last executing test programs: 4m33.052607365s ago: executing program 1 (id=483): r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000340)=""/90) 4m33.014056215s ago: executing program 1 (id=484): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000f00)=ANY=[@ANYBLOB="b0010000100001002bbd700000000088000000000000000000ff64010100ff0100000000000000000000000000010000ecdf000002000a000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff00000000000000000000000000000000321a000064010100000000000000000000000000feffffffffffffff0000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000080000000000000000084000000000000000000000000000000400000000000000000000000000000000000000000000000000000a0004002c00000000000000580002006362632861657329000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000e0fad3f10cd3a506627800000000074f4c001400686d616328736861323536290000000000"], 0x1b0}}, 0x4050) 4m32.942670021s ago: executing program 1 (id=485): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="a013000040000701fcffffff00000100017c0000040042800c00018006000600801c00007c13028078131480731315806f1301"], 0x13a0}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x74) close(r1) socket$packet(0x11, 0x2, 0x300) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) recvmsg$can_bcm(r2, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x40000100) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = socket$kcm(0xa, 0x2, 0x73) setsockopt$sock_attach_bpf(r4, 0x29, 0x21, &(0x7f0000000200), 0x4) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, 0x7, 0x2, 0x2, 0x4, 0x2, 0x7}, &(0x7f0000000080)=0x20) sendmsg$AUDIT_MAKE_EQUIV(0xffffffffffffffff, &(0x7f0000010240)={0x0, 0x0, &(0x7f0000010280)={&(0x7f00000001c0)={0x28, 0x3f7, 0x0, 0x0, 0x400, {0x7, 0x7, './file0', './file0'}}, 0x28}}, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000010480)={[&(0x7f0000000200)='\x01', &(0x7f0000010400)='/dev/qrtr-tun\x00']}) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="a013000040000701fcffffff00000100017c0000040042800c00018006000600801c00007c13028078131480731315806f1301"], 0x13a0}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) creat(&(0x7f00000000c0)='./file0\x00', 0x74) (async) close(r1) (async) socket$packet(0x11, 0x2, 0x300) (async) socket$netlink(0x10, 0x3, 0x4) (async) write(r2, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) (async) recvmsg$can_bcm(r2, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x40000100) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) socket$kcm(0xa, 0x2, 0x73) (async) setsockopt$sock_attach_bpf(r4, 0x29, 0x21, &(0x7f0000000200), 0x4) (async) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @empty}, 0x7, 0x2, 0x2, 0x4, 0x2, 0x7}, &(0x7f0000000080)=0x20) (async) sendmsg$AUDIT_MAKE_EQUIV(0xffffffffffffffff, &(0x7f0000010240)={0x0, 0x0, &(0x7f0000010280)={&(0x7f00000001c0)={0x28, 0x3f7, 0x0, 0x0, 0x400, {0x7, 0x7, './file0', './file0'}}, 0x28}}, 0x0) (async) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000010480)={[&(0x7f0000000200)='\x01', &(0x7f0000010400)='/dev/qrtr-tun\x00']}) (async) 4m32.796451267s ago: executing program 1 (id=486): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[]) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r3, r3, &(0x7f0000000000)=0x2eb4, 0x2000007ff) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r4, 0x40106f52, &(0x7f0000000280)={0x3d, &(0x7f0000000180)=[{0x26, '\x00', @st={0x4, [{0x2, @uvalue=0x8001}, {0x1, @uvalue=0x6}, {0x1, @uvalue=0xe6b6}, {0x2}]}, 0xffffffff}]}) 4m31.880547507s ago: executing program 1 (id=491): r0 = socket$nl_generic(0x10, 0x3, 0x10) rt_sigsuspend(&(0x7f0000000100)={[0xfffffffffffffffd]}, 0x8) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) prlimit64(0x0, 0x7, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x40100, 0x0) ioctl$TCSETS(r2, 0x545c, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) r3 = syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000140)=0x8, 0x4) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f00000002c0)={0x11, 0x4, 0x10, 0x0, @vifc_lcl_addr=@multicast2, @remote}, 0x10) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r6 = fcntl$dupfd(r5, 0x406, r5) read$FUSE(r6, &(0x7f0000002480)={0x2020}, 0x2020) write$tun(r6, &(0x7f0000000400)=ANY=[], 0xa2) r7 = creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) ftruncate(r7, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r7, 0x0, 0xd2, &(0x7f0000000280)={@private=0xa010101, @empty, 0x0, "614af285791a63abd0f993af8077b5cd01e03d64a831683fdc3fd440829c82ae", 0x0, 0x0, 0x0, 0x404}, 0x3c) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000002500090122bd7008f9ffffff0200000008000300470000000c003e80080010000a0101007ffe721693268cb02199de603c2093369f01c9e34942d65781cbe2c2461e62e8424d05db95e52d5aec0eaac87523d749f329b65911685173d7dd5a7878c8c0054e386f09498087fdc37d3f"], 0x28}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0xa, 0x4280) 4m31.448503589s ago: executing program 1 (id=494): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="e4010000100001000000000000000000fc020000000000000000000000000000000000000000000000000000000019000000ecdf000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000c73b0000000000000000000000000000000000800000000000000000000000000000000000000000ffffffff2dbd700000000000020004004c000000000000001c001700000000002abd700000000000000000000000000000000000480002006362632873657270656e742900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008d001400686d61632873686132353629"], 0x1e4}}, 0x0) 4m31.248155399s ago: executing program 32 (id=494): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="e4010000100001000000000000000000fc020000000000000000000000000000000000000000000000000000000019000000ecdf000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000c73b0000000000000000000000000000000000800000000000000000000000000000000000000000ffffffff2dbd700000000000020004004c000000000000001c001700000000002abd700000000000000000000000000000000000480002006362632873657270656e742900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008d001400686d61632873686132353629"], 0x1e4}}, 0x0) 19.635990914s ago: executing program 5 (id=1552): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b405000000000000711041000000000026000070000000009500"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 19.460953926s ago: executing program 5 (id=1556): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={0x1, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000240), 0x4) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x16, 0x4bd5, 0xa9bd, 0x4, 0x1040, 0xffffffffffffffff, 0x7fffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x4}, 0x50) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000380)=@generic={&(0x7f0000000340)='./file0\x00'}, 0x18) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000003c0)={0xffffffffffffffff, 0x8}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x9, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x90000000}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x1, '\x00', r1, 0x0, r2, 0x8, &(0x7f0000000280)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000400)=[0xffffffffffffffff, r3, r4, r5], &(0x7f0000000440)=[{0x4, 0x1, 0x8, 0x4}, {0x2, 0x2, 0xe}, {0x1, 0x4, 0xf, 0x3}], 0x10, 0x6}, 0x94) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000540), 0x9b7561cdd93c2196, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000580)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000600)={0x48, 0x7, r7, 0x0, 0x0, 0x0, 0x1, 0x2dc496, 0xb1a6f}) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000680)='./cgroup/syz0\x00', 0x200002, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r8, 0x400c6615, &(0x7f00000006c0)={0x0, @aes256, 0x0, @desc1}) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000700), 0x40040, 0x0) ioctl$PPPIOCGIDLE(r9, 