d0cc5c04c286ff93083f6d58d73a821118c93432fda9a8c76fa2cbcc093a7decac8e4f001ecc9f67faf1c2f102120f0618469cf653bbd5fcefd4ef2bae86dc4f5393b840f9f47140cf7f46a186c21878a43612a71d3b540b9994f010ab623f878264cf46c7366d0bec5d43d481b47846091fd3cda73a9a28ceb7f839eca695c9f084a16c812475f6575ef2368c88cc6655f47663ef69ce4779fe3ccc4dd85a07a9e4c6f39f42690d231f5727f45c247a53fd8df029fcefda4f328658435892519c17205a3c715ad6bb7387d09a5e387c83f008daf626f5977c66203af1143ef7b59ccd8e3c17bb156bca317861f0b9f222ea63c044075a3a74beaf05c23d0a75caa60397d831bbe507234fff154960faf0f02776d3f9038c955bf0c1ec9c92523cf0b855c18d6ac3b35d437796420ba3dfd581dc6adac64315c1cb1a2c3a45ec4655bb2bd6e0b4a3082281ed0697a213d1d93142e96b4fd57431d2f4547451d008ab58bcd9765ccf3ca3297becd5de9e2be0263cfca09935c9334b5e687bc7e7057dc2ed03873be22200c9fe32a9497dd00a336cf4c723ead302340b5cd1fef8cd88330a9089fc93af4ef739295b94407b291bf33f4f39c936736e1166106428f8796a4b92805f4dfcf46d8692b54e40a9e8584c0eaac4caada87bb33f553eafeef5051b889402176ab766936a38ddd7e5205d2c87e133a02e84ab24ba2d889a4c4db8cbe18b271455e84da716f4a32acdbc0a5aaba25a2ec757c73847dd1c4ccb2967c651e5257692a4553dde227846bfe2977021805f46a287c835ea8dc5", 0x2000, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x10, 0xffffffffffffffda, 0x3ff, {0x0, 0xb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) memfd_create(0x0, 0x0) tkill(r2, 0x13) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0xffffffffffffffff, 0x4}, 0xc) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r5, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r8 = fcntl$dupfd(0xffffffffffffffff, 0x2, 0xffffffffffffffff) read$FUSE(r7, &(0x7f0000000040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r7, &(0x7f0000002140)={0x130, 0xfffffffffffffffe, r9, {0x9, 0xc1, 0x0, '\x00', {0x100, 0x1, 0x9, 0x7, 0x0, 0x0, 0x8000, '\x00', 0x2a8, 0x7ffffffc, 0x5, 0x6, {0x3, 0x7}, {0x4, 0x3e3}, {0x1, 0x1}, {0x1, 0x51bb}, 0xff, 0xffffffa8, 0x2, 0x10000000}}}, 0x130) splice(r7, 0x0, r8, 0x0, 0x2000, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x8, 0xc, &(0x7f0000000380)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x0, 0x8, 0x4, 0x10, 0xfffffffffffffffc}, @map_val={0x18, 0xb, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x6}], &(0x7f00000002c0)='GPL\x00', 0x33d, 0xe6, &(0x7f0000000480)=""/230, 0x41100, 0x4, '\x00', 0x0, @cgroup_skb=0x1, 0xffffffffffffffff, 0x8, &(0x7f0000000400)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000580)={0x3, 0xc, 0x6e, 0x7}, 0x10, r6, 0xffffffffffffffff, 0x6, &(0x7f00000005c0)=[r8], &(0x7f0000000600)=[{0x1, 0x2, 0xe, 0x3}, {0x4, 0x2, 0x1, 0x7}, {0x2, 0x5, 0x10, 0xb}, {0x5, 0x1, 0x7, 0x9}, {0x2, 0x3, 0xb, 0x7}, {0x4, 0x4, 0x1, 0x5}], 0x10, 0xfffffff8}, 0x94) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0xdf}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x0) ptrace(0x10, r2) ptrace$setsig(0x4203, r2, 0xf4d, &(0x7f0000000100)={0xd, 0x4, 0x9}) write$FUSE_INIT(r0, &(0x7f0000000180)={0x50, 0x0, r1, {0x7, 0x2b, 0xffffffde, 0xffffffffa0000004, 0xf3, 0xfffe, 0x2, 0xfffffff6, 0x0, 0x0, 0x8, 0x100}}, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40242, 0x1) close(r0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x85) r11 = syz_open_procfs(0x0, &(0x7f0000000000)='mountinfo\x00') sendfile(r10, r11, 0x0, 0xfff2) kernel console output (not intermixed with test programs): sb 5-1: Manufacturer: syz [ 2606.119098][T21594] usb 5-1: SerialNumber: syz [ 2606.130129][T21594] usb 5-1: config 0 descriptor?? [ 2606.144169][T21594] uvcvideo 5-1:0.0: Found UVC 0.00 device syz (18ec:3288) [ 2606.195582][T21594] uvcvideo 5-1:0.0: No valid video chain found. [ 2606.349145][ T7699] syzkaller0: entered promiscuous mode [ 2606.357036][ T7699] syzkaller0: entered allmulticast mode [ 2606.375628][T21594] usb 5-1: USB disconnect, device number 13 [ 2606.682465][ T7715] binder: BINDER_SET_CONTEXT_MGR already set [ 2606.697414][ T7715] binder: 7711:7715 ioctl 4018620d 80000040 returned -16 [ 2606.943950][ T3458] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2607.203363][T17091] usb 2-1: USB disconnect, device number 81 [ 2607.358026][ T7721] usb usb8: usbfs: process 7721 (syz.4.9188) did not claim interface 2 before use [ 2607.369678][ T7721] openvswitch: netlink: IP tunnel dst address not specified [ 2607.733682][ T7724] l2tp_ppp: sess 2/0: no socket in recv [ 2608.309465][ T7734] pim6reg: entered allmulticast mode [ 2608.350274][ T7742] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9195'. [ 2608.353818][ T7734] pim6reg: left allmulticast mode [ 2608.401750][ T7747] netlink: 388 bytes leftover after parsing attributes in process `syz.4.9196'. [ 2608.440492][ T7736] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9194'. [ 2608.461713][ T7749] netlink: 232 bytes leftover after parsing attributes in process `syz.1.9197'. [ 2608.471652][ T7749] FAULT_INJECTION: forcing a failure. [ 2608.471652][ T7749] name failslab, interval 1, probability 0, space 0, times 0 [ 2608.488583][ T7749] CPU: 0 UID: 0 PID: 7749 Comm: syz.1.9197 Tainted: G L syzkaller #0 PREEMPT(full) [ 2608.488609][ T7749] Tainted: [L]=SOFTLOCKUP [ 2608.488616][ T7749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2608.488627][ T7749] Call Trace: [ 2608.488635][ T7749] [ 2608.488643][ T7749] dump_stack_lvl+0xe8/0x150 [ 2608.488674][ T7749] should_fail_ex+0x412/0x560 [ 2608.488705][ T7749] should_failslab+0xa8/0x100 [ 2608.488731][ T7749] __kmalloc_node_noprof+0xf0/0x7c0 [ 2608.488753][ T7749] ? qdisc_alloc+0x92/0x9e0 [ 2608.488781][ T7749] qdisc_alloc+0x92/0x9e0 [ 2608.488813][ T7749] qdisc_create+0x12c/0xf20 [ 2608.488843][ T7749] tc_modify_qdisc+0x16f0/0x2290 [ 2608.488867][ T7749] ? rcu_is_watching+0x15/0xb0 [ 2608.488900][ T7749] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 2608.488924][ T7749] ? __dev_queue_xmit+0x277/0x3890 [ 2608.488968][ T7749] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 2608.488988][ T7749] rtnetlink_rcv_msg+0x77e/0xbe0 [ 2608.489019][ T7749] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 2608.489046][ T7749] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2608.489069][ T7749] ? ref_tracker_free+0x693/0x840 [ 2608.489094][ T7749] ? __copy_skb_header+0xa3/0x4a0 [ 2608.489116][ T7749] ? __pfx_ref_tracker_free+0x10/0x10 [ 2608.489141][ T7749] ? __skb_clone+0x63/0x7a0 [ 2608.489168][ T7749] netlink_rcv_skb+0x232/0x4b0 [ 2608.489204][ T7749] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2608.489231][ T7749] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2608.489266][ T7749] ? netlink_deliver_tap+0x2e/0x1b0 [ 2608.489298][ T7749] netlink_unicast+0x80f/0x9b0 [ 2608.489328][ T7749] ? __pfx_netlink_unicast+0x10/0x10 [ 2608.489353][ T7749] ? netlink_sendmsg+0x650/0xb40 [ 2608.489377][ T7749] ? skb_put+0x11b/0x210 [ 2608.489397][ T7749] netlink_sendmsg+0x813/0xb40 [ 2608.489430][ T7749] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2608.489458][ T7749] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2608.489485][ T7749] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2608.489507][ T7749] ____sys_sendmsg+0x972/0x9f0 [ 2608.489535][ T7749] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2608.489559][ T7749] ? kstrtoull+0x12f/0x1d0 [ 2608.489593][ T7749] ___sys_sendmsg+0x2a5/0x360 [ 2608.489617][ T7749] ? __pfx____sys_sendmsg+0x10/0x10 [ 2608.489639][ T7749] ? get_pid_task+0x20/0x1f0 [ 2608.489655][ T7749] ? get_pid_task+0x20/0x1f0 [ 2608.489670][ T7749] ? get_pid_task+0x20/0x1f0 [ 2608.489709][ T7749] ? __fget_files+0x2a/0x420 [ 2608.489734][ T7749] ? __fget_files+0x3a0/0x420 [ 2608.489766][ T7749] __sys_sendmsg+0x183/0x260 [ 2608.489788][ T7749] ? __pfx___sys_sendmsg+0x10/0x10 [ 2608.489827][ T7749] __do_fast_syscall_32+0x20d/0x640 [ 2608.489850][ T7749] ? do_fast_syscall_32+0x33/0x70 [ 2608.489869][ T7749] ? asm_int80_emulation+0x1a/0x20 [ 2608.489886][ T7749] ? do_int80_emulation+0x274/0x4d0 [ 2608.489905][ T7749] ? trace_irq_disable+0x3b/0x150 [ 2608.489933][ T7749] do_fast_syscall_32+0x33/0x70 [ 2608.489954][ T7749] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2608.489975][ T7749] RIP: 0023:0xf707ef6c [ 2608.489992][ T7749] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2608.490007][ T7749] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2608.490027][ T7749] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800007c0 [ 2608.490040][ T7749] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2608.490050][ T7749] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2608.490061][ T7749] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2608.490072][ T7749] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2608.490098][ T7749] [ 2609.073014][ T7759] syzkaller0: entered promiscuous mode [ 2609.092922][ T7759] syzkaller0: entered allmulticast mode [ 2609.125934][ T7756] binder_alloc: binder_alloc_mmap_handler: 7755 800a0000-800a2000 already mapped failed -16 [ 2609.163707][ T7764] binder_alloc: binder_alloc_mmap_handler: 7755 800c0000-800c2000 already mapped failed -16 [ 2609.201777][ T7762] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9199'. [ 2609.404066][T17091] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 2609.564703][T17091] usb 3-1: Using ep0 maxpacket: 32 [ 2609.580267][T17091] usb 3-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 2609.593382][T17091] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2609.600804][T17091] usb 3-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 2609.615766][T17091] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2609.654432][T17091] usb 3-1: config 0 descriptor?? [ 2609.766707][ T7770] pim6reg: entered allmulticast mode [ 2609.775216][ T7770] pim6reg: left allmulticast mode [ 2609.923931][ T7770] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9204'. [ 2610.143534][ T3458] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2610.737860][ T7783] ptrace attach of "./syz-executor exec"[5987] was attempted by "./syz-executor exec"[7783] [ 2611.923448][T29471] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 2611.976784][ T7791] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9208'. [ 2612.073261][T29471] usb 2-1: device descriptor read/64, error -71 [ 2612.134166][ T7804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9208'. [ 2612.179719][ T7806] syzkaller0: entered promiscuous mode [ 2612.184896][ T7804] xt_NFQUEUE: number of total queues is 0 [ 2612.238724][ T7806] syzkaller0: entered allmulticast mode [ 2612.293715][T17091] usbhid 3-1:0.0: can't add hid device: -71 [ 2612.304325][T17091] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 2612.342768][T17091] usb 3-1: USB disconnect, device number 6 [ 2612.376677][T29471] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 2612.488981][ T7816] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9216'. [ 2612.523173][T29471] usb 2-1: device descriptor read/64, error -71 [ 2612.634364][T29471] usb usb2-port1: attempt power cycle [ 2612.765747][ T7827] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9217'. [ 2612.993249][T29471] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 2613.049415][T29471] usb 2-1: device descriptor read/8, error -71 [ 2613.743212][T29471] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 2613.787612][ T29] kauditd_printk_skb: 22 callbacks suppressed [ 2613.787630][ T29] audit: type=1326 audit(1774073567.516:17347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.245176][ T29] audit: type=1326 audit(1774073567.516:17348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.274197][T29471] usb 2-1: device descriptor read/8, error -71 [ 2614.286451][ T29] audit: type=1326 audit(1774073567.526:17349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=39 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.318514][ T7848] __nla_validate_parse: 1 callbacks suppressed [ 2614.318532][ T7848] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9223'. [ 2614.334444][T21594] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 2614.360017][ T29] audit: type=1326 audit(1774073567.526:17350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.413049][T29471] usb usb2-port1: unable to enumerate USB device [ 2614.451973][ T29] audit: type=1326 audit(1774073567.526:17351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=40 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.685070][ T29] audit: type=1326 audit(1774073567.526:17352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.734816][ T29] audit: type=1326 audit(1774073567.526:17353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.757299][ T29] audit: type=1326 audit(1774073567.526:17354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.779722][ T29] audit: type=1326 audit(1774073567.526:17355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2614.854553][ T29] audit: type=1326 audit(1774073567.526:17356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.2.9220" exe="/root/syz-executor" sig=0 arch=40000003 syscall=373 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2615.083214][T17091] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 2615.197795][ T981] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 2615.213180][T29471] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 2615.235174][T17091] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2615.251825][T17091] usb 5-1: not running at top speed; connect to a high speed hub [ 2615.274320][T17091] usb 5-1: config 255 has an invalid interface number: 180 but max is 0 [ 2615.285032][T17091] usb 5-1: config 255 has no interface number 0 [ 2615.298106][T17091] usb 5-1: config 255 interface 180 altsetting 9 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 2615.323187][T17091] usb 5-1: config 255 interface 180 has no altsetting 0 [ 2615.338708][T17091] usb 5-1: New USB device found, idVendor=0742, idProduct=200c, bcdDevice=76.8d [ 2615.352176][T17091] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2615.354738][ T981] usb 4-1: config index 0 descriptor too short (expected 3133, got 61) [ 2615.368621][T29471] usb 2-1: Using ep0 maxpacket: 8 [ 2615.373147][T17091] usb 5-1: Product: syz [ 2615.374593][ T981] usb 4-1: config 0 has an invalid interface number: 156 but max is 1 [ 2615.377838][T17091] usb 5-1: Manufacturer: syz [ 2615.377856][T17091] usb 5-1: SerialNumber: syz [ 2615.395760][ T981] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2615.410963][T29471] usb 2-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 2615.423500][T29471] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2615.435646][ T981] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2615.445243][T29471] usb 2-1: Product: syz [ 2615.449541][T29471] usb 2-1: Manufacturer: syz [ 2615.454475][ T981] usb 4-1: config 0 has no interface number 0 [ 2615.461088][T29471] usb 2-1: SerialNumber: syz [ 2615.465821][ T981] usb 4-1: config 0 interface 156 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 2615.481268][ T981] usb 4-1: New USB device found, idVendor=abcd, idProduct=cde3, bcdDevice= 5.b9 [ 2615.491508][T29471] usb 2-1: config 0 descriptor?? [ 2615.497290][ T981] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2615.508955][T29471] gspca_main: sq905-2.14.0 probing 2770:9120 [ 2615.519096][ T981] usb 4-1: config 0 descriptor?? [ 2615.533655][ T981] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2615.541349][ T981] usb 4-1: MIDIStreaming interface descriptor not found [ 2615.626086][T17091] usb 5-1: USB disconnect, device number 14 [ 2615.708960][T29471] gspca_sq905: sq905_command: usb_control_msg failed (-71) [ 2615.720211][T29471] sq905 2-1:0.0: probe with driver sq905 failed with error -71 [ 2615.756426][T29471] usb 2-1: USB disconnect, device number 86 [ 2616.045323][ T7855] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9226'. [ 2616.121410][T29471] usb 4-1: USB disconnect, device number 93 [ 2616.384948][T21594] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2616.405397][T21594] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 