0x8010743f, &(0x7f0000000740)) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000880)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x5000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000780)="d406857f2b505ff152b0487a67f9b35b223e717b14753a9773a1f31a8a5167facc3d8abfeb115fc82ed6ed59751fb7fb4b1920bc9c52fbe4856c378c8b91eb69b6c464df57747312d54e7fc9a4420da79fce0dbc7ec26e3b8ec7a50069e411475b8637aa0223a9484a9b84fcd44e78d39f7cf1633f77197421df8246755e15a0b1f71fb058f55c223dc33c0fe5fb111358c2ca8504a820164b9f1c9b7ca052e3c0c25656d26ba3295c3901f4753ac38954d6b4814e64361ccca19a7d505b688835a8d20cb94eeeb43571e6aef54bf752523086bf5814d2d61aac6020fdc4efb502ae453576b26675557f1e90801434e9c6", 0xf1, r6}, 0x68) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000900)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000980)={0xc, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r6, 0x3b89, &(0x7f0000000a00)={0x28, 0x3, r10, r11, 0x0, 0x0, 0xdead, 0x4, &(0x7f00000009c0)}) r12 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r12, 0x4008ae93, &(0x7f0000000a40)=0x100000) r13 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x35) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000a80)={0x10200, 0x6, 0xdddd0000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) r14 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000ac0)='/proc/diskstats\x00', 0x0, 0x0) r15 = gettid() write$cgroup_pid(r14, &(0x7f0000000b00)=r15, 0x12) read$FUSE(r14, &(0x7f0000000b40)={0x2020, 0x0, 0x0}, 0x2020) getsockopt$inet6_IPV6_XFRM_POLICY(r14, 0x29, 0x23, &(0x7f0000002b80)={{{@in=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000002c80)=0xe8) write$FUSE_STATX(r14, &(0x7f0000002cc0)={0x130, 0xfffffffffffffffe, r16, {0x8, 0x8, 0x0, '\x00', {0x2, 0x5, 0x0, 0xffffffff, r17, 0x0, 0x2000, '\x00', 0x1, 0x1, 0x6, 0x9, {0xb, 0xed}, {0x8, 0xef}, {0xc, 0xc0}, {0x8, 0xf}, 0x3ff, 0xff, 0x2, 0x4}}}, 0x130) ioctl$BTRFS_IOC_DEV_INFO(r13, 0xd000941e, &(0x7f0000002e00)={0x0, "aa12ad5e2331a1a51f7eaa166e87f1ea"}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000003e00)={r18, 0x9, 0x4, 0x1}) 19.344947021s ago: executing program 5 (id=1558): sendmmsg(0xffffffffffffffff, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000240)="65cfeb0e03a97e7ae97d1413e586e23b8d38f547ab5a1eab12", 0x19}], 0x1}}], 0x1, 0x40008) socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008006301"], 0x44}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007a7918085f0500a8ffb3010202f90902120001002d00000904"], 0x0) 19.250117661s ago: executing program 0 (id=1560): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="e4010000100001000000000000000000fc020000000000000000000000000000000000000000000000000000000000000000ecdf000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000c73b0000000000000000000000000000000000800000000000000000000000000000000000000000ffffffff2dbd700000000000020004004c000000000000001c001700000000002abd700000000000000000000000000000000000480002006362632873657270656e742900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008d001400686d61632873686132353629"], 0x1e4}}, 0x0) 18.947861724s ago: executing program 0 (id=1562): socket$kcm(0x29, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x2, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000003e40), 0xffffffffffffffff) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000004c0)="c13b5849063444584d7eab81ce851c3f2ffc95c04a422acdee9681a3bc0ce180449f9ba8835365b3bb417fdad417db9e31abdc405722eeb9f21e7ef1fdefa6cda3f3c262d95960054153a580254cceda321179de8455147d5f3e4db2e4eca6ac3d4486ef3a156283a2d23281c0b933cfb2f79e322c99f6fdc1f9204a28143bae197d19c589bd2a16b61c701a8707aeb8deb9f1f9853cf1c0233b2fb52cf1891d4a4ff0a25035762d2bdf701ceb894dfc8e47d9616d4ca1ee6ce6141e3def72fcf1fa9bc39f2c6d323d550839f10e396336ef502b281636d47ccf84d062900309609b8e5bcd9b3af22bdbf066d0160e052a7eec57f8eec3d36136abd51759bc559932b572ec3c98ae30ebbd31195579ad42c6b2aceee9530ee976a82ed0cefd5ff05029f38673fb89724ffd8e0a2fb6a5abb9ba57cd09db66e672b81f88a19248564e6197c30335f0dcf4c506862a668261496ff69779e8212ac5f91eeca8e0c274c6bb562c5d3b648e027aa91cedce953573c7c035165781935455f850efdc9a42c24bcba7ee422a61e05f53d67cea8d46cf857d9c1ea80d33dab5d3f993f1d85a9e2f01f8ff5214c52ae0daccd2b367799c850c5deb387a5463c96c04409c624c46ca78fbac01b42a8ca2f602d1e27901704c24f84b22ee1ea37ec70592f934963f8e1fabb4ccc3fcfa1ffea3fe9fb4217cd010a4ae4292147745129a2eab624f7ee3111794c4cdb0b4198efdd077f08bbcdfa3ba25af557c2c1f1979aaa8d1664e4077c496144daebcefa8d6ebaa3167b1cadb9d9aa1f7c14a9564da1d7f4cdaae59982f21591cb5394c5d99783ba4a4463988461a76", 0x257}], 0x1, 0x0, 0x0, 0x8000}, 0x0) r0 = memfd_secret(0x0) futimesat(r0, 0x0, 0x0) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="6400000002060108000000000000000005000003050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e65740000000014000780080006400000020008000840"], 0x64}, 0x1, 0x0, 0x0, 0x90}, 0x40c0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001640)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000003c0)='ns/uts\x00') madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 18.100272467s ago: executing program 2 (id=1565): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c0100001300010100000000000000006401010200000000000000000000000000000000000000000000ffff7f0000010000000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000000000000000000000000000000000000000000ffffffffffffffff0000000000000000190000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000100000000007afeffffff0000000000000000000000008400050020010000000000000000000000000001000000002b0000000a000000ac1414aa000000000000000000f0fedf3ac8db11ad"], 0x13c}}, 0x0) 17.952395819s ago: executing program 2 (id=1568): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c0000001900010025bd7000ffdbdf25022080ccfd02c8060004000008001e0001000000080004003e"], 0x2c}}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x2, 0x0, {0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) syz_usb_control_io(r0, &(0x7f0000000880)={0x18, &(0x7f0000000680)=ANY=[@ANYBLOB="20230f0000000fe06e8fb2cd9190"], 0x0, 0x0, 0x0, 0x0}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x202) ioctl$SCSI_IOCTL_PROBE_HOST(r6, 0x5385, &(0x7f0000000000)={0x8d, ""/141}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000380)="88a96c864696ec545f8b765f2953156bae1f0d51131cf90d056c26f9fbb61532bc6dbea9cf1b8933cd9550e8fae9e4688070d97f50f7e1e959b6411e171bd9708386cb030011c17b510db0c6f5b5fbe4847f46eb3ef68724a9aee30af264c718f74b2a3b19da94b50e639c7f3e1d45faeb182e192dfcf93a57cc1da493981dba1639551626185e1546e26a10157fdb825f5ff6ab936e560749b021b1d4aa2345c9029b3036c78835f2f8d8249c1e0c502d8a0a30a65610c34402750616f99b3130", 0xc1) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0x9, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x7f, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x8000000000000001}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) ioctl$HIDIOCSREPORT(r8, 0x400c4808, &(0x7f00000001c0)={0x2, 0x100, 0xf7}) 17.828540595s ago: executing program 5 (id=1570): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x400}}, 0x14}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x31}, 0x20008888) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000040)={0x5c, 0xa, 0x0, "3258c546dacccfae1e008faa022c1e00f4bf40074000000200"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000080), 0x12) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0x80045500, &(0x7f0000000100)) io_uring_setup(0x89d, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7, 0x0, r3}) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = add_key(0x0, &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r4, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r4, 0xffffffffffffffff) fspick(r4, &(0x7f0000000140)='./file0\x00', 0x1) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="01000000070200000080000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r6}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r6, &(0x7f00000005c0), &(0x7f0000000680)=""/151}, 0x20) mkdirat$cgroup(r3, &(0x7f0000000000)='syz0\x00', 0x1ff) 17.74709987s ago: executing program 5 (id=1571): syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000008640)=ANY=[@ANYBLOB="12010000020000402505a0a440000102030109025c0002010000010904000001020d001a052406000105240000c00d240f0100000000000000000306241a00000009058103"], 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3fd, &(0x7f0000000500)=0x0) io_pgetevents(r1, 0x1, 0x1, &(0x7f0000000100)=[{}], 0x0, 0x0) io_submit(r1, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f00000001c0)='m', 0xfdfe, 0x400000000000000}]) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000000)=0x4) 17.267898432s ago: executing program 5 (id=1572): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="e4010000100001000000000000000000fc020000000000000000000000000000000000000000000000000000000000000000ecdf000000000a00190000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000c73b0000000000000000000000000000000000800000000000000000000000000000000000000000ffffffff2dbd700000000000020004004c000000000000001c001700000000002abd700000000000000000000000000000000000480002006362632873657270656e742900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008d001400686d61632873686132353629"], 0x1e4}}, 0x0) 14.595585733s ago: executing program 2 (id=1579): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty, 0x40}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}, 0x401}], 0x1, 0x10020, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000100)={0x3, 0x2, 0x1}) syz_usb_connect$hid(0x5, 0x36, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x60442, 0x0) readv(r5, &(0x7f0000001800)=[{&(0x7f0000000400)=""/198, 0xc6}], 0x1) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x58, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="cc000000", @ANYRES16=r7, @ANYBLOB="0100000000000000000017000000500006804c00040067636d286165732900000000000000000000000000000000000000000000000024000000"], 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x6c, r8, 0x1, 0x0, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x0) 13.652046876s ago: executing program 2 (id=1581): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x400}}, 0x14}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x31}, 0x20008888) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000040)={0x5c, 0xa, 0x0, "3258c546dacccfae1e008faa022c1e00f4bf40074000000200"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000080), 0x12) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0x80045500, &(0x7f0000000100)) io_uring_setup(0x89d, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7, 0x0, r3}) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = add_key(0x0, &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r4, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r4, 0xffffffffffffffff) fspick(r4, &(0x7f0000000140)='./file0\x00', 0x1) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="01000000070200000080000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r6}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r6, &(0x7f00000005c0), &(0x7f0000000680)=""/151}, 0x20) mkdirat$cgroup(r3, &(0x7f0000000000)='syz0\x00', 0x1ff) 13.601193792s ago: executing program 2 (id=1582): r0 = socket$inet6(0xa, 0x400000000001, 0x100) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e22, 0xfffffff9, @private0={0xfc, 0x0, '\x00', 0x1}, 0x4}, 0x1c) unshare(0x6020400) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x52, 0x80103) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f00000000c0)={0x65cabf8d}) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0xc2080) preadv(r3, 0x0, 0x0, 0x4, 0x3) r4 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac1(r4, 0x0, &(0x7f00000009c0)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="40000f000000012721dcfe14c639a500ba17162716"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) close(0x3) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r5, 0x5b14, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x300, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xd}, {}, {0xe, 0xfff1}}}, 0x24}}, 0x40004) r7 = add_key$keyring(&(0x7f00000004c0), &(0x7f0000000500)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$restrict_keyring(0x1d, r7, &(0x7f0000000540)='logon\x00', &(0x7f0000000580)='pimreg\x00') r8 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r8, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r9 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r9, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r8, 0xc02064b9, &(0x7f0000000300)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f00000002c0), 0x2, r10}) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r3, 0xc0106441, &(0x7f00000002c0)={0x0, 0x0, 0x4}) ioctl$DRM_IOCTL_PANTHOR_GROUP_CREATE(r2, 0xc0386447, &(0x7f0000000480)={{0x8, 0x2, &(0x7f0000000100)=[{0x0, 0x0, 0xd6f0}, {0xd, 0x0, 0x1}]}, 0x1c, 0x6d, 0x8, 0x0, 0x0, 0x4, 0x2, 0xd, r12}) ioctl$DRM_IOCTL_MODE_ATOMIC(r8, 0xc03864bc, &(0x7f0000000040)={0x500, 0x1, &(0x7f0000000180)=[r10], &(0x7f0000000180), &(0x7f0000000240)=[r11], &(0x7f00000001c0), 0x0, 0xff}) setsockopt$IP_VS_SO_SET_STARTDAEMON(r6, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'ip6gretap0\x00', 0x4}, 0x18) socket$inet_sctp(0x2, 0x0, 0x84) 13.232218087s ago: executing program 2 (id=1583): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000400)=[{0x28, 0x0, 0x0, 0xfffff024}, {0x6, 0x0, 0x0, 0x6}]}, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x10008095, 0x0, 0x0) 11.264929206s ago: executing program 4 (id=1586): socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x4c8, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080045bc04ba00544a7d784951002000e39ea6714259e202000000119078000000000000000000004e2004a6907802010001800000002b47019676fb912bfb3979bb82d94c42da0498ad601e4b92fe2c62ba4d6bdd44d280dada5a5650e1edaecb4fd923a6ded85d084df9d5e7bffddda34d04e5cdb51ef2fe8703b3988bb47989823d53b49308c5d2977c173d08535eaf56e740391766d74589e9806165ef3d4085755bbaa162e74e4dc541aa6004761f6a43e20556918bb04da9070b3cc89472820459902b3342031e1571d32a8b78f2da2a8e73e26af9389dced48cdcaf0a714363789e4acd9373813e2729986552c1cdbeabd3a03d7684ead62926c387b1552066f9751c9f0fa935afda36cf2fb30bba0cb8007f3bd1fea86ef3b7f8434e250f2a09e6a3b569c8c0519adc93f8b909470f39920551618ecfe04ff0cc4b1ed29eee56dcd976a79181e4d3218b51150ce595c25371293ec4d05e4aa411ef3b190554c6a2e06ee6374d80a3c511603a8a20b75f8075d0d83d31b86be7d2d785e6d60c07b515fe04bd55e20bcfe799a3e66c93744c52d0d34880ab42354859d5d1a9d0d65b52a0819b19c2d7f7a285d401825bf40ccc355b1aecb100c3f86c71607b00c59c7a8c0d8ae35a0a0e20f189568cb1a386c9d799f2c5ba6cce4e6ae0dce69f7391a4f4b011b27ad89ecaca95b90be9e517d39fa47ab5d08fd75233c1b0b604c169ebdc29efe713e9ecd551fc383be78cc5afccee1d8bb067e64054734b61c99f1055748b335ea261b9a6ccd1b3362a0c9d26c74bcda8e4d1efca7f614a61b8dfa2508a39f78901cf7ab2f15409f1da06432db0b50f00e16a77ceece0e315fc63c46cd418a1d259ba713bc5a26a49bdc202cf04e02149cf29c1f617f0898321ecf9d395f349e276480b42147d4dc1af6491e05cff9a33517437cb21125f6945e0b727576880a89ef6d53375bb901e14ae1a2dd27a5bf67012b8e4515023dba602d2e5293da914c199c0c0d610bf6461cd7bba6c8b948e96f395c39a7a0b93df65368f8eaa306fdcf87522ac1a36c427d98af77c3a3afa33dc3e8e070a1a2f66a4877abbeef23ff67befdcc9532cf3990918fb778d7799ee1f26b469c37f3c9578b8f8f2d00d32fc839171b9474e76f03d827a4eac2802322f3d68b03d1516aec9566bba3acc0bcf0d6a551c412f080d8c7fe0c60e23cdb328920263477470ea4f23e23d5aebbfda173aa781f89bf0cdfce2003ed3c010c511b3b489eab29453a365b839cca172e3abbcbab0203899bdb4f14a3423c2293166145760e61c3c188c3e0888ee817f0772ff89e02df8f42b9951e1661b39def34308c46e8ec1e4e5b68e88140ac7dc993523191fdb71db3a2677a3bd666e6180a96c9846bce6cb6c16e379bf29e1769a66da2f6781e79f082cb80662d72adbb21240cef87dc3079a822b2a791753fcd12a7ec362088d76237370bcd5d5daa440ba735b4e29cf2cb93583a5080270d1a3fd40183dc04f30e01c428f92e595c89fcbd1fc52962eedea82e2772b5f5fa3dad0f908fe6a48fffcc69df60f34ef9d9ba7609d16cdf733ca77785c0ab6f536b79ffde4ff9b835bfcaffef0d15ae69c26c0588f1acd5a648fde52568c713163717eb77f863d20dda0f1ca2c0306748544d3763c1cfa82f1785f047c842cadc4f8ac1906ab6ad8f6425bb9efbe97ee"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000300)) 