2616.427412][T21594] usb 3-1: can't read configurations, error -71 [ 2616.699574][ T7873] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9232'. [ 2616.958252][ T7878] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2617.183658][T26449] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2617.451678][ T7891] vlan2: entered allmulticast mode [ 2617.456987][ T7891] vlan0: entered allmulticast mode [ 2617.462473][ T7891] veth0_vlan: entered allmulticast mode [ 2617.666299][ T7895] netlink: 96 bytes leftover after parsing attributes in process `syz.3.9239'. [ 2617.772428][ T7901] syzkaller1: entered promiscuous mode [ 2617.798106][ T7901] syzkaller1: entered allmulticast mode [ 2617.965274][ T7905] binder: 7903:7905 ioctl 4018620d 0 returned -22 [ 2618.040677][ T7907] usb usb8: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2618.841476][ T7917] FAULT_INJECTION: forcing a failure. [ 2618.841476][ T7917] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2618.864304][ T7917] CPU: 0 UID: 0 PID: 7917 Comm: syz.2.9246 Tainted: G L syzkaller #0 PREEMPT(full) [ 2618.864335][ T7917] Tainted: [L]=SOFTLOCKUP [ 2618.864343][ T7917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2618.864355][ T7917] Call Trace: [ 2618.864364][ T7917] [ 2618.864372][ T7917] dump_stack_lvl+0xe8/0x150 [ 2618.864403][ T7917] should_fail_ex+0x412/0x560 [ 2618.864444][ T7917] _copy_from_user+0x2d/0xb0 [ 2618.864466][ T7917] userfaultfd_ioctl+0xa61/0x5130 [ 2618.864495][ T7917] ? kasan_save_track+0x4f/0x80 [ 2618.864515][ T7917] ? kasan_save_track+0x3e/0x80 [ 2618.864533][ T7917] ? kfree+0x1c1/0x630 [ 2618.864548][ T7917] ? tomoyo_path_number_perm+0x501/0x630 [ 2618.864571][ T7917] ? security_file_ioctl_compat+0xc3/0x2a0 [ 2618.864591][ T7917] ? __do_fast_syscall_32+0x20d/0x640 [ 2618.864610][ T7917] ? do_fast_syscall_32+0x33/0x70 [ 2618.864627][ T7917] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2618.864653][ T7917] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 2618.864695][ T7917] ? kasan_quarantine_put+0xbb/0x1f0 [ 2618.864718][ T7917] ? tomoyo_path_number_perm+0x219/0x630 [ 2618.864738][ T7917] ? tomoyo_path_number_perm+0x219/0x630 [ 2618.864761][ T7917] ? do_vfs_ioctl+0x1166/0x1530 [ 2618.864781][ T7917] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 2618.864827][ T7917] ? __fget_files+0x2a/0x420 [ 2618.864853][ T7917] ? __fget_files+0x3a0/0x420 [ 2618.864873][ T7917] ? __fget_files+0x2a/0x420 [ 2618.864897][ T7917] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 2618.864920][ T7917] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 2618.864942][ T7917] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 2618.864963][ T7917] ? __fget_files+0x3a0/0x420 [ 2618.864989][ T7917] ? fput+0xa0/0xd0 [ 2618.865010][ T7917] ? ksys_write+0x242/0x270 [ 2618.865036][ T7917] __do_fast_syscall_32+0x20d/0x640 [ 2618.865055][ T7917] ? do_fast_syscall_32+0x33/0x70 [ 2618.865072][ T7917] ? asm_int80_emulation+0x1a/0x20 [ 2618.865087][ T7917] ? do_int80_emulation+0x274/0x4d0 [ 2618.865104][ T7917] ? trace_irq_disable+0x3b/0x150 [ 2618.865130][ T7917] do_fast_syscall_32+0x33/0x70 [ 2618.865148][ T7917] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2618.865167][ T7917] RIP: 0023:0xf709ef6c [ 2618.865181][ T7917] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2618.865196][ T7917] RSP: 002b:00000000f544b50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 2618.865214][ T7917] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c028aa03 [ 2618.865225][ T7917] RDX: 0000000080000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 2618.865235][ T7917] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2618.865244][ T7917] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2618.865254][ T7917] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2618.865276][ T7917] [ 2619.775978][ T6102] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 2619.914563][ T7929] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 2619.954838][ T6102] usb 2-1: config 0 has an invalid interface number: 3 but max is 0 [ 2619.962989][ T6102] usb 2-1: config 0 has no interface number 0 [ 2619.975748][ T6102] usb 2-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 2619.993720][ T6102] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2620.001724][ T6102] usb 2-1: Product: syz [ 2620.006403][ T6102] usb 2-1: Manufacturer: syz [ 2620.012223][ T6102] usb 2-1: SerialNumber: syz [ 2620.023862][ T6102] usb 2-1: config 0 descriptor?? [ 2620.032640][ T6102] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 2620.043160][T21594] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 2620.055399][ T6102] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2620.065454][ T6102] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 2620.075927][ T6102] usb 2-1: media controller created [ 2620.100201][ T6102] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2620.162541][ T6102] DVB: Unable to find symbol mt352_attach() [ 2620.194944][T21594] usb 3-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 2620.215942][T21594] usb 3-1: config 0 interface 0 has no altsetting 0 [ 2620.238420][T21594] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2620.249684][ T6102] DVB: Unable to find symbol nxt6000_attach() [ 2620.255986][T21594] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2620.266078][ T6102] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 2620.277313][T21594] usb 3-1: Product: syz [ 2620.281721][T21594] usb 3-1: Manufacturer: syz [ 2620.289225][T21594] usb 3-1: SerialNumber: syz [ 2620.296804][ T6102] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input194 [ 2620.314651][T21594] usb 3-1: config 0 descriptor?? [ 2620.323489][ T6102] dvb-usb: schedule remote query interval to 1000 msecs. [ 2620.331049][ T6102] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 2620.341557][ T7924] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 2620.348937][ T6102] dvb-usb: bulk message failed: -22 (7/0) [ 2620.359741][T21594] usb 3-1: selecting invalid altsetting 0 [ 2620.365536][ T6102] dvb-usb: bulk message failed: -22 (7/0) [ 2620.396219][ T6102] usb 2-1: USB disconnect, device number 87 [ 2620.497828][ T6102] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 2620.568852][T22761] usb 3-1: USB disconnect, device number 9 [ 2620.718972][ T7940] netlink: 6 bytes leftover after parsing attributes in process `syz.4.9253'. [ 2620.872615][ T7948] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9257'. [ 2620.936645][ T7946] debugfs: 'netdev:nicvf0' already exists in 'phy67' [ 2621.164077][ T7959] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9261'. [ 2621.321120][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 2621.321137][ T29] audit: type=1326 audit(1774073575.086:17368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.392517][ T29] audit: type=1326 audit(1774073575.116:17369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.415780][ T29] audit: type=1326 audit(1774073575.116:17370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.457026][ T29] audit: type=1326 audit(1774073575.116:17371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.489397][ T29] audit: type=1326 audit(1774073575.116:17372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.523484][ T29] audit: type=1326 audit(1774073575.116:17373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=366 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.603238][T29471] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 2621.643638][ T29] audit: type=1326 audit(1774073575.116:17374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.725180][ T29] audit: type=1326 audit(1774073575.126:17375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.795190][T29471] usb 2-1: config index 0 descriptor too short (expected 3133, got 61) [ 2621.803671][T29471] usb 2-1: config 0 has an invalid interface number: 156 but max is 1 [ 2621.820806][ T29] audit: type=1326 audit(1774073575.126:17376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2621.857484][T29471] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2621.868787][ T29] audit: type=1326 audit(1774073575.126:17377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7961 comm="syz.0.9262" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709ef6c code=0x7ffc0000 [ 2622.022343][T29471] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2622.085772][T29471] usb 2-1: config 0 has no interface number 0 [ 2622.091937][T29471] usb 2-1: config 0 interface 156 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 2622.118510][T29471] usb 2-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2622.153365][T29471] usb 2-1: New USB device found, idVendor=abcd, idProduct=cde3, bcdDevice= 5.b9 [ 2622.167577][T29471] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2622.191427][T29471] usb 2-1: config 0 descriptor?? [ 2622.265129][T29471] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 2622.274648][T29471] usb 2-1: MIDIStreaming interface descriptor not found [ 2622.624419][ T6102] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 2622.804404][ T6102] usb 3-1: Using ep0 maxpacket: 32 [ 2622.814352][T17091] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 2622.827238][ T6102] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 2622.843239][ T6102] usb 3-1: config 0 has no interface number 0 [ 2622.855077][ T6102] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 2622.873707][ T6102] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2622.887328][ T6102] usb 3-1: Product: syz [ 2622.891502][ T6102] usb 3-1: Manufacturer: syz [ 2622.903257][ T6102] usb 3-1: SerialNumber: syz [ 2622.916567][ T6102] usb 3-1: config 0 descriptor?? [ 2622.934880][ T6102] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 2622.953279][ T6102] usb 3-1: selecting invalid altsetting 1 [ 2622.959234][ T6102] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 2622.973925][T17091] usb 4-1: Using ep0 maxpacket: 32 [ 2622.991991][T17091] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 2623.004957][ T6102] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2623.023147][T17091] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2623.033607][ T6102] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 2623.041918][T17091] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 2623.063137][ T6102] usb 3-1: media controller created [ 2623.081472][T17091] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2623.097391][T14343] Bluetooth: hci1: command 0x0406 tx timeout [ 2623.106089][T17091] usb 4-1: config 0 descriptor?? [ 2623.116361][ T6102] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2623.164423][ T7996] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9271'. [ 2623.221438][ T7969] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9264'. [ 2623.520207][T22761] usb 2-1: USB disconnect, device number 88 [ 2624.294400][ T6102] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 2624.304882][ T6102] zl10353_read_register: readreg error (reg=127, ret==-110) [ 2624.392442][ T8015] ptrace attach of "./syz-executor exec"[6901] was attempted by "./syz-executor exec"[8015] [ 2625.014282][ T8020] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9277'. [ 2625.268651][T29471] usb 3-1: USB disconnect, device number 10 [ 2625.609278][ T8022] pim6reg: entered allmulticast mode [ 2625.658352][ T8022] pim6reg: left allmulticast mode [ 2625.771327][T17091] usbhid 4-1:0.0: can't add hid device: -71 [ 2625.790133][T17091] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2625.831300][ T8022] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9279'. [ 2625.862200][T17091] usb 4-1: USB disconnect, device number 94 [ 2625.943209][ T8009] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 2625.980299][ T8040] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9282'. [ 2626.175600][ T8009] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 2626.184780][ T8009] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2626.203595][ T8009] usb 2-1: Product: syz [ 2626.213196][ T8009] usb 2-1: Manufacturer: syz [ 2626.217806][ T8009] usb 2-1: SerialNumber: syz [ 2626.241162][ T8045] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9284'. [ 2626.634030][ T8009] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 2626.654107][ T8009] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 2627.044337][T29471] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 2627.203581][T29471] usb 3-1: Using ep0 maxpacket: 32 [ 2627.213371][T29471] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 2627.221695][T29471] usb 3-1: config 0 has no interface number 0 [ 2627.244434][T29471] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 2627.318073][T29471] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 2627.336741][T29471] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2627.367125][T29471] usb 3-1: Product: syz [ 2627.398022][T29471] usb 3-1: Manufacturer: syz [ 2627.415178][T29471] usb 3-1: SerialNumber: syz [ 2627.442144][T29471] usb 3-1: config 0 descriptor?? [ 2627.512846][ T8051] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 2627.999222][ T8009] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 2628.064965][ T3449] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2628.414552][ T8031] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2628.426452][ T8031] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2628.573375][ T8047] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 2628.695888][ T8069] tipc: Enabled bearer , priority 0 [ 2628.704285][ T8069] syzkaller0: entered promiscuous mode [ 2628.709849][ T8069] syzkaller0: entered allmulticast mode [ 2628.727764][ T8069] tipc: Resetting bearer [ 2628.775687][ T8067] tipc: Resetting bearer [ 2628.786082][T29471] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 2628.813789][T29471] asix 3-1:0.188: probe with driver asix failed with error -61 [ 2628.822283][ T8067] tipc: Disabling bearer [ 2628.903347][T17091] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 2629.086934][ T8078] netlink: 179596 bytes leftover after parsing attributes in process `syz.0.9292'. [ 2629.183255][T17091] usb 4-1: Using ep0 maxpacket: 32 [ 2629.191371][T17091] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 2629.202884][T17091] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2629.239577][T17091] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 2629.249714][T17091] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2629.278704][T17091] usb 4-1: config 0 descriptor?? [ 2629.286836][ T8009] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001018. ret = -EPROTO [ 2629.303898][ T8009] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 2629.334505][ T8009] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 2629.362052][ T8009] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 2629.380269][ T8009] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 2629.403219][T21594] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 2629.418545][ T8009] usb 2-1: USB disconnect, device number 89 [ 2629.587247][T21594] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2629.596800][T21594] usb 5-1: config 129 has an invalid interface number: 135 but max is 0 [ 2629.605810][T21594] usb 5-1: config 129 has an invalid interface number: 5 but max is 0 [ 2629.614272][T21594] usb 5-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 2629.624850][T21594] usb 5-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 2629.637909][T21594] usb 5-1: config 129 has no interface number 0 [ 2629.653644][T21594] usb 5-1: config 129 has no interface number 1 [ 2629.667136][T21594] usb 5-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 2629.699509][T21594] usb 5-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 2629.727321][T21594] usb 5-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 2629.962242][T21594] usb 5-1: config 129 interface 135 has no altsetting 0 [ 2629.999782][T21594] usb 5-1: config 129 interface 5 has no altsetting 0 [ 2630.054290][T21594] usb 5-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.62 [ 2630.064887][T21594] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2630.088049][T21594] usb 5-1: SerialNumber: Е [ 2630.166387][T29471] usb 3-1: USB disconnect, device number 11 [ 2630.189038][ T8087] IPVS: set_ctl: invalid protocol: 1 10.1.1.0:20000 [ 2630.203487][ T8087] tipc: Enabled bearer , priority 0 [ 2630.211854][ T8087] syzkaller0: entered promiscuous mode [ 2630.219082][ T8087] syzkaller0: entered allmulticast mode [ 2630.306626][ T8089] tipc: Resetting bearer [ 2630.331283][T21594] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 2630.339712][T21594] usb 5-1: MIDIStreaming interface descriptor not found [ 2630.372043][ T8091] ptrace attach of "./syz-executor exec"[6901] was attempted by "./syz-executor exec"[8091] [ 2630.476951][ T8086] tipc: Resetting bearer [ 2630.552859][T21594] usb 5-1: USB disconnect, device number 15 [ 2630.630354][ T8086] tipc: Disabling bearer [ 2630.958431][ T8104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9300'. [ 2631.843217][T22761] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 2631.976759][T22761] usb 3-1: device descriptor read/64, error -71 [ 2631.994055][T14343] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2632.020432][T14343] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2632.028856][T14343] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2632.037098][T14343] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2632.046178][T14343] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2632.139336][T17091] usbhid 4-1:0.0: can't add hid device: -71 [ 2632.153220][T17091] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2632.213978][T17091] usb 4-1: USB disconnect, device number 95 [ 2632.243243][T22761] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 2632.393737][T22761] usb 3-1: device descriptor read/64, error -71 [ 2632.460643][ T8110] chnl_net:caif_netlink_parms(): no params data found [ 2632.472959][ T8121] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 2632.513469][T22761] usb usb3-port1: attempt power cycle [ 2632.563735][ T8124] syzkaller1: entered promiscuous mode [ 2632.569244][ T8124] syzkaller1: entered allmulticast mode [ 2632.602129][ T8110] bridge0: port 1(bridge_slave_0) entered blocking state [ 2632.610106][ T8110] bridge0: port 1(bridge_slave_0) entered disabled state [ 2632.617579][ T8110] bridge_slave_0: entered allmulticast mode [ 2632.625348][ T8110] bridge_slave_0: entered promiscuous mode [ 2632.633713][ T8110] bridge0: port 2(bridge_slave_1) entered blocking state [ 2632.641107][ T8110] bridge0: port 2(bridge_slave_1) entered disabled state [ 2632.648524][ T8110] bridge_slave_1: entered allmulticast mode [ 2632.659366][ T8110] bridge_slave_1: entered promiscuous mode [ 2632.703350][ T8110] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2632.717552][ T8110] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2632.745701][ T8110] team0: Port device team_slave_0 added [ 2632.753860][ T8110] team0: Port device team_slave_1 added [ 2632.777996][ T8110] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2632.785235][ T8110] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2632.812164][ T8110] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2632.824742][ T8110] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2632.831689][ T8110] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2632.857755][ T8110] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2632.873334][T22761] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 2632.902795][ T8110] hsr_slave_0: entered promiscuous mode [ 2632.909102][ T8110] hsr_slave_1: entered promiscuous mode [ 2632.914051][T22761] usb 3-1: device descriptor read/8, error -71 [ 2632.916691][ T8110] debugfs: 'hsr0' already exists in 'hsr' [ 2632.926752][ T8110] Cannot create hsr debugfs directory [ 2632.933504][T30517] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 2633.106281][T30517] usb 4-1: Using ep0 maxpacket: 32 [ 2633.114121][T30517] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2633.125611][T30517] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2633.135127][T30517] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2633.148290][T30517] usb 4-1: config 0 interface 0 has no altsetting 1 [ 2633.156811][T30517] usb 4-1: New USB device found, idVendor=1199, idProduct=9004, bcdDevice= f.8c [ 2633.166089][T22761] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 2633.174456][T30517] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2633.182461][T30517] usb 4-1: Product: syz [ 2633.187316][T30517] usb 4-1: Manufacturer: syz [ 2633.191926][T30517] usb 4-1: SerialNumber: syz [ 2633.199255][T30517] usb 4-1: config 0 descriptor?? [ 2633.204911][T22761] usb 3-1: device descriptor read/8, error -71 [ 2633.314485][T22761] usb usb3-port1: unable to enumerate USB device [ 2633.344153][ T8110] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 2633.355382][ T8110] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 2633.365971][ T8110] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 2633.377549][ T8110] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 2633.411077][ T8110] bridge0: port 2(bridge_slave_1) entered blocking state [ 2633.418329][ T8110] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2633.425827][ T8110] bridge0: port 1(bridge_slave_0) entered blocking state [ 2633.432967][ T8110] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2633.446680][ T8128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2633.455592][ T8128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2633.471394][T30517] usb 4-1: USB disconnect, device number 96 [ 2633.551314][ T8110] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2633.576719][ T3456] bridge0: port 1(bridge_slave_0) entered disabled state [ 2633.585718][ T3456] bridge0: port 2(bridge_slave_1) entered disabled state [ 2633.605447][ T8110] 8021q: adding VLAN 0 to HW filter on device team0 [ 2633.617892][ T3456] bridge0: port 1(bridge_slave_0) entered blocking state [ 2633.625055][ T3456] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2633.641122][ T3456] bridge0: port 2(bridge_slave_1) entered blocking state [ 2633.648351][ T3456] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2633.810575][ T8110] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2633.916611][ T8110] veth0_vlan: entered promiscuous mode [ 2633.956415][ T8110] veth1_vlan: entered promiscuous mode [ 2634.028393][ T8110] veth0_macvtap: entered promiscuous mode [ 2634.065595][ T8110] veth1_macvtap: entered promiscuous mode [ 2634.132215][ T8110] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2634.140149][ T2087] Bluetooth: hci0: command tx timeout [ 2634.212615][ T8110] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2634.256019][ T3457] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2634.282707][ T3457] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2634.304340][T26449] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2634.345205][ T8151] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9313'. [ 2634.627243][ T8153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9314'. [ 2634.741329][T26449] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2635.349976][ T3449] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2635.369513][ T3449] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2635.509730][ T3457] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2635.585419][ T3457] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2636.027893][ T8166] FAULT_INJECTION: forcing a failure. [ 2636.027893][ T8166] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2636.316573][ T8166] CPU: 1 UID: 0 PID: 8166 Comm: syz.3.9317 Tainted: G L syzkaller #0 PREEMPT(full) [ 2636.316594][ T8166] Tainted: [L]=SOFTLOCKUP [ 2636.316599][ T8166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2636.316606][ T8166] Call Trace: [ 2636.316611][ T8166] [ 2636.316617][ T8166] dump_stack_lvl+0xe8/0x150 [ 2636.316637][ T8166] should_fail_ex+0x412/0x560 [ 2636.316656][ T8166] _copy_to_user+0x31/0xb0 [ 2636.316669][ T8166] simple_read_from_buffer+0xe1/0x170 [ 2636.316688][ T8166] proc_fail_nth_read+0x1bb/0x230 [ 2636.316705][ T8166] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2636.316722][ T8166] ? rw_verify_area+0x2a6/0x4d0 [ 2636.316734][ T8166] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2636.316749][ T8166] vfs_read+0x20c/0xa70 [ 2636.316760][ T8166] ? fdget_pos+0x246/0x320 [ 2636.316778][ T8166] ? __pfx___mutex_lock+0x10/0x10 [ 2636.316791][ T8166] ? __pfx_vfs_read+0x10/0x10 [ 2636.316803][ T8166] ? __fget_files+0x2a/0x420 [ 2636.316820][ T8166] ? __fget_files+0x3a0/0x420 [ 2636.316835][ T8166] ? __fget_files+0x2a/0x420 [ 2636.316854][ T8166] ksys_read+0x150/0x270 [ 2636.316866][ T8166] ? __pfx_ksys_read+0x10/0x10 [ 2636.316880][ T8166] ? asm_int80_emulation+0x1a/0x20 [ 2636.316893][ T8166] do_int80_emulation+0x173/0x4d0 [ 2636.316906][ T8166] ? trace_irq_disable+0x3b/0x150 [ 2636.316921][ T8166] ? asm_int80_emulation+0x1a/0x20 [ 2636.316931][ T8166] ? clear_bhb_loop+0x40/0x90 [ 2636.316941][ T8166] ? clear_bhb_loop+0x40/0x90 [ 2636.316954][ T8166] asm_int80_emulation+0x1a/0x20 [ 2636.316964][ T8166] RIP: 0023:0xf7145cab [ 2636.316974][ T8166] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 2636.316984][ T8166] RSP: 002b:00000000f53fd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2636.316995][ T8166] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000f53fd5d0 [ 2636.317003][ T8166] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 2636.317009][ T8166] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2636.317015][ T8166] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2636.317021][ T8166] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2636.317035][ T8166] [ 2636.553844][ T2087] Bluetooth: hci0: command tx timeout [ 2637.403192][T17091] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 2637.424038][ T8185] tipc: Enabled bearer , priority 0 [ 2637.443640][ T8185] syzkaller0: entered promiscuous mode [ 2637.457017][ T8185] syzkaller0: entered allmulticast mode [ 2637.533223][T17091] usb 2-1: device descriptor read/64, error -71 [ 2637.541665][ T8185] tipc: Resetting bearer [ 2637.565405][ T8184] tipc: Resetting bearer [ 2637.760887][ T8184] tipc: Disabling bearer [ 2637.785799][T17091] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 2637.795996][T21594] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 2637.933207][T17091] usb 2-1: device descriptor read/64, error -71 [ 2638.043660][T17091] usb usb2-port1: attempt power cycle [ 2638.433615][T17091] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 2638.463845][T17091] usb 2-1: device descriptor read/8, error -71 [ 2638.613485][ T2087] Bluetooth: hci0: command tx timeout [ 2638.682350][ T8209] pim6reg: entered allmulticast mode [ 2638.712489][T17091] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 2638.720497][ T8209] pim6reg: left allmulticast mode [ 2638.753294][T17091] usb 2-1: device descriptor read/8, error -71 [ 2638.778000][ T8209] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9330'. [ 2638.803355][ T3449] wlan0: Trigger new scan to find an IBSS to join [ 2638.860891][ T8220] tipc: Enabled bearer , priority 0 [ 2638.869006][T17091] usb usb2-port1: unable to enumerate USB device [ 2638.878299][ T8220] syzkaller0: entered promiscuous mode [ 2638.893141][ T8220] syzkaller0: entered allmulticast mode [ 2638.922950][ T8220] tipc: Resetting bearer [ 2638.935372][ T3454] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2638.962663][ T8219] tipc: Resetting bearer [ 2639.014675][ T8219] tipc: Disabling bearer [ 2639.453437][T29471] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 2639.533220][T21594] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 2639.553143][T17091] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 2639.613271][T29471] usb 4-1: Using ep0 maxpacket: 32 [ 2639.619847][T29471] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 2639.631101][T29471] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2639.638714][T29471] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 2639.647975][T29471] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2639.661796][T29471] usb 4-1: config 0 descriptor?? [ 2639.683185][T21594] usb 5-1: Using ep0 maxpacket: 32 [ 2639.689917][T21594] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 2639.701349][T21594] usb 5-1: config 0 interface 0 has no altsetting 0 [ 2639.708610][T21594] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 2639.719266][T21594] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2639.727977][T17091] usb 3-1: config index 0 descriptor too short (expected 3133, got 61) [ 2639.739203][T21594] usb 5-1: config 0 descriptor?? [ 2639.744411][T17091] usb 3-1: config 0 has an invalid interface number: 156 but max is 1 [ 2639.752580][T17091] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2639.762994][T17091] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2639.777249][T17091] usb 3-1: config 0 has no interface number 0 [ 2639.783487][T17091] usb 3-1: config 0 interface 156 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 2639.793445][T17091] usb 3-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2639.806472][T17091] usb 3-1: New USB device found, idVendor=abcd, idProduct=cde3, bcdDevice= 5.b9 [ 2639.815827][T17091] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2639.826581][T17091] usb 3-1: config 0 descriptor?? [ 2639.836220][T17091] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 2639.843290][T17091] usb 3-1: MIDIStreaming interface descriptor not found [ 2640.557094][ T8226] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9336'. [ 2640.671481][T22761] usb 3-1: USB disconnect, device number 17 [ 2640.693448][ T2087] Bluetooth: hci0: command tx timeout [ 2640.972072][ T8241] ptrace attach of "./syz-executor exec"[8110] was attempted by "./syz-executor exec"[8241] [ 2641.222100][ T8248] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9338'. [ 2641.545963][ T8251] syzkaller0: entered promiscuous mode [ 2641.559772][ T8251] syzkaller0: entered allmulticast mode [ 2641.743333][T26449] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2641.857825][ T8257] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9341'. [ 2641.997408][ T8261] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9342'. [ 2642.034044][ T8261] veth1_to_team: entered promiscuous mode [ 2642.133350][T26449] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2642.378405][ T8263] pim6reg: entered allmulticast mode [ 2642.525387][ T8263] pim6reg: left allmulticast mode [ 2642.555314][ T8264] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9343'. [ 2643.059594][T21594] usbhid 5-1:0.0: can't add hid device: -71 [ 2643.059692][T21594] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2643.075018][T21594] usb 5-1: USB disconnect, device number 16 [ 2643.242028][T29471] usbhid 4-1:0.0: can't add hid device: -71 [ 2643.242112][T29471] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2643.244769][T29471] usb 4-1: USB disconnect, device number 97 [ 2643.454613][ T8285] netlink: 'syz.3.9349': attribute type 10 has an invalid length. [ 2643.511840][ T8285] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9349'. [ 2643.553163][ T8285] batadv0: entered promiscuous mode [ 2643.558405][ T8285] batadv0: entered allmulticast mode [ 2643.582601][ T8285] bridge0: port 3(batadv0) entered blocking state [ 2643.596383][ T8285] bridge0: port 3(batadv0) entered disabled state [ 2643.607805][ T8285] bridge0: port 3(batadv0) entered blocking state [ 2643.614467][ T8285] bridge0: port 3(batadv0) entered forwarding state [ 2643.768235][ T8295] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9352'. [ 2643.814599][T26449] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 2643.824398][T26449] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 2643.865554][ T8299] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9354'. [ 2643.901118][ T8299] hsr_slave_1 (unregistering): left promiscuous mode [ 2643.903793][T21594] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 2643.963176][T17091] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 2644.031069][ T8303] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.9355'. [ 2644.054250][T21594] usb 3-1: device descriptor read/64, error -71 [ 2644.068060][ T2087] Bluetooth: hci0: unexpected subevent 0x01 length: 11 < 18 [ 2644.103184][T17091] usb 2-1: device descriptor read/64, error -71 [ 2644.293317][T21594] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 2644.343231][T17091] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 2644.391555][ T8309] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9358'. [ 2644.428366][T21594] usb 3-1: device descriptor read/64, error -71 [ 2644.474025][T17091] usb 2-1: device descriptor read/64, error -71 [ 2644.563358][T21594] usb usb3-port1: attempt power cycle [ 2644.596166][T17091] usb usb2-port1: attempt power cycle [ 2644.904119][T21594] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 2644.946062][T17091] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 2644.954398][T21594] usb 3-1: device descriptor read/8, error -71 [ 2644.983870][T17091] usb 2-1: device descriptor read/8, error -71 [ 2645.205658][T21594] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 2645.234064][T17091] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 2645.243676][T21594] usb 3-1: device descriptor read/8, error -71 [ 2645.283932][T17091] usb 2-1: device descriptor read/8, error -71 [ 2645.365476][T21594] usb usb3-port1: unable to enumerate USB device [ 2645.393508][T17091] usb usb2-port1: unable to enumerate USB device [ 2646.042856][ T8350] netlink: 164 bytes leftover after parsing attributes in process `syz.1.9363'. [ 2646.052206][ T8350] netlink: 36 bytes leftover after parsing attributes in process `syz.1.9363'. [ 2646.743325][ T8361] input: syz1 as /devices/virtual/input/input195 [ 2647.449958][ T8373] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9370'. [ 2648.593167][T21594] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 2648.753172][T21594] usb 3-1: Using ep0 maxpacket: 8 [ 2648.766839][T21594] usb 3-1: config 5 has an invalid interface number: 185 but max is 1 [ 2648.787655][T21594] usb 3-1: config 5 has an invalid descriptor of length 210, skipping remainder of the config [ 2648.810624][T21594] usb 3-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 2648.832735][T21594] usb 3-1: config 5 has no interface number 0 [ 2648.849784][T21594] usb 3-1: config 5 interface 185 altsetting 1 endpoint 0xC has an invalid bInterval 28, changing to 8 [ 2648.908950][T21594] usb 3-1: config 5 interface 185 altsetting 1 endpoint 0xC has invalid wMaxPacketSize 0 [ 2648.933526][T21594] usb 3-1: config 5 interface 185 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 2648.966515][T21594] usb 3-1: config 5 interface 185 has no altsetting 0 [ 2648.983283][T22761] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 2649.010454][T21594] usb 3-1: string descriptor 0 read error: -22 [ 2649.020791][T21594] usb 3-1: New USB device found, idVendor=04da, idProduct=2500, bcdDevice=83.2e [ 2649.048126][T21594] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2649.164536][T22761] usb 2-1: config index 0 descriptor too short (expected 3133, got 61) [ 2649.172914][T22761] usb 2-1: config 0 has an invalid interface number: 156 but max is 1 [ 2649.183410][ T3456] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2649.187117][T22761] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2649.205962][T22761] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2649.222053][T22761] usb 2-1: config 0 has no interface number 0 [ 2649.235906][T22761] usb 2-1: config 0 interface 156 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 2649.246116][T22761] usb 2-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2649.259583][T22761] usb 2-1: New USB device found, idVendor=abcd, idProduct=cde3, bcdDevice= 5.b9 [ 2649.274870][T22761] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2649.361062][ T8387] blktrace: Concurrent blktraces are not allowed on nullb0 [ 2649.425822][T22761] usb 2-1: config 0 descriptor?? [ 2649.459715][T22761] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 2649.473681][T22761] usb 2-1: MIDIStreaming interface descriptor not found [ 2649.998441][ T8395] input: syz0 as /devices/virtual/input/input196 [ 2650.460210][ T8403] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9380'. [ 2650.761989][ T8414] netlink: 'syz.0.9382': attribute type 1 has an invalid length. [ 2650.775935][ T8414] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9382'. [ 2650.803977][T17091] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 2650.833136][ T8414] erspan1: entered allmulticast mode [ 2650.963429][T17091] usb 4-1: Using ep0 maxpacket: 32 [ 2650.975448][T17091] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 2650.986853][T17091] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2650.999288][T17091] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 2651.019573][T17091] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2651.048249][T17091] usb 4-1: config 0 descriptor?? [ 2651.450524][ T8009] usb 2-1: USB disconnect, device number 98 [ 2651.562564][T21594] usb 3-1: USB disconnect, device number 22 [ 2651.653754][ T8435] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9385'. [ 2651.737524][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 2651.744264][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 2652.920592][ T8455] FAULT_INJECTION: forcing a failure. [ 2652.920592][ T8455] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2653.027604][ T8457] fuse: Bad value for 'fd' [ 2653.125184][ T8459] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9390'. [ 2653.190506][ T8455] CPU: 1 UID: 0 PID: 8455 Comm: syz.1.9388 Tainted: G L syzkaller #0 PREEMPT(full) [ 2653.190526][ T8455] Tainted: [L]=SOFTLOCKUP [ 2653.190530][ T8455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2653.190537][ T8455] Call Trace: [ 2653.190542][ T8455] [ 2653.190548][ T8455] dump_stack_lvl+0xe8/0x150 [ 2653.190568][ T8455] should_fail_ex+0x412/0x560 [ 2653.190586][ T8455] _copy_from_iter+0x1d3/0x1670 [ 2653.190606][ T8455] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2653.190622][ T8455] ? __pfx_policy_nodemask+0x10/0x10 [ 2653.190638][ T8455] ? __pfx__copy_from_iter+0x10/0x10 [ 2653.190657][ T8455] ? set_page_refcounted+0xa0/0x1e0 [ 2653.190670][ T8455] ? page_copy_sane+0x4e/0x270 [ 2653.190686][ T8455] copy_page_from_iter+0xdd/0x170 [ 2653.190705][ T8455] tun_get_user+0x1d4b/0x3dd0 [ 2653.190717][ T8455] ? tun_get_user+0x6ff/0x3dd0 [ 2653.190735][ T8455] ? aa_file_perm+0x50e/0x15e0 [ 2653.190744][ T8455] ? __pfx_tun_get_user+0x10/0x10 [ 2653.190754][ T8455] ? aa_file_perm+0x192/0x15e0 [ 2653.190772][ T8455] ? ref_tracker_alloc+0x35c/0x4c0 [ 2653.190789][ T8455] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 2653.190807][ T8455] ? tun_get+0x1c/0x2f0 [ 2653.190819][ T8455] ? tun_get+0x1c/0x2f0 [ 2653.190829][ T8455] ? tun_get+0x1c/0x2f0 [ 2653.190844][ T8455] tun_chr_write_iter+0x113/0x200 [ 2653.190857][ T8455] vfs_write+0x61d/0xb90 [ 2653.190872][ T8455] ? __pfx_vfs_write+0x10/0x10 [ 2653.190888][ T8455] ? __fget_files+0x2a/0x420 [ 2653.190907][ T8455] ksys_write+0x150/0x270 [ 2653.190920][ T8455] ? __pfx_ksys_write+0x10/0x10 [ 2653.190933][ T8455] ? asm_int80_emulation+0x1a/0x20 [ 2653.190946][ T8455] do_int80_emulation+0x173/0x4d0 [ 2653.190959][ T8455] ? trace_irq_disable+0x3b/0x150 [ 2653.190975][ T8455] ? asm_int80_emulation+0x1a/0x20 [ 2653.190985][ T8455] ? clear_bhb_loop+0x40/0x90 [ 2653.190995][ T8455] ? clear_bhb_loop+0x40/0x90 [ 2653.191008][ T8455] asm_int80_emulation+0x1a/0x20 [ 2653.191018][ T8455] RIP: 0023:0xf71b5cab [ 2653.191029][ T8455] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 2653.191038][ T8455] RSP: 002b:00000000f546d44c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 2653.191051][ T8455] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080001180 [ 2653.191058][ T8455] RDX: 000000000000004f RSI: 0000000000000000 RDI: 0000000000000000 [ 2653.191065][ T8455] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2653.191071][ T8455] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2653.191077][ T8455] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2653.191098][ T8455] [ 2654.243955][T17091] usbhid 4-1:0.0: can't add hid device: -71 [ 2654.249936][T17091] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2654.290731][T17091] usb 4-1: USB disconnect, device number 98 [ 2654.423199][T30517] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 2654.456321][ T8473] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9397'. [ 2654.481954][ T8475] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9396'. [ 2654.575371][T30517] usb 5-1: config index 0 descriptor too short (expected 3133, got 61) [ 2654.577468][ T8466] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9393'. [ 2654.583922][T30517] usb 5-1: config 0 has an invalid interface number: 156 but max is 1 [ 2654.603542][T30517] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2654.615049][T30517] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2654.630967][T30517] usb 5-1: config 0 has no interface number 0 [ 2654.637598][T30517] usb 5-1: config 0 interface 156 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 2654.648088][T30517] usb 5-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2654.661605][T30517] usb 5-1: New USB device found, idVendor=abcd, idProduct=cde3, bcdDevice= 5.b9 [ 2654.671045][T30517] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2654.682315][T30517] usb 5-1: config 0 descriptor?? [ 2654.697725][T30517] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 2654.705769][T30517] usb 5-1: MIDIStreaming interface descriptor not found [ 2654.799933][ T8471] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9393'. [ 2655.163378][T30517] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 2655.215678][ T8482] syzkaller0: entered promiscuous mode [ 2655.221267][ T8482] syzkaller0: entered allmulticast mode [ 2655.324614][T30517] usb 4-1: Using ep0 maxpacket: 32 [ 2655.355059][T30517] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 2655.373220][T30517] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2655.393672][T30517] usb 4-1: Product: syz [ 2655.398513][T30517] usb 4-1: Manufacturer: syz [ 2655.434650][T30517] usb 4-1: SerialNumber: syz [ 2655.442713][ T8486] FAULT_INJECTION: forcing a failure. [ 2655.442713][ T8486] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2655.457556][T30517] usb 4-1: config 0 descriptor?? [ 2655.476035][ T8486] CPU: 0 UID: 0 PID: 8486 Comm: syz.1.9400 Tainted: G L syzkaller #0 PREEMPT(full) [ 2655.476063][ T8486] Tainted: [L]=SOFTLOCKUP [ 2655.476070][ T8486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2655.476081][ T8486] Call Trace: [ 2655.476089][ T8486] [ 2655.476097][ T8486] dump_stack_lvl+0xe8/0x150 [ 2655.476130][ T8486] should_fail_ex+0x412/0x560 [ 2655.476159][ T8486] _copy_from_iter+0x3b0/0x1670 [ 2655.476194][ T8486] ? __pfx__copy_from_iter+0x10/0x10 [ 2655.476224][ T8486] ? netlink_sendmsg+0x650/0xb40 [ 2655.476251][ T8486] ? skb_put+0x11b/0x210 [ 2655.476270][ T8486] netlink_sendmsg+0x6c0/0xb40 [ 2655.476301][ T8486] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2655.476330][ T8486] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2655.476356][ T8486] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2655.476377][ T8486] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2655.476402][ T8486] sock_write_iter+0x49b/0x4f0 [ 2655.476429][ T8486] ? __pfx_sock_write_iter+0x10/0x10 [ 2655.476460][ T8486] ? kstrtoull+0x12f/0x1d0 [ 2655.476489][ T8486] do_iter_readv_writev+0x619/0x8c0 [ 2655.476514][ T8486] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 2655.476541][ T8486] ? bpf_lsm_file_permission+0x9/0x20 [ 2655.476561][ T8486] ? security_file_permission+0x75/0x260 [ 2655.476584][ T8486] ? rw_verify_area+0x255/0x4d0 [ 2655.476605][ T8486] vfs_writev+0x33c/0x990 [ 2655.476636][ T8486] ? __pfx_vfs_writev+0x10/0x10 [ 2655.476672][ T8486] ? __fget_files+0x2a/0x420 [ 2655.476704][ T8486] ? __fget_files+0x3a0/0x420 [ 2655.476730][ T8486] ? __fget_files+0x2a/0x420 [ 2655.476764][ T8486] do_writev+0x154/0x2e0 [ 2655.476790][ T8486] ? __pfx_do_writev+0x10/0x10 [ 2655.476824][ T8486] __do_fast_syscall_32+0x20d/0x640 [ 2655.476849][ T8486] ? do_fast_syscall_32+0x33/0x70 [ 2655.476878][ T8486] ? asm_int80_emulation+0x1a/0x20 [ 2655.476896][ T8486] ? do_int80_emulation+0x274/0x4d0 [ 2655.476917][ T8486] ? trace_irq_disable+0x3b/0x150 [ 2655.476947][ T8486] do_fast_syscall_32+0x33/0x70 [ 2655.476970][ T8486] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2655.476993][ T8486] RIP: 0023:0xf707ef6c [ 2655.477011][ T8486] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2655.477027][ T8486] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000092 [ 2655.477048][ T8486] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 2655.477062][ T8486] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 2655.477073][ T8486] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2655.477084][ T8486] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2655.477096][ T8486] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2655.477122][ T8486] [ 2655.785019][ T8488] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9402'. [ 2655.813285][T17091] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 2655.829944][T30517] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: version d4.15 found at bus 004 address 099 [ 2655.930164][ T8492] netlink: 'syz.1.9403': attribute type 1 has an invalid length. [ 2655.983195][T17091] usb 3-1: Using ep0 maxpacket: 16 [ 2655.994726][T17091] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2656.018865][T17091] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2656.051912][ T8489] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9402'. [ 2656.054864][T17091] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2656.075469][ T8489] xt_NFQUEUE: number of total queues is 0 [ 2656.115915][T17091] usb 3-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 2656.121775][ T8495] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9404'. [ 2656.138874][T17091] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2656.174377][T17091] usb 3-1: config 0 descriptor?? [ 2656.468469][ T8502] syzkaller0: entered promiscuous mode [ 2656.474129][ T8502] syzkaller0: entered allmulticast mode [ 2656.604980][T17091] hid_parser_main: 28 callbacks suppressed [ 2656.605004][T17091] shield 0003:0955:7214.00CE: unknown main item tag 0x0 [ 2656.633146][T17091] shield 0003:0955:7214.00CE: unknown main item tag 0x0 [ 2656.640301][T17091] shield 0003:0955:7214.00CE: unknown main item tag 0x0 [ 2656.647917][T17091] shield 0003:0955:7214.00CE: unknown main item tag 0x0 [ 2656.649306][ T8478] i2c i2c-1: failure reading status [ 2656.655132][T17091] shield 0003:0955:7214.00CE: unknown main item tag 0x0 [ 2656.669605][T30517] usb 4-1: USB disconnect, device number 99 [ 2656.702710][T17091] input: HID 0955:7214 Haptics as /devices/virtual/input/input197 [ 2656.762322][ T8506] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9407'. [ 2656.767529][T17091] shield 0003:0955:7214.00CE: Registered Thunderstrike controller [ 2656.800512][ T8485] random: crng reseeded on system resumption [ 2656.828232][T17091] shield 0003:0955:7214.00CE: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 2656.909407][T31954] shield 