9.397960261s ago: executing program 4 (id=1588): mremap(&(0x7f0000778000/0x3000)=nil, 0x3000, 0x600000, 0x0, &(0x7f0000a00000/0x600000)=nil) mknod$loop(0x0, 0x4000, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0x100001, 0x4) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f00000000c0)=0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r1, 0x5000aea5, &(0x7f0000000100)) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000000)=0xffffff7e, 0x4) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000200)=0x41) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r3 = socket$nl_audit(0x10, 0x3, 0x9) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c00bd35c25d01031b217000ffdbdf25020000000000000800000000"], 0x1c}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) ioctl$VHOST_VDPA_GET_DEVICE_ID(0xffffffffffffffff, 0x8004af70, &(0x7f0000000000)) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000180)={'vlan1\x00', {0x2, 0x4e22, @empty}}) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c100000000000244e0000", 0x58}], 0x1) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x7, 0x9) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha224)\x00'}, 0x58) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r10, 0x4048aecb, &(0x7f0000000180)={0x4, 0x0, [{0x0, 0x6, 0x0, 0x6}, {0x0, 0x6, 0x1}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x3, 0x80000001, 0x8}, {0x80000001, 0xffffffff, 0x7, 0x8, 0x5, 0x110, 0x3}]}) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) 8.436139977s ago: executing program 4 (id=1589): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f0000000280)={'syztnl0\x00', 0x0, 0x4, 0x5, 0x2, 0xa, 0x40, @rand_addr=' \x01\x00', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7, 0x7, 0x200, 0x2}}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, r0, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @ETHTOOL_A_LINKMODES_MASTER_SLAVE_CFG={0x5, 0x7, 0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x8449}, 0x20000040) syz_emit_ethernet(0x7a, &(0x7f00000000c0)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, 'r\r\x00', 0x44, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x2}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9900}, {}, {0x8, 0x88be, 0x3, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x0, 0x4, 0x14}, 0x1, {0x7b40}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0x42, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x80000003, 0xeb, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x4}}}}}}}, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000880)={{0x12, 0x1, 0x0, 0x3b, 0x83, 0x4e, 0x8, 0xc942, 0x2c0f, 0x4709, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0xbb, 0xe, 0x0, 0x8, 0x3, 0x1, 0x75}}]}}]}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x40100, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000180), r3) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000300)={{0x0, 0x2, 0xffffffff}}) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r6, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000100)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda501009bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r7, 0xc0303e03, &(0x7f00000001c0)={"0080bced01eb0100000000000000000700000000000000c900", r8, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r9, 0x40103e05, &(0x7f00000003c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r4, 0x80605414, &(0x7f0000000000)) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8002}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x400) 7.301067353s ago: executing program 3 (id=1591): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x2, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f0000000180)=ANY=[@ANYRES8=r0], 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) (async) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_enter(0xffffffffffffffff, 0x234c, 0xb1e6, 0x234f, 0x0, 0x0) (async) io_uring_enter(0xffffffffffffffff, 0x234c, 0xb1e6, 0x234f, 0x0, 0x0) r1 = io_uring_setup(0x1c6c, &(0x7f0000000040)={0x0, 0xaebb, 0xd000, 0x20000a, 0x20002f7}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x20800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS2(r3, 0x4068aea3, &(0x7f0000000080)={0xd5, 0x0, 0x7f}) (async) ioctl$KVM_CAP_DISABLE_QUIRKS2(r3, 0x4068aea3, &(0x7f0000000080)={0xd5, 0x0, 0x7f}) r4 = dup(r3) syz_kvm_setup_cpu$x86(r4, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(r4, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x42, 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@deltfilter={0x2c, 0x2d, 0x2, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff1}, {0xfff3, 0xffff}, {0x9, 0xffff}}, [@TCA_CHAIN={0x8, 0xb, 0x200}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x411cc0cd3ec7af8f) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) socket$inet_sctp(0x2, 0x1, 0x84) (async) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) (async) r6 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r6, 0x0, 0x0) syz_usb_control_io$printer(r6, 0x0, 0x0) (async) syz_usb_control_io$printer(r6, 0x0, 0x0) r7 = syz_open_dev$I2C(&(0x7f00000000c0), 0xc, 0x88000) read(r7, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8010, 0xffffffffffffffff, 0x40000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) madvise(&(0x7f000001b000/0x3000)=nil, 0x3000, 0x9) (async) madvise(&(0x7f000001b000/0x3000)=nil, 0x3000, 0x9) migrate_pages(0x0, 0x3, &(0x7f00000002c0)=0x2d, &(0x7f0000000280)=0xa) (async) migrate_pages(0x0, 0x3, &(0x7f00000002c0)=0x2d, &(0x7f0000000280)=0xa) 6.739775683s ago: executing program 4 (id=1592): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x400}}, 0x14}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x31}, 0x20008888) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000040)={0x5c, 0xa, 0x0, "3258c546dacccfae1e008faa022c1e00f4bf40074000000200"}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000080), 0x12) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0x80045500, &(0x7f0000000100)) io_uring_setup(0x89d, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7, 0x0, r3}) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = add_key(&(0x7f0000000000)='id_resolver\x00', 0x0, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r4, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r4, 0xffffffffffffffff) fspick(r4, &(0x7f0000000140)='./file0\x00', 0x1) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="01000000070200000080000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r6}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r6, &(0x7f00000005c0), &(0x7f0000000680)=""/151}, 0x20) mkdirat$cgroup(r3, &(0x7f0000000000)='syz0\x00', 0x1ff) 6.599119294s ago: executing program 4 (id=1593): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000840)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xfff3, 0xc}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x18, 0x2, [@TCA_CGROUP_EMATCHES={0x7, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x4}}, @TCA_EMATCH_TREE_HDR={0x8}]}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x40010) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1ff, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x13, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, &(0x7f0000000140)="f30f00550a0f0172000f08b9800000c00f3235008000000f30c4e245a8e666b83e000f00d80f22df360ffd39b9b50900000f320f78b808b39f6c", 0x3a}], 0x1, 0x9, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 