0003:0955:7214.00CE: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 2656.943260][T17091] usb 3-1: USB disconnect, device number 23 [ 2656.958163][T31954] shield 0003:0955:7214.00CE: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 2656.987293][T31954] shield 0003:0955:7214.00CE: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 2657.002155][ T8511] tipc: Enabled bearer , priority 0 [ 2657.002557][T31954] shield 0003:0955:7214.00CE: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 2657.045872][ T8511] tipc: Resetting bearer [ 2657.126961][T31954] usb 5-1: USB disconnect, device number 17 [ 2657.229556][ T8510] tipc: Disabling bearer [ 2657.755969][ T8522] syzkaller0: entered promiscuous mode [ 2657.883263][ T8522] syzkaller0: entered allmulticast mode [ 2658.126872][T29471] IPVS: starting estimator thread 0... [ 2658.150567][ T8530] netlink: 'syz.4.9410': attribute type 10 has an invalid length. [ 2658.159694][ T8528] syzkaller0: entered promiscuous mode [ 2658.175626][ T8528] syzkaller0: entered allmulticast mode [ 2658.233178][ T8531] IPVS: using max 53 ests per chain, 127200 per kthread [ 2658.235233][ T8530] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 2658.626294][T31954] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 2658.813141][T31954] usb 3-1: Using ep0 maxpacket: 8 [ 2658.823513][ T8545] pim6reg: entered allmulticast mode [ 2658.835628][T31954] usb 3-1: config 5 has an invalid interface number: 185 but max is 1 [ 2658.847471][ T8545] pim6reg: left allmulticast mode [ 2658.971588][T31954] usb 3-1: config 5 has an invalid descriptor of length 210, skipping remainder of the config [ 2658.989048][T31954] usb 3-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 2659.072039][T31954] usb 3-1: config 5 has no interface number 0 [ 2659.094101][T31954] usb 3-1: config 5 interface 185 altsetting 1 endpoint 0xC has an invalid bInterval 28, changing to 8 [ 2659.106751][ T8552] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9421'. [ 2659.139155][T31954] usb 3-1: config 5 interface 185 altsetting 1 endpoint 0xC has invalid wMaxPacketSize 0 [ 2659.166448][T31954] usb 3-1: config 5 interface 185 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 2659.208627][T31954] usb 3-1: config 5 interface 185 has no altsetting 0 [ 2659.239487][T31954] usb 3-1: language id specifier not provided by device, defaulting to English [ 2659.300707][T31954] usb 3-1: New USB device found, idVendor=04da, idProduct=2500, bcdDevice=83.2e [ 2659.322377][T31954] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2659.366481][T31954] usb 3-1: Product: 쌙ŏ匴ﾡꡮƉᑈ懳麀群䔉鈣㵤 [ 2659.384082][T31954] usb 3-1: Manufacturer: N [ 2659.404991][T31954] usb 3-1: SerialNumber: 쑊壒ᠤ텝᥽뿞辳ᴘ୫᥍덟窠등굁헙繯괴廆น會쯢獒戛ㅊ鰊䉹랴鬝ﲵꬬ죑᎔ઃ໯⋺꺠傲ᥘ〞듁뀛ﯰᎏぢ螉ᡎ᝴ꇐ㡠冇厘驪ㆉ裖됇Ỗ얱䌮鄔Ⰺ潨ﭸℹ鳕剝ⴏᮍ똸꫋⿈禍뭷 [ 2659.785647][T17091] usb 4-1: new low-speed USB device number 100 using dummy_hcd [ 2659.818137][ T8538] blktrace: Concurrent blktraces are not allowed on nullb0 [ 2660.224616][ T3457] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2660.425228][T17091] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 2660.442270][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2660.473359][T17091] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2660.489972][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2660.501672][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2660.517549][T17091] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 2660.527375][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2660.570841][T17091] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2660.586316][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2660.599978][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2660.614893][T17091] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 2660.623169][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2660.634358][T17091] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2660.647072][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2660.660166][T17091] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2660.682146][T17091] usb 4-1: string descriptor 0 read error: -22 [ 2660.688822][T17091] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 2660.700638][T17091] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2660.724536][T17091] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 2660.843209][T29471] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 2660.993170][T29471] usb 5-1: Using ep0 maxpacket: 32 [ 2661.030638][T29471] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 2661.040404][T29471] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2661.057820][ T8576] netlink: 'syz.3.9426': attribute type 15 has an invalid length. [ 2661.065233][T29471] usb 5-1: Product: syz [ 2661.070724][T29471] usb 5-1: Manufacturer: syz [ 2661.081245][T17091] usb 4-1: USB disconnect, device number 100 [ 2661.090027][T29471] usb 5-1: SerialNumber: syz [ 2661.159890][T29471] usb 5-1: config 0 descriptor?? [ 2661.380075][T29471] RobotFuzz Open Source InterFace, OSIF 5-1:0.0: version d4.15 found at bus 005 address 018 [ 2661.732284][T31954] usb 3-1: USB disconnect, device number 24 [ 2662.199494][ T8594] pim6reg: entered allmulticast mode [ 2662.205690][ T8594] pim6reg: left allmulticast mode [ 2662.280903][ T8599] syzkaller0: entered promiscuous mode [ 2662.286565][ T8599] syzkaller0: entered allmulticast mode [ 2662.320107][ T8599] netlink: 'syz.1.9437': attribute type 13 has an invalid length. [ 2662.363179][ T8594] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9436'. [ 2662.698037][ T8614] FAULT_INJECTION: forcing a failure. [ 2662.698037][ T8614] name failslab, interval 1, probability 0, space 0, times 0 [ 2662.762705][ T8614] CPU: 1 UID: 0 PID: 8614 Comm: syz.2.9441 Tainted: G L syzkaller #0 PREEMPT(full) [ 2662.762737][ T8614] Tainted: [L]=SOFTLOCKUP [ 2662.762745][ T8614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2662.762756][ T8614] Call Trace: [ 2662.762764][ T8614] [ 2662.762773][ T8614] dump_stack_lvl+0xe8/0x150 [ 2662.762808][ T8614] should_fail_ex+0x412/0x560 [ 2662.762840][ T8614] should_failslab+0xa8/0x100 [ 2662.762866][ T8614] __kmalloc_noprof+0xe8/0x760 [ 2662.762888][ T8614] ? security_sk_alloc+0x52/0x360 [ 2662.762921][ T8614] security_sk_alloc+0x52/0x360 [ 2662.762944][ T8614] sk_prot_alloc+0x101/0x210 [ 2662.762976][ T8614] sk_alloc+0x3a/0x390 [ 2662.763001][ T8614] inet_create+0x7a0/0x1000 [ 2662.763027][ T8614] ? inet_create+0x9c/0x1000 [ 2662.763055][ T8614] __sock_create+0x4b2/0x9d0 [ 2662.763090][ T8614] mptcp_pm_nl_add_addr_doit+0x4f4/0x1510 [ 2662.763112][ T8614] ? __nla_validate_parse+0x2480/0x2dc0 [ 2662.763140][ T8614] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 2662.763165][ T8614] ? __pfx___nla_validate_parse+0x10/0x10 [ 2662.763201][ T8614] ? rcu_is_watching+0x15/0xb0 [ 2662.763228][ T8614] ? trace_kmalloc+0x2a/0x110 [ 2662.763261][ T8614] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 2662.763293][ T8614] genl_family_rcv_msg_doit+0x22a/0x330 [ 2662.763315][ T8614] ? __asan_memcpy+0x40/0x70 [ 2662.763334][ T8614] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 2662.763368][ T8614] ? bpf_lsm_capable+0x9/0x20 [ 2662.763393][ T8614] ? security_capable+0x7e/0x2c0 [ 2662.763424][ T8614] genl_rcv_msg+0x61c/0x7a0 [ 2662.763452][ T8614] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2662.763474][ T8614] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 2662.763495][ T8614] ? __lock_acquire+0x6b5/0x2cf0 [ 2662.763530][ T8614] netlink_rcv_skb+0x232/0x4b0 [ 2662.763560][ T8614] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2662.763585][ T8614] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2662.763628][ T8614] ? down_read+0x272/0x2e0 [ 2662.763651][ T8614] ? genl_rcv+0xd/0x40 [ 2662.763674][ T8614] genl_rcv+0x28/0x40 [ 2662.763695][ T8614] netlink_unicast+0x80f/0x9b0 [ 2662.763730][ T8614] ? __pfx_netlink_unicast+0x10/0x10 [ 2662.763758][ T8614] ? netlink_sendmsg+0x650/0xb40 [ 2662.763784][ T8614] ? skb_put+0x11b/0x210 [ 2662.763808][ T8614] netlink_sendmsg+0x813/0xb40 [ 2662.763846][ T8614] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2662.763878][ T8614] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2662.763907][ T8614] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2662.763933][ T8614] ____sys_sendmsg+0x972/0x9f0 [ 2662.763972][ T8614] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2662.763999][ T8614] ? kstrtoull+0x12f/0x1d0 [ 2662.764034][ T8614] ___sys_sendmsg+0x2a5/0x360 [ 2662.764063][ T8614] ? __pfx____sys_sendmsg+0x10/0x10 [ 2662.764088][ T8614] ? get_pid_task+0x20/0x1f0 [ 2662.764107][ T8614] ? get_pid_task+0x20/0x1f0 [ 2662.764124][ T8614] ? get_pid_task+0x20/0x1f0 [ 2662.764169][ T8614] ? __fget_files+0x2a/0x420 [ 2662.764197][ T8614] ? __fget_files+0x3a0/0x420 [ 2662.764234][ T8614] __sys_sendmsg+0x183/0x260 [ 2662.764259][ T8614] ? __pfx___sys_sendmsg+0x10/0x10 [ 2662.764303][ T8614] __do_fast_syscall_32+0x20d/0x640 [ 2662.764327][ T8614] ? do_fast_syscall_32+0x33/0x70 [ 2662.764349][ T8614] ? asm_int80_emulation+0x1a/0x20 [ 2662.764368][ T8614] ? do_int80_emulation+0x274/0x4d0 [ 2662.764390][ T8614] ? trace_irq_disable+0x3b/0x150 [ 2662.764419][ T8614] do_fast_syscall_32+0x33/0x70 [ 2662.764442][ T8614] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2662.764465][ T8614] RIP: 0023:0xf709ef6c [ 2662.764483][ T8614] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2662.764500][ T8614] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2662.764521][ T8614] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000400 [ 2662.764535][ T8614] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2662.764548][ T8614] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2662.764560][ T8614] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2662.764573][ T8614] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2662.764602][ T8614] [ 2663.653780][ T8572] i2c i2c-1: failure writing data [ 2663.653801][ T8622] program syz.2.9443 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2663.705641][T17091] usb 5-1: USB disconnect, device number 18 [ 2663.984411][T30517] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 2664.143369][T30517] usb 4-1: Using ep0 maxpacket: 8 [ 2664.156627][T30517] usb 4-1: config 5 has an invalid interface number: 185 but max is 1 [ 2664.165648][T30517] usb 4-1: config 5 has an invalid descriptor of length 210, skipping remainder of the config [ 2664.215138][T30517] usb 4-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 2664.262025][T30517] usb 4-1: config 5 has no interface number 0 [ 2664.282842][T30517] usb 4-1: config 5 interface 185 altsetting 1 endpoint 0xC has an invalid bInterval 28, changing to 8 [ 2664.297042][T29471] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 2664.329489][T30517] usb 4-1: config 5 interface 185 altsetting 1 endpoint 0xC has invalid wMaxPacketSize 0 [ 2664.395145][T30517] usb 4-1: config 5 interface 185 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 2664.454756][T29471] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2664.476198][T30517] usb 4-1: config 5 interface 185 has no altsetting 0 [ 2664.513964][T29471] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2664.557818][T30517] usb 4-1: language id specifier not provided by device, defaulting to English [ 2664.574951][T29471] usb 3-1: config 1 has no interface number 1 [ 2664.629036][T30517] usb 4-1: New USB device found, idVendor=04da, idProduct=2500, bcdDevice=83.2e [ 2664.656707][T30517] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2664.680949][T30517] usb 4-1: Product: 쌙ŏ匴ﾡꡮƉᑈ懳麀群䔉鈣㵤 [ 2664.688463][T29471] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 2664.712061][T30517] usb 4-1: Manufacturer: N [ 2664.721090][T30517] usb 4-1: SerialNumber: 쑊壒ᠤ텝᥽뿞辳ᴘ୫᥍덟窠등굁헙繯괴廆น會쯢獒戛ㅊ鰊䉹랴鬝ﲵꬬ죑᎔ઃ໯⋺꺠傲ᥘ〞듁뀛ﯰᎏぢ螉ᡎ᝴ꇐ㡠冇厘驪ㆉ裖됇Ỗ얱䌮鄔Ⰺ潨ﭸℹ鳕剝ⴏᮍ똸꫋⿈禍뭷 [ 2664.759261][T29471] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 2664.838665][T29471] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2664.847901][T29471] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2664.856405][T29471] usb 3-1: Product: syz [ 2664.861560][T29471] usb 3-1: Manufacturer: syz [ 2664.869266][T29471] usb 3-1: SerialNumber: syz [ 2664.888136][ T8634] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 2665.463152][T31954] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 2665.520946][ T8625] blktrace: Concurrent blktraces are not allowed on nullb0 [ 2665.820767][T31954] usb 5-1: Using ep0 maxpacket: 32 [ 2665.842193][T31954] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 2665.879675][T31954] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2665.953166][T31954] usb 5-1: Product: syz [ 2665.975388][T31954] usb 5-1: Manufacturer: syz [ 2665.987012][T31954] usb 5-1: SerialNumber: syz [ 2666.007887][T31954] usb 5-1: config 0 descriptor?? [ 2666.231136][T31954] RobotFuzz Open Source InterFace, OSIF 5-1:0.0: version d4.15 found at bus 005 address 019 [ 2666.618505][ T8673] bridge0: port 2(bridge_slave_1) entered disabled state [ 2666.626136][ T8673] bridge0: port 1(bridge_slave_0) entered disabled state [ 2667.302414][T29471] usb 3-1: 2:1 : no or invalid class specific endpoint descriptor [ 2667.328913][T29471] usb 3-1: 2:1 : no or invalid class specific endpoint descriptor [ 2667.382722][ T8673] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2667.430868][ T8673] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2667.620808][T29471] usb 3-1: USB disconnect, device number 25 [ 2667.673000][T24318] udevd[24318]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2667.759598][T30517] usb 4-1: USB disconnect, device number 101 [ 2668.453352][ T8662] i2c i2c-1: failure writing data [ 2668.500883][T29471] usb 5-1: USB disconnect, device number 19 [ 2668.513399][ T3449] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2668.551731][ T3449] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2668.583628][ T8683] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9462'. [ 2668.601794][ T3449] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2668.623231][ T3449] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2668.665886][ T8691] sock: sock_timestamping_bind_phc: sock not bind to device [ 2668.752240][ T8689] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9462'. [ 2668.775597][ T8689] xt_NFQUEUE: number of total queues is 0 [ 2668.974126][ T8705] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9465'. [ 2669.026141][ T8695] pim6reg: entered allmulticast mode [ 2669.043187][ T8695] pim6reg: left allmulticast mode [ 2669.094693][ T8697] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9466'. [ 2669.233179][T30517] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 2669.413537][T30517] usb 5-1: Using ep0 maxpacket: 8 [ 2669.447596][T30517] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2669.458243][T30517] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 2669.576669][T30517] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 2669.632890][T30517] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2669.695983][T30517] usb 5-1: Product: syz [ 2669.743128][T30517] usb 5-1: Manufacturer: syz [ 2669.768065][T30517] usb 5-1: SerialNumber: syz [ 2669.791702][T30517] cdc_ether 5-1:1.0: skipping garbage [ 2669.800837][T30517] usb 5-1: bad CDC descriptors [ 2669.812086][T30517] usbtest 5-1:1.0: couldn't get endpoints, -22 [ 2669.843303][T30517] usbtest 5-1:1.0: probe with driver usbtest failed with error -22 [ 2670.058339][T30517] usb 5-1: USB disconnect, device number 20 [ 2670.294845][ T3457] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2672.011461][ T8750] pim6reg: entered allmulticast mode [ 2672.021995][ T8750] pim6reg: left allmulticast mode [ 2672.133847][ T8750] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9479'. [ 2672.172798][ T8756] FAULT_INJECTION: forcing a failure. [ 2672.172798][ T8756] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2672.353176][ T8756] CPU: 0 UID: 0 PID: 8756 Comm: syz.4.9480 Tainted: G L syzkaller #0 PREEMPT(full) [ 2672.353205][ T8756] Tainted: [L]=SOFTLOCKUP [ 2672.353212][ T8756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2672.353222][ T8756] Call Trace: [ 2672.353230][ T8756] [ 2672.353238][ T8756] dump_stack_lvl+0xe8/0x150 [ 2672.353268][ T8756] should_fail_ex+0x412/0x560 [ 2672.353298][ T8756] _copy_to_user+0x31/0xb0 [ 2672.353321][ T8756] simple_read_from_buffer+0xe1/0x170 [ 2672.353350][ T8756] proc_fail_nth_read+0x1bb/0x230 [ 2672.353379][ T8756] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2672.353408][ T8756] ? rw_verify_area+0x2a6/0x4d0 [ 2672.353427][ T8756] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2672.353455][ T8756] vfs_read+0x20c/0xa70 [ 2672.353482][ T8756] ? __pfx_vfs_read+0x10/0x10 [ 2672.353499][ T8756] ? sock_common_getsockopt+0x2d/0xb0 [ 2672.353524][ T8756] ? raw_getsockopt+0xf0/0x1f0 [ 2672.353541][ T8756] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 2672.353568][ T8756] ? do_sock_getsockopt+0x2d3/0x3f0 [ 2672.353587][ T8756] ? fd_install+0x94/0x3d0 [ 2672.353614][ T8756] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 2672.353643][ T8756] ksys_read+0x150/0x270 [ 2672.353664][ T8756] ? __pfx_ksys_read+0x10/0x10 [ 2672.353685][ T8756] ? asm_int80_emulation+0x1a/0x20 [ 2672.353707][ T8756] do_int80_emulation+0x173/0x4d0 [ 2672.353728][ T8756] ? trace_irq_disable+0x3b/0x150 [ 2672.353751][ T8756] ? asm_int80_emulation+0x1a/0x20 [ 2672.353766][ T8756] ? clear_bhb_loop+0x40/0x90 [ 2672.353782][ T8756] ? clear_bhb_loop+0x40/0x90 [ 2672.353801][ T8756] asm_int80_emulation+0x1a/0x20 [ 2672.353818][ T8756] RIP: 0023:0xf7135cab [ 2672.353835][ T8756] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 2672.353847][ T8756] RSP: 002b:00000000f53ed4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2672.353859][ T8756] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53ed5d0 [ 2672.353867][ T8756] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 2672.353873][ T8756] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2672.353880][ T8756] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2672.353886][ T8756] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2672.353900][ T8756] [ 2673.099309][ T8775] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9486'. [ 2673.153852][T30517] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 2673.163343][T17091] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 2673.198121][ T8777] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9486'. [ 2673.304670][T30517] usb 3-1: config 1 has an invalid interface number: 128 but max is 2 [ 2673.323199][T30517] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 2673.334933][T30517] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2673.345652][T17091] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2673.347324][T30517] usb 3-1: config 1 has no interface number 0 [ 2673.361371][T17091] usb 5-1: config 3 has an invalid interface number: 4 but max is 0 [ 2673.361906][T30517] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 2673.378915][T30517] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 2673.386433][T17091] usb 5-1: config 3 has no interface number 0 [ 2673.395424][T30517] usb 3-1: SerialNumber: syz [ 2673.402070][T17091] usb 5-1: config 3 interface 4 altsetting 184 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2673.420038][T17091] usb 5-1: config 3 interface 4 has no altsetting 0 [ 2673.431160][T30517] usb 3-1: 128:2 : does not exist [ 2673.441314][T17091] usb 5-1: New USB device found, idVendor=12cf, idProduct=7111, bcdDevice=7a.1f [ 2673.455066][T17091] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2673.465866][T17091] usb 5-1: Product: syz [ 2673.470270][T17091] usb 5-1: Manufacturer: syz [ 2673.475378][T17091] usb 5-1: SerialNumber: syz [ 2673.694062][T17091] radio-si470x 5-1:3.4: could not find interrupt in endpoint [ 2673.711955][ T8782] input: syz0 as /devices/virtual/input/input198 [ 2673.728289][T17091] radio-si470x 5-1:3.4: probe with driver radio-si470x failed with error -5 [ 2673.750805][T17091] usbhid 5-1:3.4: couldn't find an input interrupt endpoint [ 2673.755121][T17091] usb 5-1: USB disconnect, device number 21 [ 2674.133749][ T3456] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2675.412520][ T8811] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9497'. [ 2675.906546][ T8820] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9499'. [ 2675.940975][ T8009] usb 3-1: USB disconnect, device number 26 [ 2676.497863][ T8824] input: syz0 as /devices/virtual/input/input199 [ 2677.043713][ T8009] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 2677.141877][ T8837] tipc: Enabled bearer , priority 0 [ 2677.152288][ T8837] syzkaller0: entered promiscuous mode [ 2677.172168][ T8837] syzkaller0: entered allmulticast mode [ 2677.197156][ T8837] tipc: Resetting bearer [ 2677.203307][ T8009] usb 4-1: Using ep0 maxpacket: 32 [ 2677.211256][ T8009] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2677.231376][ T8009] usb 4-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 2677.247760][ T8009] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2677.268606][ T8836] tipc: Resetting bearer [ 2677.281019][ T8009] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 2677.306959][ T8009] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2677.325201][ T8009] usb 4-1: Product: syz [ 2677.341686][ T8009] usb 4-1: Manufacturer: syz [ 2677.350792][ T8009] usb 4-1: SerialNumber: syz [ 2677.366908][ T8009] usb 4-1: config 0 descriptor?? [ 2677.392300][ T8836] tipc: Disabling bearer [ 2677.800036][ T8841] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 2677.806578][ T8841] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 2677.814592][ T8009] gs_usb 4-1:0.0: Configuring for 1 interfaces [ 2677.829979][ T8841] vhci_hcd vhci_hcd.0: Device attached [ 2678.093153][T29471] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 2678.093241][T31954] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 2678.247844][T29471] usb 2-1: config 0 has no interfaces? [ 2678.254393][T29471] usb 2-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 2678.263848][T29471] usb 2-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 2678.275284][T29471] usb 2-1: Manufacturer: syz [ 2678.287183][T29471] usb 2-1: config 0 descriptor?? [ 2678.490614][ T8866] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9515'. [ 2678.501996][ T8866] netlink: 'syz.4.9515': attribute type 11 has an invalid length. [ 2678.576061][ T8867] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9515'. [ 2678.587736][ T8867] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9515'. [ 2678.653239][T31954] usb 35-1: device descriptor read/64, error -71 [ 2678.903256][T31954] usb 35-1: new low-speed USB device number 3 using vhci_hcd [ 2679.413511][ T2087] Bluetooth: hci5: command 0x0406 tx timeout [ 2679.442039][ T8874] input: syz0 as /devices/virtual/input/input200 [ 2679.680793][T29471] usb 2-1: USB disconnect, device number 99 [ 2679.687730][ T8843] vhci_hcd: connection closed [ 2679.688168][ T3457] vhci_hcd vhci_hcd.1: stop threads [ 2679.713956][ T3457] vhci_hcd vhci_hcd.1: release socket [ 2679.719729][ T3457] vhci_hcd vhci_hcd.1: disconnect device [ 2681.183314][ T3456] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2683.325113][T17091] usb 4-1: USB disconnect, device number 102 [ 2684.047265][T31954] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 2684.203257][ T8240] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 2684.260216][ T8937] tipc: Enabled bearer , priority 0 [ 2684.295961][ T8936] tipc: Disabling bearer [ 2684.363323][ T8240] usb 3-1: Using ep0 maxpacket: 32 [ 2684.379116][ T8240] usb 3-1: no configurations [ 2684.388923][ T8240] usb 3-1: can't read configurations, error -22 [ 2684.403266][T17091] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 2684.547135][ T8240] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 2684.594176][T17091] usb 2-1: Using ep0 maxpacket: 32 [ 2684.628786][T17091] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 2684.639315][T17091] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2684.648326][T17091] usb 2-1: Product: syz [ 2684.652672][T17091] usb 2-1: Manufacturer: syz [ 2684.657608][T17091] usb 2-1: SerialNumber: syz [ 2684.703237][ T8240] usb 3-1: Using ep0 maxpacket: 32 [ 2684.709477][ T8240] usb 3-1: no configurations [ 2684.717586][ T8240] usb 3-1: can't read configurations, error -22 [ 2684.733223][ T8240] usb usb3-port1: attempt power cycle [ 2684.835638][T17091] usb 2-1: config 0 descriptor?? [ 2685.061673][T17091] RobotFuzz Open Source InterFace, OSIF 2-1:0.0: version d4.15 found at bus 002 address 100 [ 2685.083353][ T8240] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 2685.113747][ T8240] usb 3-1: Using ep0 maxpacket: 32 [ 2685.119482][ T8240] usb 3-1: no configurations [ 2685.125007][ T8240] usb 3-1: can't read configurations, error -22 [ 2685.253225][ T8240] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 2685.283806][ T8240] usb 3-1: Using ep0 maxpacket: 32 [ 2685.290178][ T8240] usb 3-1: no configurations [ 2685.296061][ T8240] usb 3-1: can't read configurations, error -22 [ 2685.306859][ T8240] usb usb3-port1: unable to enumerate USB device [ 2685.874043][ T8932] i2c i2c-1: failure reading status [ 2685.881376][T17091] usb 2-1: USB disconnect, device number 100 [ 2687.072649][ T8988] netlink: 'syz.4.9543': attribute type 1 has an invalid length. [ 2687.082480][ T8986] tipc: Enabled bearer , priority 0 [ 2687.091920][ T8988] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9543'. [ 2687.109576][ T8990] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9544'. [ 2687.130659][ T8985] tipc: Disabling bearer [ 2687.152989][ T8988] erspan1: entered allmulticast mode [ 2688.104322][ T8240] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 2688.160810][ T9011] kvm: kvm [9010]: vcpu0, guest rIP: 0x273 Unhandled WRMSR(0x11e) = 0xbe702111 [ 2688.273148][ T8240] usb 4-1: Using ep0 maxpacket: 32 [ 2688.285124][ T8240] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2688.313133][ T8240] usb 4-1: config 0 has no interfaces? [ 2688.320973][ T8240] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 2688.343267][ T8240] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2688.351468][ T8240] usb 4-1: Product: syz [ 2688.356066][ T8240] usb 4-1: Manufacturer: syz [ 2688.360673][ T8240] usb 4-1: SerialNumber: syz [ 2688.373222][T31954] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 2688.374137][ T8240] usb 4-1: config 0 descriptor?? [ 2688.534267][T31954] usb 2-1: Using ep0 maxpacket: 32 [ 2688.543831][T31954] usb 2-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 2688.556497][T31954] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2688.564683][T17091] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 2688.573168][T31954] usb 2-1: Product: syz [ 2688.578217][T31954] usb 2-1: Manufacturer: syz [ 2688.583625][T31954] usb 2-1: SerialNumber: syz [ 2688.591560][T31954] usb 2-1: config 0 descriptor?? [ 2688.723233][T17091] usb 3-1: Using ep0 maxpacket: 8 [ 2688.730740][T17091] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 2688.739609][T17091] usb 3-1: config 0 has no interface number 0 [ 2688.749724][T17091] usb 3-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 2688.761272][T17091] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2688.769755][T17091] usb 3-1: Product: syz [ 2688.782824][T17091] usb 3-1: Manufacturer: syz [ 2688.787922][T17091] usb 3-1: SerialNumber: syz [ 2688.798502][T17091] usb 3-1: config 0 descriptor?? [ 2688.823884][T17091] usb 3-1: selecting invalid altsetting 2 [ 2688.833197][T17091] i2c-cp2615 3-1:0.1: probe with driver i2c-cp2615 failed with error -22 [ 2688.845275][T31954] RobotFuzz Open Source InterFace, OSIF 2-1:0.0: version d4.15 found at bus 002 address 101 [ 2689.105466][ T9023] tipc: Started in network mode [ 2689.110338][ T9023] tipc: Node identity d63b8ba35dd4, cluster identity 4711 [ 2689.118089][ T9023] tipc: Enabled bearer , priority 0 [ 2689.147567][ T9022] tipc: Disabling bearer [ 2689.268250][ T9028] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9558'. [ 2689.278116][ T9028] FAULT_INJECTION: forcing a failure. [ 2689.278116][ T9028] name failslab, interval 1, probability 0, space 0, times 0 [ 2689.292183][ T9028] CPU: 1 UID: 0 PID: 9028 Comm: syz.4.9558 Tainted: G L syzkaller #0 PREEMPT(full) [ 2689.292209][ T9028] Tainted: [L]=SOFTLOCKUP [ 2689.292213][ T9028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2689.292220][ T9028] Call Trace: [ 2689.292226][ T9028] [ 2689.292231][ T9028] dump_stack_lvl+0xe8/0x150 [ 2689.292251][ T9028] should_fail_ex+0x412/0x560 [ 2689.292270][ T9028] should_failslab+0xa8/0x100 [ 2689.292285][ T9028] __kmalloc_cache_noprof+0x88/0x660 [ 2689.292298][ T9028] ? nsim_fib_event_nb+0x190/0x1210 [ 2689.292318][ T9028] nsim_fib_event_nb+0x190/0x1210 [ 2689.292340][ T9028] notifier_call_chain+0x1be/0x400 [ 2689.292359][ T9028] ? atomic_notifier_call_chain+0x26/0x180 [ 2689.292376][ T9028] atomic_notifier_call_chain+0xda/0x180 [ 2689.292393][ T9028] call_fib_notifiers+0x31/0x60 [ 2689.292413][ T9028] fib_table_flush+0xadf/0x1300 [ 2689.292429][ T9028] ? atomic_notifier_call_chain+0x26/0x180 [ 2689.292455][ T9028] ? __pfx_fib_table_flush+0x10/0x10 [ 2689.292482][ T9028] fib_disable_ip+0xfd/0x170 [ 2689.292497][ T9028] fib_netdev_event+0x318/0x490 [ 2689.292511][ T9028] notifier_call_chain+0x1be/0x400 [ 2689.292531][ T9028] netif_close_many+0x2ae/0x420 [ 2689.292547][ T9028] ? __pfx___mutex_trylock_common+0x10/0x10 [ 2689.292565][ T9028] ? __pfx_netif_close_many+0x10/0x10 [ 2689.292583][ T9028] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 2689.292598][ T9028] unregister_netdevice_many_notify+0xb47/0x2370 [ 2689.292615][ T9028] ? stack_trace_save+0xa9/0x100 [ 2689.292626][ T9028] ? rtnl_dellink+0x42a/0x820 [ 2689.292642][ T9028] ? __pfx_stack_trace_save+0x10/0x10 [ 2689.292657][ T9028] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 2689.292672][ T9028] ? unregister_netdevice_queue+0x19b/0x360 [ 2689.292686][ T9028] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 2689.292701][ T9028] ? __nla_parse+0x40/0x60 [ 2689.292712][ T9028] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 2689.292725][ T9028] rtnl_dellink+0x5d4/0x820 [ 2689.292744][ T9028] ? __pfx_rtnl_dellink+0x10/0x10 [ 2689.292805][ T9028] ? __pfx_rtnl_dellink+0x10/0x10 [ 2689.292820][ T9028] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 2689.292837][ T9028] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 2689.292853][ T9028] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2689.292868][ T9028] ? ref_tracker_free+0x693/0x840 [ 2689.292883][ T9028] ? __copy_skb_header+0xa3/0x4a0 [ 2689.292896][ T9028] ? __pfx_ref_tracker_free+0x10/0x10 [ 2689.292916][ T9028] netlink_rcv_skb+0x232/0x4b0 [ 2689.292934][ T9028] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2689.292950][ T9028] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2689.292972][ T9028] ? netlink_deliver_tap+0x2e/0x1b0 [ 2689.292991][ T9028] netlink_unicast+0x80f/0x9b0 [ 2689.293009][ T9028] ? __pfx_netlink_unicast+0x10/0x10 [ 2689.293024][ T9028] ? netlink_sendmsg+0x650/0xb40 [ 2689.293039][ T9028] ? skb_put+0x11b/0x210 [ 2689.293056][ T9028] netlink_sendmsg+0x813/0xb40 [ 2689.293088][ T9028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2689.293116][ T9028] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2689.293143][ T9028] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2689.293165][ T9028] ____sys_sendmsg+0x972/0x9f0 [ 2689.293192][ T9028] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2689.293216][ T9028] ? kstrtoull+0x12f/0x1d0 [ 2689.293248][ T9028] ___sys_sendmsg+0x2a5/0x360 [ 2689.293274][ T9028] ? __pfx____sys_sendmsg+0x10/0x10 [ 2689.293296][ T9028] ? get_pid_task+0x20/0x1f0 [ 2689.293313][ T9028] ? get_pid_task+0x20/0x1f0 [ 2689.293330][ T9028] ? get_pid_task+0x20/0x1f0 [ 2689.293369][ T9028] ? __fget_files+0x2a/0x420 [ 2689.293395][ T9028] ? __fget_files+0x3a0/0x420 [ 2689.293434][ T9028] __sys_sendmsg+0x183/0x260 [ 2689.293449][ T9028] ? __pfx___sys_sendmsg+0x10/0x10 [ 2689.293472][ T9028] __do_fast_syscall_32+0x20d/0x640 [ 2689.293486][ T9028] ? do_fast_syscall_32+0x33/0x70 [ 2689.293498][ T9028] ? asm_int80_emulation+0x1a/0x20 [ 2689.293508][ T9028] ? do_int80_emulation+0x274/0x4d0 [ 2689.293520][ T9028] ? trace_irq_disable+0x3b/0x150 [ 2689.293537][ T9028] do_fast_syscall_32+0x33/0x70 [ 2689.293550][ T9028] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2689.293563][ T9028] RIP: 0023:0xf6ffef6c [ 2689.293574][ T9028] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2689.293584][ T9028] RSP: 002b:00000000f53ed50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2689.293596][ T9028] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000200 [ 2689.293604][ T9028] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2689.293610][ T9028] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2689.293617][ T9028] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2689.293623][ T9028] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2689.293638][ T9028] [ 2689.652012][ T9029] i2c i2c-1: failure reading status [ 2689.726435][T14343] Bluetooth: hci3: command 0x0406 tx timeout [ 2690.803670][ T8240] usb 4-1: USB disconnect, device number 103 [ 2690.920821][ T9033] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9559'. [ 2691.030652][ T9035] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9560'. [ 2691.196374][ T9040] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9561'. [ 2691.366954][ T8240] usb 3-1: USB disconnect, device number 31 [ 2691.519633][ T9049] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9565'. [ 2691.576222][ T9049] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2691.614555][ T9052] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9565'. [ 2691.821296][ T9012] i2c i2c-1: failure reading data [ 2691.884971][ T9040] i2c i2c-1: failure reading data [ 2691.997927][T17091] usb 2-1: USB disconnect, device number 101 [ 2692.054113][ T3454] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2692.941746][ T9071] netlink: 'syz.3.9571': attribute type 1 has an invalid length. [ 2692.967742][ T9071] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9571'. [ 2693.030520][ T9071] erspan1: entered allmulticast mode [ 2693.143299][ T8240] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 2693.303193][ T8240] usb 2-1: Using ep0 maxpacket: 32 [ 2693.311334][ T8240] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2693.333161][ T8240] usb 2-1: can't read configurations, error -61 [ 2693.436899][ T9084] netlink: 'syz.2.9576': attribute type 2 has an invalid length. [ 2693.444888][ T9084] netlink: 'syz.2.9576': attribute type 11 has an invalid length. [ 2693.452736][ T9084] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9576'. [ 2693.464050][ T8240] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 2693.623345][ T8240] usb 2-1: Using ep0 maxpacket: 32 [ 2693.635691][ T8240] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2693.651693][ T8240] usb 2-1: can't read configurations, error -61 [ 2693.659445][ T8240] usb usb2-port1: attempt power cycle [ 2693.692896][ T9096] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9582'. [ 2693.868047][ T9092] pim6reg: entered allmulticast mode [ 2693.890108][ T9092] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9581'. [ 2694.003530][ T8240] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 2694.050967][ T8240] usb 2-1: Using ep0 maxpacket: 32 [ 2694.058293][ T8240] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2694.067572][ T8240] usb 2-1: can't read configurations, error -61 [ 2694.213232][ T8240] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 2694.234247][ T8240] usb 2-1: Using ep0 maxpacket: 32 [ 2694.241317][ T8240] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 2694.249385][ T8240] usb 2-1: can't read configurations, error -61 [ 2694.256185][ T8240] usb usb2-port1: unable to enumerate USB device [ 2694.333163][T21594] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 2694.495154][T21594] usb 4-1: Using ep0 maxpacket: 32 [ 2694.505023][T21594] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 2694.516422][T21594] usb 4-1: config 0 interface 0 has no altsetting 0 [ 2694.522178][ T9105] FAULT_INJECTION: forcing a failure. [ 2694.522178][ T9105] name failslab, interval 1, probability 0, space 0, times 0 [ 2694.523045][T21594] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 2694.536766][ T9105] CPU: 0 UID: 0 PID: 9105 Comm: syz.2.9585 Tainted: G L syzkaller #0 PREEMPT(full) [ 2694.536795][ T9105] Tainted: [L]=SOFTLOCKUP [ 2694.536803][ T9105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2694.536813][ T9105] Call Trace: [ 2694.536821][ T9105] [ 2694.536830][ T9105] dump_stack_lvl+0xe8/0x150 [ 2694.536860][ T9105] should_fail_ex+0x412/0x560 [ 2694.536890][ T9105] should_failslab+0xa8/0x100 [ 2694.536913][ T9105] ? skb_clone+0x212/0x3a0 [ 2694.536935][ T9105] kmem_cache_alloc_noprof+0x87/0x650 [ 2694.536953][ T9105] ? apparmor_capable+0x126/0x170 [ 2694.536980][ T9105] skb_clone+0x212/0x3a0 [ 2694.536999][ T9105] ? nfnetlink_rcv+0x4b0/0x27b0 [ 2694.537025][ T9105] nfnetlink_rcv+0x4e2/0x27b0 [ 2694.537058][ T9105] ? lockdep_hardirqs_on+0x7a/0x110 [ 2694.537078][ T9105] ? __dev_queue_xmit+0x277/0x3890 [ 2694.537099][ T9105] ? __local_bh_enable_ip+0xd0/0x130 [ 2694.537129][ T9105] ? __dev_queue_xmit+0x1e78/0x3890 [ 2694.537150][ T9105] ? do_fast_syscall_32+0x33/0x70 [ 2694.537177][ T9105] ? __dev_queue_xmit+0x277/0x3890 [ 2694.537203][ T9105] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 2694.537240][ T9105] ? ref_tracker_free+0x693/0x840 [ 2694.537265][ T9105] ? __copy_skb_header+0xa3/0x4a0 [ 2694.537287][ T9105] ? __pfx_ref_tracker_free+0x10/0x10 [ 2694.537327][ T9105] ? skb_clone+0x246/0x3a0 [ 2694.537350][ T9105] ? __netlink_deliver_tap+0x807/0x850 [ 2694.537377][ T9105] ? netlink_deliver_tap+0x2e/0x1b0 [ 2694.537418][ T9105] netlink_unicast+0x80f/0x9b0 [ 2694.537449][ T9105] ? __pfx_netlink_unicast+0x10/0x10 [ 2694.537474][ T9105] ? netlink_sendmsg+0x650/0xb40 [ 2694.537500][ T9105] ? skb_put+0x11b/0x210 [ 2694.537521][ T9105] netlink_sendmsg+0x813/0xb40 [ 2694.537555][ T9105] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2694.537585][ T9105] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2694.537611][ T9105] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2694.537634][ T9105] ____sys_sendmsg+0x972/0x9f0 [ 2694.537663][ T9105] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2694.537687][ T9105] ? kstrtoull+0x12f/0x1d0 [ 2694.537719][ T9105] ___sys_sendmsg+0x2a5/0x360 [ 2694.537743][ T9105] ? __pfx____sys_sendmsg+0x10/0x10 [ 2694.537765][ T9105] ? get_pid_task+0x20/0x1f0 [ 2694.537782][ T9105] ? get_pid_task+0x20/0x1f0 [ 2694.537798][ T9105] ? get_pid_task+0x20/0x1f0 [ 2694.537836][ T9105] ? __fget_files+0x2a/0x420 [ 2694.537862][ T9105] ? __fget_files+0x3a0/0x420 [ 2694.537896][ T9105] __sys_sendmsg+0x183/0x260 [ 2694.537918][ T9105] ? __pfx___sys_sendmsg+0x10/0x10 [ 2694.537957][ T9105] __do_fast_syscall_32+0x20d/0x640 [ 2694.537979][ T9105] ? do_fast_syscall_32+0x33/0x70 [ 2694.537999][ T9105] ? asm_int80_emulation+0x1a/0x20 [ 2694.538016][ T9105] ? do_int80_emulation+0x274/0x4d0 [ 2694.538036][ T9105] ? trace_irq_disable+0x3b/0x150 [ 2694.538065][ T9105] do_fast_syscall_32+0x33/0x70 [ 2694.538087][ T9105] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2694.538108][ T9105] RIP: 0023:0xf709ef6c [ 2694.538131][ T9105] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2694.538146][ T9105] RSP: 002b:00000000f548d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2694.538167][ T9105] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 2694.538180][ T9105] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2694.538191][ T9105] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2694.538202][ T9105] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2694.538214][ T9105] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2694.538238][ T9105] [ 2694.650170][ T9107] tipc: Enabled bearer , priority 0 [ 2694.652222][T21594] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2694.660668][ T9107] syzkaller0: entered promiscuous mode [ 2694.666747][T21594] usb 4-1: config 0 descriptor?? [ 2694.671715][ T9107] syzkaller0: entered allmulticast mode [ 2694.938649][ T9109] tipc: Resetting bearer [ 2694.947749][ T9106] tipc: Resetting bearer [ 2694.966958][ T9106] tipc: Disabling bearer [ 2695.254522][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 2695.473359][ T9123] input: syz0 as /devices/virtual/input/input201 [ 2695.540704][ T9126] ptrace attach of "./syz-executor exec"[6901] was attempted by "./syz-executor exec"[9126] [ 2696.418933][ T9133] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9595'. [ 2696.645488][ T9134] pim6reg: entered allmulticast mode [ 2696.655535][ T9134] pim6reg: left allmulticast mode [ 2696.722281][ T9134] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9594'. [ 2697.113424][T29471] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 2697.143617][T21594] usbhid 4-1:0.0: can't add hid device: -71 [ 2697.152663][T21594] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2697.221072][T21594] usb 4-1: USB disconnect, device number 104 [ 2697.311946][T29471] usb 2-1: too many configurations: 230, using maximum allowed: 8 [ 2697.328537][T29471] usb 2-1: config index 0 descriptor too short (expected 65176, got 161) [ 2697.340511][T29471] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2697.354985][ T9146] tipc: Enabled bearer , priority 0 [ 2697.366518][ T9146] syzkaller0: entered promiscuous mode [ 2697.372013][ T9146] syzkaller0: entered allmulticast mode [ 2697.381665][T29471] usb 2-1: config index 1 descriptor too short (expected 65176, got 161) [ 2697.390643][T29471] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2697.406972][ T9146] tipc: Resetting bearer [ 2697.410386][T29471] usb 2-1: config index 2 descriptor too short (expected 65176, got 161) [ 2697.423798][ T9145] tipc: Resetting bearer [ 2697.429873][T29471] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2697.451576][T29471] usb 2-1: config index 3 descriptor too short (expected 65176, got 161) [ 2697.460787][T29471] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2697.475230][ T9145] tipc: Disabling bearer [ 2697.475742][T29471] usb 2-1: config index 4 descriptor too short (expected 65176, got 161) [ 2697.535649][T29471] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2697.554973][T29471] usb 2-1: config index 5 descriptor too short (expected 65176, got 161) [ 2697.572697][T29471] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2697.597237][T29471] usb 2-1: config index 6 descriptor too short (expected 65176, got 161) [ 2697.616313][T29471] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2697.649048][T29471] usb 2-1: config index 7 descriptor too short (expected 65176, got 161) [ 2697.666194][T29471] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2697.681663][T29471] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 2697.701351][T29471] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2697.719344][T29471] usb 2-1: Product: syz [ 2697.719457][ T9152] netlink: 48 bytes leftover after parsing attributes in process `syz.0.9601'. [ 2697.725046][ T9150] tipc: Enabled bearer , priority 0 [ 2697.741424][T29471] usb 2-1: Manufacturer: syz [ 2697.746156][T29471] usb 2-1: SerialNumber: syz [ 2697.753308][T21594] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 2697.770220][T29471] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 2697.790087][T30517] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 2697.822635][ T9149] tipc: Disabling bearer [ 2697.915659][T21594] usb 3-1: Using ep0 maxpacket: 8 [ 2697.948646][T21594] usb 3-1: config 5 has an invalid interface number: 185 but max is 1 [ 2697.967211][T21594] usb 3-1: config 5 has an invalid descriptor of length 210, skipping remainder of the config [ 2698.019088][T21594] usb 3-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 2698.031501][T21594] usb 3-1: config 5 has no interface number 0 [ 2698.045636][ T9155] input: syz0 as /devices/virtual/input/input202 [ 2698.057192][T21594] usb 3-1: config 5 interface 185 altsetting 1 endpoint 0xC has an invalid bInterval 28, changing to 8 [ 2698.140979][T21594] usb 3-1: config 5 interface 185 altsetting 1 endpoint 0xC has invalid wMaxPacketSize 0 [ 2698.141071][T21594] usb 3-1: config 5 interface 185 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 2698.141099][T21594] usb 3-1: config 5 interface 185 has no altsetting 0 [ 2698.205211][ T9139] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2698.205526][ T9139] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2698.208846][T21594] usb 3-1: New USB device found, idVendor=04da, idProduct=2500, bcdDevice=83.2e [ 2698.208875][T21594] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2698.208892][T21594] usb 3-1: Product: 쌙ŏ匴ﾡꡮƉᑈ懳麀群䔉鈣㵤 [ 2698.208902][T21594] usb 3-1: Manufacturer: N [ 2698.208910][T21594] usb 3-1: SerialNumber: 쑊壒ᠤ텝᥽뿞辳ᴘ୫᥍덟窠등굁헙繯괴廆น會쯢獒戛ㅊ鰊䉹랴鬝ﲵꬬ죑᎔ઃ໯⋺꺠傲ᥘ〞듁뀛ﯰᎏぢ螉ᡎ᝴ꇐ㡠冇厘驪ㆉ裖됇Ỗ얱䌮鄔Ⰺ潨ﭸℹ鳕剝ⴏᮍ똸꫋⿈禍뭷 [ 2698.222453][T31954] usb 2-1: USB disconnect, device number 106 [ 2698.449517][ T9148] blktrace: Concurrent blktraces are not allowed on nullb0 [ 2698.845030][T17091] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 2698.853225][T30517] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 2698.860695][T30517] ath9k_htc: Failed to initialize the device [ 2698.867725][T31954] usb 2-1: ath9k_htc: USB layer deinitialized [ 2699.004779][T17091] usb 4-1: config index 0 descriptor too short (expected 3133, got 61) [ 2699.013532][T17091] usb 4-1: config 0 has an invalid interface number: 156 but max is 1 [ 2699.021714][T17091] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.032569][T17091] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2699.041504][T17091] usb 4-1: config 0 has no interface number 0 [ 2699.048183][T17091] usb 4-1: config 0 interface 156 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 2699.058120][T17091] usb 4-1: config 0 interface 156 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2699.074349][T17091] usb 4-1: New USB device found, idVendor=abcd, idProduct=cde3, bcdDevice= 5.b9 [ 2699.083612][T17091] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2699.093714][T17091] usb 4-1: config 0 descriptor?? [ 2699.106220][T17091] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2699.113640][T17091] usb 4-1: MIDIStreaming interface descriptor not found [ 2699.177675][T31954] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 2699.344037][T31954] usb 2-1: too many configurations: 230, using maximum allowed: 8 [ 2699.354938][T31954] usb 2-1: config index 0 descriptor too short (expected 65176, got 161) [ 2699.363876][T31954] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.377262][T31954] usb 2-1: config index 1 descriptor too short (expected 65176, got 161) [ 2699.386011][T31954] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.398047][T31954] usb 2-1: config index 2 descriptor too short (expected 65176, got 161) [ 2699.406865][T31954] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.419635][T31954] usb 2-1: config index 3 descriptor too short (expected 65176, got 161) [ 2699.428455][T31954] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.440488][T31954] usb 2-1: config index 4 descriptor too short (expected 65176, got 161) [ 2699.449246][T31954] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.461203][T31954] usb 2-1: config index 5 descriptor too short (expected 65176, got 161) [ 2699.471325][T31954] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.484064][T31954] usb 