6.324644063s ago: executing program 4 (id=1594): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a0108000000ffffff6a00010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d65746100000000140002800800014000000012080002400000002214000000110001"], 0xd8}}, 0x0) 4.188181712s ago: executing program 3 (id=1595): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0x18, &(0x7f0000000000)=0xfc2, 0x4) bind$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r2, 0x40085112, &(0x7f0000000040)=@e={0xff, 0xa, 0x7, 0x2, @generic=0x9, 0x10, 0x7, 0x1}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000080010000060a01040000000000000000010000000900020073797a310000000038000480340001800c00010062697477697365002400028008000340000000040800024000000000080006400000000008000140000000000900010073797a30000000005e000740"], 0x1f4}}, 0x400000000000000) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="600000001000ffff270faeae4a7db9db4cbd6ffa8c3641ef4b5f1378629c4c7fd346dd10f03efda289ce41dc206cd0c7d0a3a8fd99d5ae94bf0436686b3fb2b0cd94bcf36263d56789050e9cd3bf76c0de6273e9e954df4220d7cd15b12e", @ANYRES32=0x0, @ANYBLOB="137c030000000000400012800e0001006970366772657461700000002c000280140007000000000000000000fffffffffffffffe14000600fe880000000000000000000000000101"], 0x60}, 0x1, 0x0, 0x0, 0x41}, 0x20040000) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x42f40, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cgroups\x00', 0x0, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/ip6_mr_vif\x00') r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r8 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r6, &(0x7f0000000000)={0x2000}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000040)) close(r8) r9 = socket$inet6(0xa, 0xa, 0x80) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000740)={'syztnl2\x00', &(0x7f00000006c0)={'ip6gre0\x00', 0x0, 0x2f, 0x3, 0x6, 0x8, 0x11, @empty, @mcast2, 0x7800, 0x20, 0x5, 0x2}}) setsockopt$inet6_mreq(r9, 0x29, 0x15, &(0x7f0000000780)={@mcast2, r10}, 0x14) sendfile(r4, r5, 0x0, 0x20000023896) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, &(0x7f0000000680)={""/32, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) 2.122142589s ago: executing program 3 (id=1596): r0 = syz_open_dev$cec(&(0x7f0000000740), 0x0, 0x22000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/raw\x00') read$FUSE(r1, &(0x7f0000002140)={0x2020}, 0x2020) ioctl$CEC_ADAP_G_LOG_ADDRS(r0, 0x805c6103, &(0x7f0000000780)) 1.979878784s ago: executing program 3 (id=1597): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000080)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}, r1}}, 0x30) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 1.953197742s ago: executing program 3 (id=1598): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) r1 = memfd_create(&(0x7f0000000500)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\xee\xf6Oc8\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Ncp\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xe9fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\xdeQ/\xb8X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31W\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\x0e\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]\xd5\xbe\'U\xf17', 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)={0x78, r3, 0x813, 0x70bd23, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x64, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, "ba0a6e9cc64a0aa63ae2e0c4663a7200"}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "7876d6d3483689a0256b48dd0cfb450ec5e5cd794a17ff7b0d54b0a9ad2b3654154350f3"}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x20048044}, 0x20008000) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000140)={0x21c, r3, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK={0x94, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0x48, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x33}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x49fc}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x40}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x17c}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffb}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0xe8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9ba}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xba1b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xaff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1e876ff7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc5c7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x21c}, 0x1, 0x0, 0x0, 0x4000001}, 0x44084) syz_emit_ethernet(0x7e, &(0x7f0000000140)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4a300", 0x48, 0x3a, 0x1, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x6, {0xc, 0x6, "f6cd53", 0xffff, 0x3c, 0x1, @dev={0xfe, 0x80, '\x00', 0x35}, @local, [@dstopts={0x2f, 0x1, '\x00', [@enc_lim={0x4, 0x1, 0x7}, @jumbo={0xc2, 0x4, 0xe}]}]}}}}}}}, 0x0) dup(r1) r4 = syz_open_dev$evdev(&(0x7f000001fa80), 0x2, 0x48e000) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r4, @ANYBLOB="063bbbb64679b5"], 0x0) 1.243489147s ago: executing program 0 (id=1562): socket$kcm(0x29, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x2, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000003e40), 0xffffffffffffffff) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000004c0)="c13b5849063444584d7eab81ce851c3f2ffc95c04a422acdee9681a3bc0ce180449f9ba8835365b3bb417fdad417db9e31abdc405722eeb9f21e7ef1fdefa6cda3f3c262d95960054153a580254cceda321179de8455147d5f3e4db2e4eca6ac3d4486ef3a156283a2d23281c0b933cfb2f79e322c99f6fdc1f9204a28143bae197d19c589bd2a16b61c701a8707aeb8deb9f1f9853cf1c0233b2fb52cf1891d4a4ff0a25035762d2bdf701ceb894dfc8e47d9616d4ca1ee6ce6141e3def72fcf1fa9bc39f2c6d323d550839f10e396336ef502b281636d47ccf84d062900309609b8e5bcd9b3af22bdbf066d0160e052a7eec57f8eec3d36136abd51759bc559932b572ec3c98ae30ebbd31195579ad42c6b2aceee9530ee976a82ed0cefd5ff05029f38673fb89724ffd8e0a2fb6a5abb9ba57cd09db66e672b81f88a19248564e6197c30335f0dcf4c506862a668261496ff69779e8212ac5f91eeca8e0c274c6bb562c5d3b648e027aa91cedce953573c7c035165781935455f850efdc9a42c24bcba7ee422a61e05f53d67cea8d46cf857d9c1ea80d33dab5d3f993f1d85a9e2f01f8ff5214c52ae0daccd2b367799c850c5deb387a5463c96c04409c624c46ca78fbac01b42a8ca2f602d1e27901704c24f84b22ee1ea37ec70592f934963f8e1fabb4ccc3fcfa1ffea3fe9fb4217cd010a4ae4292147745129a2eab624f7ee3111794c4cdb0b4198efdd077f08bbcdfa3ba25af557c2c1f1979aaa8d1664e4077c496144daebcefa8d6ebaa3167b1cadb9d9aa1f7c14a9564da1d7f4cdaae59982f21591cb5394c5d99783ba4a4463988461a76", 0x257}], 0x1, 0x0, 0x0, 0x8000}, 0x0) r0 = memfd_secret(0x0) futimesat(r0, 0x0, 0x0) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="6400000002060108000000000000000005000003050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e65740000000014000780080006400000020008000840"], 0x64}, 0x1, 0x0, 0x0, 0x90}, 0x40c0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001640)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000003c0)='ns/uts\x00') madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 420.403961ms ago: executing program 3 (id=1599): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) remap_file_pages(&(0x7f00005f4000/0x3000)=nil, 0xa00, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002780)=ANY=[@ANYBLOB="640000000206010800000000000000000100000a16000300686173683a6e65742c706f72742c6e6574000000050001000700000005000500020000000900020073797a310000000005000400000000001400078008000840000000f108000640"], 0x64}, 0x1, 0x0, 0x0, 0x2006c0c4}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005c40)=[{{0x0, 0x0, &(0x7f0000002880)=[{&(0x7f0000000440)="4b817ec69726bbf402343f8812035e72d85c7ebb54c7d36184592d6371955d17dbc620a121fd94ca2942b1828b4fbd07c265b128a50f87890bb39d4669c93868a54c32ccaa8f5dfb4c338bcc69280af9e67c7f35b28fc464d9b29482d11041b224dc28c4457663003b3e2fbaa82974dbb443c387d2fe0efcb24ac27ab9c2fbb6b131bf008b9f555099e5d32267b7cfd9ca94e4415c2a1dd0b2593eaf0bca37189ace6436c1e7d087660bd128cd07382bc4bbebae10a97cf63b915f810e3e2658f7d7256d81a1cb94a020a9d519096f2068c300cca6d804555c643267a7c9a27a1d49bb463b176700e2c32c13400b86dc9f91b6811d03fd621fe61791ae8ca1d9bcd31ce1e014c7714b5ec6aa507a08e1e2cac3d61be8d5018daae401563fb391f1809a50c06cd2bbefe45fd253282499b752fbdc4228c8509d7ae5e764c7e21e404ba71c48aeb68fcb7fcd5b052b2a765e36383ac01c530d9ccdc00dcea60219be3b5b67ec9890966fe751f017d2d49bd376bc8f2ede9633c4de8c289e4934e6f4f709c78e73c824fdbc7c50b352e4a6ed048f37a320c71f788dcf422185e5d25eee40a8346239ab25bc364969ac96f04d32a405b7db6957400e49f9937ebfc0309a00630df1f573ece697ca0f5135d7c6846fad268b815a6e550df780989dcb9e9fad92681cf175088b0c3b0f0ce987a3c48ef7a74b4065078901d4b9490f8068acb314aeb825cccbc92ce3bfb14f9d0bdfa03f493cad50831e597c21da60ef3e8b5e98738c29a8e925a4101e9f62d0c68495f6a45071ea74e8de1cb74131503140397f434a9aa9ac4095f5e491445d68cf044b9d6fb9a50af68832bb9dc675f7ddfcd0607b115642db55d2102d18da763df6b02ebffa14ef9d4bc28674e9af61f317de8cc3a8bf76766018785b50f64ba620aed716fcd4d79a03e619ebba89f31fd039c7011c13520359386b2c7ecc4fde24f337f8c7135dba3f0859aa5fbbcd75f6ea7b1adba49570c8f122085a7304f321d2621beea7beaf60508c0a08e7088584fb4c7bdb1b40417874af5072675f82e00abc86eda4ce463b17064624845607fb50df77d3a670d9b1cfdbf274d43b535bc4bd2aae615e2b4b3a22e5094675304d22e114d14e712df4738590fbc9b33f58057077e2860d1c8c4cdac11a801981cad00e0b5153ada0fb1e273d1ed1e2e7c1568240acba90c3d24482856a003084b0e46064e10403d1a1d9acc37ea840bab318b8367d9e0026dcac12c4bf0a5a108eb71c017ae9f94e6f9eebab0da1025ccf5906551346395b5dc4df5a799041f3c2695c8da5c853a5f60811446119c02b5a90561a0fb9e1121128df6d453d07ab45108cc88f36faafaa56da2d4532318a0525c9114ea0822299663b56ee4e6b0dbbb0462a3feb643a0013a270b1f5eb98bd281b139a53a80f849af99423d156a02a156df63112600590a4c49d3772b7fb0cb32b48cf14b5bad2444d9ab2a56e3bb768b5b39e9b47f5f55a8c58bdcfcae5dd73ad626f3fa47e24750c225b9a6861d1c02162edeb1119589c58c449bd45a879721c4e7058dcaf75b56837bd867e95fc700fa80d7884bda691f5d12375e0d1c3fa210db564235c4ec3b40db3bd349e5326a4e2df66c3a537fb4c7595868ef00632078deceed2d76b26df1cfc3ee23bdc13a3a1ffbf86cf51425524b7e260453e5fd81532b0bfdcd8b1a5d8b959f7bdfcba0c6771519437e52255f748bb7bfd5b74cf86dc7ed3457131cac4dda726486892e872d1c416e33a11c18b4d3af58bbc92c642ff178668211aff5df9a515bbd184293827ed570248efc6776073af7a93620e34098fcc9f0de94f245805e7ade588cd07ec64847dabf54da70eb698900e1984a45b5d4ba8468265953fc5554fe029ef887eaf811df3d3c57e8abb1d496b8e460e06bc314c305fe37d49a0c541f858eaeff5e1318d7e50a7dd0cf9dad959b99bbd096ba3cff8c976fe1799a62ef3a40ff25c", 0x587}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x4c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x64e98, 0x16ac1}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x14, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_TO_UCAST={0x5}, @IFLA_BRPORT_MCAST_FLOOD={0x5, 0x1b, 0x1}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x3, &(0x7f0000000180)=[{0x5, 0x30, 0x9, 0x5}, {0x8000, 0x10, 0xda, 0x1ac85c82}, {0x6, 0x5, 0x1, 0x2}]}) sendmmsg$inet6(r2, &(0x7f0000000480)=[{{&(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000300)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000009c0)=ANY=[], 0x1000f) syz_usb_connect(0x2, 0x3f, &(0x7f0000000340)=ANY=[@ANYBLOB="120110012cae9308da040d39dffa0102030109022d0001c94080010904f90403c0da26ff0905f10f40000300bf09050300ff030507200905821010"], 0x0) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000a00), 0x2, 0x0) ioctl$UI_END_FF_ERASE(r6, 0x400c55cb, &(0x7f0000000a40)={0x3, 0x0, 0x3}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) r7 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="5300000060cb09c7592cb43f664755c1449fe40e166c98729e6b7eaa40947bb87b3f38794db062e5df95dd89f19c2881380ca9040ad87c50aa7b18c42bc9a035583ae953ad0edec454494382efa0b3894fa4c2ed46ab0823478ae0b31953a6fd084f327780c9523f1d828539d746564aeb46317f94595ea84434fab6ac0ca79d6a9597e56077944ecfe831d4e29313778f3770135cc9c6a5d4243cac6e76e2ca5549e0ddcbc365a61734483d59424262da99613a7dc1c0f3536d51d4a3e7753087ea1bede6", @ANYRES16=r8, @ANYBLOB="000427bd7000fedbdf25070000000500130000000000050021000000000008000b00000000000500050001000000"], 0x34}, 0x1, 0x0, 0x0, 0x5}, 0x4) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r7, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) syz_open_dev$dri(&(0x7f0000000f00), 0x1, 0x0) socket(0x2, 0x80805, 0x0) close(0x3) socket(0x2, 0x80805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) 352.397783ms ago: executing program 0 (id=1600): socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x4c8, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080045bc04ba00544a7d784951002000e39ea6714259e202000000119078000000000000000000004e2004a6907802010001800000002b47019676fb912bfb3979bb82d94c42da0498ad601e4b92fe2c62ba4d6bdd44d280dada5a5650e1edaecb4fd923a6ded85d084df9d5e7bffddda34d04e5cdb51ef2fe8703b3988bb47989823d53b49308c5d2977c173d08535eaf56e740391766d74589e9806165ef3d4085755bbaa162e74e4dc541aa6004761f6a43e20556918bb04da9070b3cc89472820459902b3342031e1571d32a8b78f2da2a8e73e26af9389dced48cdcaf0a714363789e4acd9373813e2729986552c1cdbeabd3a03d7684ead62926c387b1552066f9751c9f0fa935afda36cf2fb30bba0cb8007f3bd1fea86ef3b7f8434e250f2a09e6a3b569c8c0519adc93f8b909470f39920551618ecfe04ff0cc4b1ed29eee56dcd976a79181e4d3218b51150ce595c25371293ec4d05e4aa411ef3b190554c6a2e06ee6374d80a3c511603a8a20b75f8075d0d83d31b86be7d2d785e6d60c07b515fe04bd55e20bcfe799a3e66c93744c52d0d34880ab42354859d5d1a9d0d65b52a0819b19c2d7f7a285d401825bf40ccc355b1aecb100c3f86c71607b00c59c7a8c0d8ae35a0a0e20f189568cb1a386c9d799f2c5ba6cce4e6ae0dce69f7391a4f4b011b27ad89ecaca95b90be9e517d39fa47ab5d08fd75233c1b0b604c169ebdc29efe713e9ecd551fc383be78cc5afccee1d8bb067e64054734b61c99f1055748b335ea261b9a6ccd1b3362a0c9d26c74bcda8e4d1efca7f614a61b8dfa2508a39f78901cf7ab2f15409f1da06432db0b50f00e16a77ceece0e315fc63c46cd418a1d259ba713bc5a26a49bdc202cf04e02149cf29c1f617f0898321ecf9d395f349e276480b42147d4dc1af6491e05cff9a33517437cb21125f6945e0b727576880a89ef6d53375bb901e14ae1a2dd27a5bf67012b8e4515023dba602d2e5293da914c199c0c0d610bf6461cd7bba6c8b948e96f395c39a7a0b93df65368f8eaa306fdcf87522ac1a36c427d98af77c3a3afa33dc3e8e070a1a2f66a4877abbeef23ff67befdcc9532cf3990918fb778d7799ee1f26b469c37f3c9578b8f8f2d00d32fc839171b9474e76f03d827a4eac2802322f3d68b03d1516aec9566bba3acc0bcf0d6a551c412f080d8c7fe0c60e23cdb328920263477470ea4f23e23d5aebbfda173aa781f89bf0cdfce2003ed3c010c511b3b489eab29453a365b839cca172e3abbcbab0203899bdb4f14a3423c2293166145760e61c3c188c3e0888ee817f0772ff89e02df8f42b9951e1661b39def34308c46e8ec1e4e5b68e88140ac7dc993523191fdb71db3a2677a3bd666e6180a96c9846bce6cb6c16e379bf29e1769a66da2f6781e79f082cb80662d72adbb21240cef87dc3079a822b2a791753fcd12a7ec362088d76237370bcd5d5daa440ba735b4e29cf2cb93583a5080270d1a3fd40183dc04f30e01c428f92e595c89fcbd1fc52962eedea82e2772b5f5fa3dad0f908fe6a48fffcc69df60f34ef9d9ba7609d16cdf733ca77785c0ab6f536b79ffde4ff9b835bfcaffef0d15ae69c26c0588f1acd5a648fde52568c713163717eb77f863d20dda0f1ca2c0306748544d3763c1cfa82f1785f047c842cadc4f8ac1906ab6ad8f6425bb9efbe97ee"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000300)={0x1, 0x0, [{0x0, 0x2, 0x3, 0x0, @sint={0xa, 0x101}}]}) 152.167502ms ago: executing program 0 (id=1601): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000002a80)={0x9, 0x0, [{0x230e9000, 0xfffffcd0, &(0x7f0000000040)=""/192}, {0xeeee8000, 0x1000, &(0x7f0000000780)=""/4096}, {0x0, 0xe5, &(0x7f0000001780)=""/229}, {0x54000, 0x1000, &(0x7f0000001880)=""/4096}, {0x8000000, 0x76, &(0x7f0000002880)=""/118}, {0x0, 0x75, &(0x7f0000002900)=""/117}, {0x60000, 0x3, &(0x7f0000002980)=""/3}, {0x0, 0xffffffffffffffb0, &(0x7f0000000300)=""/45}, {0x2, 0x75, &(0x7f0000002a00)=""/117}]}) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0xfe, 