2-1: config index 6 descriptor too short (expected 65176, got 161) [ 2699.492938][T31954] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.505791][T31954] usb 2-1: config index 7 descriptor too short (expected 65176, got 161) [ 2699.515015][T31954] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2699.529274][T31954] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 2699.539177][T31954] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2699.547579][T31954] usb 2-1: Product: syz [ 2699.552019][T31954] usb 2-1: Manufacturer: syz [ 2699.552497][ T9160] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9604'. [ 2699.566203][T31954] usb 2-1: SerialNumber: syz [ 2699.575185][ T8240] usb 4-1: USB disconnect, device number 105 [ 2699.620271][T31954] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 2700.481431][T21594] usb 3-1: USB disconnect, device number 32 [ 2700.707318][ T8009] usb 2-1: ath9k_htc: Firmware - ath9k_htc/htc_9271-1.4.0.fw download failed [ 2700.721850][ T8009] usb 2-1: ath9k_htc: USB layer deinitialized [ 2700.958559][T30517] usb 2-1: USB disconnect, device number 107 [ 2701.338766][ T9183] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9611'. [ 2701.558243][ T9187] tipc: Enabling of bearer rejected, failed to enable media [ 2701.784736][ T9193] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9614'. [ 2701.863836][ T9194] netlink: 'syz.2.9614': attribute type 10 has an invalid length. [ 2701.878840][ T9194] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2701.888259][ T9194] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 2701.903350][T21594] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 2701.922359][ T9194] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2701.931495][ T9194] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2701.987345][ T9194] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2701.994986][ T9194] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2702.013413][ T9194] bond0: (slave batadv0): Releasing backup interface [ 2702.053142][T21594] usb 4-1: Using ep0 maxpacket: 32 [ 2702.061975][T21594] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 2702.072988][T21594] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2702.089606][T21594] usb 4-1: Product: syz [ 2702.095212][T21594] usb 4-1: Manufacturer: syz [ 2702.099794][T21594] usb 4-1: SerialNumber: syz [ 2702.111230][T21594] usb 4-1: config 0 descriptor?? [ 2702.557380][ T3453] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2702.655473][T21594] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: version d4.15 found at bus 004 address 106 [ 2703.273305][T21594] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 2703.303176][T17091] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 2703.433264][T21594] usb 2-1: Using ep0 maxpacket: 32 [ 2703.441700][T21594] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 2703.457035][ T9188] i2c i2c-1: failure reading status [ 2703.464628][T21594] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 2703.478209][T31954] usb 4-1: USB disconnect, device number 106 [ 2703.484325][T17091] usb 3-1: Using ep0 maxpacket: 8 [ 2703.508081][T17091] usb 3-1: config 5 has an invalid interface number: 185 but max is 1 [ 2703.519148][T21594] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2703.538555][T17091] usb 3-1: config 5 has an invalid descriptor of length 210, skipping remainder of the config [ 2703.555320][T21594] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 2703.573571][T17091] usb 3-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 2703.605393][T17091] usb 3-1: config 5 has no interface number 0 [ 2703.611886][T17091] usb 3-1: config 5 interface 185 altsetting 1 endpoint 0xC has an invalid bInterval 28, changing to 8 [ 2703.623666][T21594] usb 2-1: config 0 interface 0 has no altsetting 0 [ 2703.643433][T17091] usb 3-1: config 5 interface 185 altsetting 1 endpoint 0xC has invalid wMaxPacketSize 0 [ 2703.653945][T17091] usb 3-1: config 5 interface 185 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 2703.667682][T21594] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 2703.678320][T17091] usb 3-1: config 5 interface 185 has no altsetting 0 [ 2703.685232][T21594] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 2703.693882][T21594] usb 2-1: Product: syz [ 2703.698090][T21594] usb 2-1: Manufacturer: syz [ 2703.703638][T21594] usb 2-1: SerialNumber: syz [ 2703.710971][T21594] usb 2-1: config 0 descriptor?? [ 2703.716925][T17091] usb 3-1: New USB device found, idVendor=04da, idProduct=2500, bcdDevice=83.2e [ 2703.727805][T21594] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 2703.737240][T17091] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2703.745267][T17091] usb 3-1: Product: 쌙ŏ匴ﾡꡮƉᑈ懳麀群䔉鈣㵤 [ 2703.752373][T17091] usb 3-1: Manufacturer: N [ 2703.757527][T17091] usb 3-1: SerialNumber: 쑊壒ᠤ텝᥽뿞辳ᴘ୫᥍덟窠등굁헙繯괴廆น會쯢獒戛ㅊ鰊䉹랴鬝ﲵꬬ죑᎔ઃ໯⋺꺠傲ᥘ〞듁뀛ﯰᎏぢ螉ᡎ᝴ꇐ㡠冇厘驪ㆉ裖됇Ỗ얱䌮鄔Ⰺ潨ﭸℹ鳕剝ⴏᮍ똸꫋⿈禍뭷 [ 2703.784106][T21594] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 2704.065459][ T9202] blktrace: Concurrent blktraces are not allowed on nullb0 [ 2704.404151][ T9204] ldusb 2-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 2704.438480][ T9207] ldusb 2-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71 [ 2704.527740][T30517] usb 2-1: USB disconnect, device number 108 [ 2704.527773][ C1] ldusb 2-1:0.0: usb_submit_urb failed (-19) [ 2704.593833][T30517] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 2704.668694][ T9211] input: syz0 as /devices/virtual/input/input203 [ 2704.853930][ T30] INFO: task kworker/u8:4:15613 blocked for more than 143 seconds. [ 2704.864072][ T30] Tainted: G L syzkaller #0 [ 2704.886167][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 2704.906927][ T30] task:kworker/u8:4 state:D stack:21032 pid:15613 tgid:15613 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 2704.935401][ T30] Workqueue: netns cleanup_net [ 2704.947619][ T30] Call Trace: [ 2704.964041][ T30] [ 2704.970126][ T30] __schedule+0x15dd/0x52d0 [ 2704.980299][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 2704.990159][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 2704.995703][ T30] ? __pfx___schedule+0x10/0x10 [ 2705.001367][ T30] ? schedule+0x90/0x360 [ 2705.074081][ T30] schedule+0x164/0x360 [ 2705.078289][ T30] afs_cell_purge+0x40d/0x580 [ 2705.203153][ T30] ? __pfx_afs_cell_purge+0x10/0x10 [ 2705.216845][ T30] ? __pfx_var_wake_function+0x10/0x10 [ 2705.222343][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 2705.283183][ T30] ? __timer_delete_sync+0x4a4/0x520 [ 2705.288523][ T30] afs_net_exit+0x50/0x100 [ 2705.292950][ T30] ops_undo_list+0x49f/0x940 [ 2705.323226][ T30] ? __pfx_ops_undo_list+0x10/0x10 [ 2705.328383][ T30] ? idr_destroy+0x218/0x290 [ 2705.333005][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 2705.363208][ T30] cleanup_net+0x56b/0x800 [ 2705.367706][ T30] ? __pfx_cleanup_net+0x10/0x10 [ 2705.372661][ T30] ? process_scheduled_works+0xa8d/0x18c0 [ 2705.403328][ T30] ? process_scheduled_works+0xa8d/0x18c0 [ 2705.409299][ T30] process_scheduled_works+0xb6e/0x18c0 [ 2705.423195][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 2705.429216][ T30] ? assign_work+0x3d5/0x5e0 [ 2705.444693][ T30] worker_thread+0xa53/0xfc0 [ 2705.449368][ T30] kthread+0x388/0x470 [ 2705.453908][ T30] ? __pfx_worker_thread+0x10/0x10 [ 2705.459039][ T30] ? __pfx_kthread+0x10/0x10 [ 2705.473184][ T30] ret_from_fork+0x51e/0xb90 [ 2705.477838][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 2705.482988][ T30] ? __switch_to+0xc7d/0x1450 [ 2705.491951][ T30] ? __pfx_kthread+0x10/0x10 [ 2705.503228][ T30] ret_from_fork_asm+0x1a/0x30 [ 2705.508077][ T30] [ 2705.511273][ T30] [ 2705.511273][ T30] Showing all locks held in the system: [ 2705.533287][ T30] 1 lock held by rcu_exp_gp_kthr/18: [ 2705.538590][ T30] 1 lock held by ksoftirqd/1/23: [ 2705.577493][T17091] usb 3-1: USB disconnect, device number 33 [ 2705.592400][ T30] #0: ffff8880b863ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb6/0x150 [ 2705.623186][ T30] 1 lock held by khungtaskd/30: [ 2705.628055][ T30] #0: ffffffff8e75e520 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 2705.653416][ T30] 2 locks held by getty/5584: [ 2705.658111][ T30] #0: ffff8880320b50a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 2705.673026][ T30] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 2705.703149][ T30] 3 locks held by kworker/u8:4/15613: [ 2705.708533][ T30] #0: ffff88801b6de948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 2705.724532][ T30] #1: ffffc9001bf0fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 2705.735528][ T30] #2: ffffffff8fbbf430 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 2705.745177][ T30] 3 locks held by kworker/1:0/17091: [ 2705.750483][ T30] #0: ffff88801fef7948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 2705.762382][ T30] #1: ffffc90004057c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 2705.774588][ T30] #2: ffff88823bf72998 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 2705.793350][ T30] 2 locks held by kworker/0:5/29471: [ 2705.798671][ T30] #0: ffff88813fe0f148 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 2705.824284][ T30] #1: ffffc9000c56fc40 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 2705.834790][ T30] 1 lock held by syz.1.9440/8613: [ 2705.839815][ T30] #0: ffffffff8e7647b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 2705.850882][ T30] 1 lock held by syz.3.9618/9210: [ 2705.856031][ T30] #0: ffffffff8f63dfc8 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x328/0x640 [ 2705.866289][ T30] 1 lock held by syz.0.9620/9214: [ 2705.871293][ T30] #0: ffffffff8e7647b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 2705.893350][ T30] [ 2705.910486][ T30] ============================================= [ 2705.910486][ T30] [ 2705.939269][ T30] NMI backtrace for cpu 1 [ 2705.939291][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2705.939316][ T30] Tainted: [L]=SOFTLOCKUP [ 2705.939324][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2705.939336][ T30] Call Trace: [ 2705.939344][ T30] [ 2705.939353][ T30] dump_stack_lvl+0xe8/0x150 [ 2705.939384][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 2705.939410][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2705.939436][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 2705.939465][ T30] sys_info+0x135/0x170 [ 2705.939488][ T30] watchdog+0xfd9/0x1030 [ 2705.939519][ T30] ? watchdog+0x21a/0x1030 [ 2705.939551][ T30] kthread+0x388/0x470 [ 2705.939571][ T30] ? __pfx_watchdog+0x10/0x10 [ 2705.939597][ T30] ? __pfx_kthread+0x10/0x10 [ 2705.939617][ T30] ret_from_fork+0x51e/0xb90 [ 2705.939644][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 2705.939666][ T30] ? __switch_to+0xc7d/0x1450 [ 2705.939691][ T30] ? __pfx_kthread+0x10/0x10 [ 2705.939711][ T30] ret_from_fork_asm+0x1a/0x30 [ 2705.939760][ T30] [ 2705.939768][ T30] Sending NMI from CPU 1 to CPUs 0: [ 2706.057352][ C0] NMI backtrace for cpu 0 [ 2706.057372][ C0] CPU: 0 UID: 0 PID: 9214 Comm: syz.0.9620 Tainted: G L syzkaller #0 PREEMPT(full) [ 2706.057397][ C0] Tainted: [L]=SOFTLOCKUP [ 2706.057403][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2706.057414][ C0] RIP: 0010:_raw_spin_trylock+0x67/0x80 [ 2706.057446][ C0] Code: c9 ff 74 24 10 e8 09 7d f0 f5 48 83 c4 08 eb 17 bf 01 00 00 00 e8 99 df e2 f5 65 8b 05 f2 22 6b 07 31 db 85 c0 74 0b 89 d8 5b <41> 5e e9 52 4b 00 00 cc e8 9c a0 82 f5 eb ee 66 2e 0f 1f 84 00 00 [ 2706.057460][ C0] RSP: 0018:ffffc90003a07888 EFLAGS: 00000292 [ 2706.057476][ C0] RAX: 0000000000000001 RBX: ffff8880b8640b80 RCX: 0000000080000002 [ 2706.057489][ C0] RDX: 00000000a0a395a0 RSI: ffffffff8e168271 RDI: ffffffff8c27c200 [ 2706.057502][ C0] RBP: 0000000000000000 R08: ffffffff82210edf R09: ffff8880b8640b98 [ 2706.057514][ C0] R10: dffffc0000000000 R11: fffff52000740f00 R12: ffffea00027a9c80 [ 2706.057527][ C0] R13: ffff88813fffbb80 R14: ffff8880b8640b98 R15: 0000000000000000 [ 2706.057540][ C0] FS: 0000000000000000(0000) GS:ffff88812545d000(0000) knlGS:0000000000000000 [ 2706.057555][ C0] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 2706.057567][ C0] CR2: 00000000f546bff4 CR3: 0000000035f16000 CR4: 00000000003526f0 [ 2706.057583][ C0] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000080083 [ 2706.057594][ C0] DR3: ffffffffefffff16 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 2706.057606][ C0] Call Trace: [ 2706.057614][ C0] [ 2706.057626][ C0] __free_frozen_pages+0x6cf/0xdb0 [ 2706.057649][ C0] ? ___free_pages+0xb2/0x220 [ 2706.057671][ C0] vfree+0x25a/0x400 [ 2706.057687][ C0] ? __pfx_kcov_close+0x10/0x10 [ 2706.057713][ C0] kcov_close+0x28/0x50 [ 2706.057736][ C0] __fput+0x44f/0xa70 [ 2706.057765][ C0] task_work_run+0x1d9/0x270 [ 2706.057784][ C0] ? __pfx_task_work_run+0x10/0x10 [ 2706.057803][ C0] ? kmem_cache_free+0x187/0x630 [ 2706.057821][ C0] ? do_exit+0x70a/0x23c0 [ 2706.057839][ C0] do_exit+0x70f/0x23c0 [ 2706.057859][ C0] ? __pfx_do_exit+0x10/0x10 [ 2706.057873][ C0] ? cgroup1_freezing+0x20/0x350 [ 2706.057897][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 2706.057919][ C0] do_group_exit+0x21b/0x2d0 [ 2706.057935][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 2706.057952][ C0] get_signal+0x1284/0x1330 [ 2706.057982][ C0] arch_do_signal_or_restart+0xbc/0x830 [ 2706.058010][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 2706.058028][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 2706.058053][ C0] exit_to_user_mode_loop+0x86/0x480 [ 2706.058072][ C0] ? rcu_is_watching+0x15/0xb0 [ 2706.058097][ C0] __do_fast_syscall_32+0x415/0x640 [ 2706.058117][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 2706.058135][ C0] ? do_fast_syscall_32+0x33/0x70 [ 2706.058154][ C0] ? irqentry_exit+0x10e/0x620 [ 2706.058171][ C0] ? trace_irq_disable+0x3b/0x150 [ 2706.058198][ C0] do_fast_syscall_32+0x33/0x70 [ 2706.058217][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2706.058238][ C0] RIP: 0023:0xf709ef6c [ 2706.058252][ C0] Code: Unable to access opcode bytes at 0xf709ef42. [ 2706.058261][ C0] RSP: 002b:00000000f546c4bc EFLAGS: 00000206 ORIG_RAX: 0000000000000078 [ 2706.058277][ C0] RAX: fffffffffffffff4 RBX: 0000000000100411 RCX: 0000000000000000 [ 2706.058289][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2706.058299][ C0] RBP: 00000000f546c5ec R08: 0000000000000000 R09: 0000000000000000 [ 2706.058310][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2706.058320][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2706.058337][ C0] [ 2706.246285][ T3457] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2706.255951][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 2706.255977][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2706.256003][ T30] Tainted: [L]=SOFTLOCKUP [ 2706.256011][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2706.256022][ T30] Call Trace: [ 2706.256031][ T30] [ 2706.256041][ T30] vpanic+0x56c/0xa60 [ 2706.256071][ T30] ? __pfx___schedule+0x10/0x10 [ 2706.256091][ T30] ? __pfx_vpanic+0x10/0x10 [ 2706.256116][ T30] ? __pfx_console_unlock+0x10/0x10 [ 2706.256150][ T30] panic+0xc5/0xd0 [ 2706.256174][ T30] ? __pfx_panic+0x10/0x10 [ 2706.256200][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 2706.256226][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 2706.256255][ T30] watchdog+0x1023/0x1030 [ 2706.256287][ T30] ? watchdog+0x21a/0x1030 [ 2706.256320][ T30] kthread+0x388/0x470 [ 2706.256338][ T30] ? __pfx_watchdog+0x10/0x10 [ 2706.256364][ T30] ? __pfx_kthread+0x10/0x10 [ 2706.256383][ T30] ret_from_fork+0x51e/0xb90 [ 2706.256410][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 2706.256433][ T30] ? __switch_to+0xc7d/0x1450 [ 2706.256458][ T30] ? __pfx_kthread+0x10/0x10 [ 2706.256477][ T30] ret_from_fork_asm+0x1a/0x30 [ 2706.256517][ T30] [ 2706.257359][ T30] Kernel Offset: disabled