0x7fff0006}]}) (async) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa8203, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000080)={0x20004, r3, 0x2}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000440)={0x0, 0x0, r5}) (async) r6 = openat$panthor(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000200)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r6, 0xc01864c1, &(0x7f0000000280)={r7}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r5, 0xc01864c1, &(0x7f0000000180)={r7}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) (async) connect$inet6(r8, &(0x7f00000001c0)={0xa, 0x4e23, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0xc3f37cc}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000240)=0x2, 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r8, 0x11a, 0x2, &(0x7f0000000180)=@gcm_256={{0x304}, "32f058ec27d46898", "d40f86fd02541c95afec379bdb3cc0d5646e20975202603a18fe7474dc4c3d7b", '\"\vEX', "010000000100"}, 0x38) (async) ioctl$int_in(r8, 0x5452, &(0x7f0000000080)=0x8) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r8) (async) r9 = landlock_create_ruleset(&(0x7f0000000040)={0x1801a, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r9, 0xa) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01864c2, &(0x7f0000000100)={0x0}) (async) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r11) (async) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c4b20710200e0101"], 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r1, 0xc02064cc, &(0x7f00000001c0)={r7, r10, 0x80000000, 0x6, 0x5}) (async) r12 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x8943, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x1, r12}) 0s ago: executing program 0 (id=1602): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) ioctl$vim2m_VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000240)=@mmap={0x2b9776dc, 0x1, 0x4, 0x70000, 0x4, {0x77359400}, {0x1, 0xc, 0x2, 0x4, 0xfc, 0x4, "7365981f"}, 0xb24, 0x1, {}, 0x7}) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='westwood', 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1, 0xf, &(0x7f0000004280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x99f}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x57}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0xd4}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x6400}}}, &(0x7f0000004380)='GPL\x00', 0x5, 0x20, &(0x7f0000000000)=""/32, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) gettid() connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) kernel console output (not intermixed with test programs): [ 363.117995][ T46] usb 5-1: config 0 has an invalid interface number: 255 but max is 8 [ 363.123842][T11304] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 363.129866][ T46] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 363.152748][T11479] netlink: 'syz.2.1301': attribute type 10 has an invalid length. [ 363.155068][T11304] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 363.161988][ T46] usb 5-1: config 0 has no interface number 0 [ 363.175547][T11479] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1301'. [ 363.187024][ T46] usb 5-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 363.201304][ T46] usb 5-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 363.216142][T11304] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 363.220111][ T46] usb 5-1: config 0 interface 255 has no altsetting 0 [ 363.234623][ T46] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 363.244278][ T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 363.247146][T11304] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 363.261861][ T46] usb 5-1: Product: syz [ 363.266584][ T46] usb 5-1: Manufacturer: syz [ 363.279418][T11479] team0: Failed to send options change via netlink (err -105) [ 363.289497][ T46] usb 5-1: SerialNumber: syz [ 363.296207][T11479] team0: Port device geneve1 added [ 363.303068][ T46] usb 5-1: config 0 descriptor?? [ 363.347968][T11411] hsr_slave_0: entered promiscuous mode [ 363.354874][T11411] hsr_slave_1: entered promiscuous mode [ 363.425712][ T50] Bluetooth: hci1: command tx timeout [ 363.481907][T11167] veth0_macvtap: entered promiscuous mode [ 363.589199][T11167] veth1_macvtap: entered promiscuous mode [ 363.704341][ T46] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 363.724036][ T46] pctv452e: pctv452e_power_ctrl: 1 [ 363.724036][ T46] [ 363.744282][ T46] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 363.744282][ T46] [ 363.755790][ T46] dvb-usb: bulk message failed: -22 (5/0) [ 363.773511][ T46] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 363.800902][T11167] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 363.803204][ T46] dvb-usb: Technotrend TT Connect S2-3600 error while loading driver (-19) [ 363.815389][T11167] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 363.850010][ T46] usb 5-1: USB disconnect, device number 88 [ 363.932363][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 364.026816][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 364.056070][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 364.107932][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 364.262069][T11304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 364.407267][T11514] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 364.639657][ T8391] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 364.665523][T11304] 8021q: adding VLAN 0 to HW filter on device team0 [ 364.685897][ T8391] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 364.741704][ T6111] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.748928][ T6111] bridge0: port 1(bridge_slave_0) entered forwarding state [ 364.961626][ T35] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.088296][ T8391] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 365.098143][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.105340][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 365.137969][ T8391] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 365.340355][ T35] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.504906][ T50] Bluetooth: hci1: command tx timeout [ 365.552323][ T5635] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 365.571727][ T5635] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 365.601608][ T5635] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 365.616428][ T5635] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 365.617760][ T35] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.641212][ T5635] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 365.669473][ T5732] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 365.853427][ T5732] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 365.875609][ T5732] usb 1-1: config 0 has no interface number 0 [ 365.884231][ T5732] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 365.897611][ T5732] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.917390][ T5732] usb 1-1: Product: syz [ 365.921680][ T5732] usb 1-1: Manufacturer: syz [ 365.927799][ T5732] usb 1-1: SerialNumber: syz [ 365.941268][ T5732] usb 1-1: config 0 descriptor?? [ 366.011109][ T35] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 366.180833][ T5732] dvb_usb_ec168 1-1:0.1: probe with driver dvb_usb_ec168 failed with error -32 [ 366.196540][T11411] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 366.222332][T11411] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 366.247906][T11304] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 366.320262][T11411] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 366.340654][T11411] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 366.361633][T11411] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 366.376793][T11411] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 366.391842][T11411] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 366.420204][T11411] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 366.556686][ T35] bridge_slave_1: left allmulticast mode [ 366.563518][ T35] bridge_slave_1: left promiscuous mode [ 366.570079][ T35] bridge0: port 2(bridge_slave_1) entered disabled state [ 366.583814][ T35] bridge_slave_0: left allmulticast mode [ 366.591070][ T35] bridge_slave_0: left promiscuous mode [ 366.598944][ T35] bridge0: port 1(bridge_slave_0) entered disabled state [ 366.839694][ T35] team0: Port device geneve1 removed [ 366.875171][ T35] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 366.888618][ T35] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 366.908710][ T35] bond0 (unregistering): Released all slaves [ 367.240120][T11304] veth0_vlan: entered promiscuous mode [ 367.452807][ T35] hsr_slave_0: left promiscuous mode [ 367.480878][ T35] hsr_slave_1: left promiscuous mode [ 367.494092][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 367.518089][ T35] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 367.538868][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 367.548487][ T35] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 367.570415][ T35] veth1_macvtap: left promiscuous mode [ 367.577509][ T35] veth0_macvtap: left promiscuous mode [ 367.583173][ T35] veth1_vlan: left promiscuous mode [ 367.588530][ T5635] Bluetooth: hci1: command tx timeout [ 367.590576][ T35] veth0_vlan: left promiscuous mode [ 367.745683][ T5635] Bluetooth: hci2: command tx timeout [ 367.929454][T11576] block device autoloading is deprecated and will be removed. [ 368.046722][ T35] team0 (unregistering): Port device team_slave_1 removed [ 368.092287][ T35] team0 (unregistering): Port device team_slave_0 removed [ 368.287802][T11304] veth1_vlan: entered promiscuous mode [ 368.308275][ T5292] 8021q: adding VLAN 0 to HW filter on device eth1 [ 368.387706][ T5732] usb 1-1: USB disconnect, device number 79 [ 368.558176][T11594] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1315'. [ 368.612149][T11540] bridge0: port 1(bridge_slave_0) entered blocking state [ 368.624657][T11540] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.654965][T11540] bridge_slave_0: entered allmulticast mode [ 368.666149][T11540] bridge_slave_0: entered promiscuous mode [ 368.692876][T11540] bridge0: port 2(bridge_slave_1) entered blocking state [ 368.707253][T11540] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.722711][T11540] bridge_slave_1: entered allmulticast mode [ 368.739427][T11540] bridge_slave_1: entered promiscuous mode [ 368.839768][T11540] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 368.869840][T11304] veth0_macvtap: entered promiscuous mode [ 368.887829][T11540] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 368.904510][T11304] veth1_macvtap: entered promiscuous mode [ 368.982550][T11411] 8021q: adding VLAN 0 to HW filter on device bond0 [ 369.000041][T11540] team0: Port device team_slave_0 added [ 369.030548][T11540] team0: Port device team_slave_1 added [ 369.094184][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 369.112548][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 369.122999][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 369.132148][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 369.140123][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 369.166298][T11304] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 369.199382][T11304] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 369.209934][T11411] 8021q: adding VLAN 0 to HW filter on device team0 [ 369.227469][T11540] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 369.254963][T11540] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 369.283040][T11540] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 369.319706][T11540] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 369.339188][T11540] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 369.389578][T11540] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 369.429410][ T8391] bridge0: port 1(bridge_slave_0) entered blocking state [ 369.436636][ T8391] bridge0: port 1(bridge_slave_0) entered forwarding state [ 369.446876][ T6111] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.457774][ T6111] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.600674][ T35] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.679634][ T6111] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.691168][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 369.698407][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 369.721791][ T5292] 8021q: adding VLAN 0 to HW filter on device eth2 [ 369.760922][ T6111] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.831361][ T50] Bluetooth: hci2: command tx timeout [ 369.840042][ T35] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.963537][T11540] hsr_slave_0: entered promiscuous mode [ 369.974420][T11540] hsr_slave_1: entered promiscuous mode [ 369.982150][T11540] debugfs: 'hsr0' already exists in 'hsr' [ 369.994767][T11540] Cannot create hsr debugfs directory [ 370.088437][ T35] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.450128][ T35] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.602576][ T6111] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.639984][ T6111] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 370.877678][ T5292] 8021q: adding VLAN 0 to HW filter on device eth3 [ 370.888925][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 370.898987][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.006189][ T995] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 371.086199][T11411] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 371.098335][T11644] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1282'. [ 371.161577][ T35] bridge_slave_1: left allmulticast mode [ 371.169051][ T35] bridge_slave_1: left promiscuous mode [ 371.175091][ T35] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.185634][ T50] Bluetooth: hci0: command tx timeout [ 371.194938][ T35] bridge_slave_0: left allmulticast mode [ 371.200608][ T35] bridge_slave_0: left promiscuous mode [ 371.208148][ T35] bridge0: port 1(bridge_slave_0) entered disabled state [ 371.216159][ T995] usb 1-1: config index 0 descriptor too short (expected 45, got 36) [ 371.224339][ T995] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 371.235657][ T995] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 371.247339][ T995] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 371.260309][ T995] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 371.269904][ T995] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.282093][ T995] usb 1-1: config 0 descriptor?? [ 371.374860][ T46] usb 4-1: new low-speed USB device number 69 using dummy_hcd [ 371.493403][ T35] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 371.505430][ T35] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 371.515793][ T35] bond0 (unregistering): Released all slaves [ 371.528587][ T46] usb 4-1: unable to get BOS descriptor or descriptor too short [ 371.538960][ T46] usb 4-1: config 6 has an invalid interface number: 40 but max is 1 [ 371.549155][ T46] usb 4-1: config 6 has no interface number 1 [ 371.561704][ T46] usb 4-1: config 6 interface 0 has no altsetting 0 [ 371.568569][ T46] usb 4-1: config 6 interface 40 has no altsetting 0 [ 371.579082][ T46] usb 4-1: string descriptor 0 read error: -22 [ 371.585641][ T46] usb 4-1: New USB device found, idVendor=1199, idProduct=9003, bcdDevice=e8.30 [ 371.610928][ T46] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.652098][ T46] rndis_host 4-1:6.40: bogus CDC Union [ 371.709909][T11640] binder: 11639:11640 ioctl c00c6211 0 returned -14 [ 371.835464][T11646] netlink: 186380 bytes leftover after parsing attributes in process `syz.3.1282'. [ 371.868348][ T46] usb 4-1: USB disconnect, device number 69 [ 371.917568][ T50] Bluetooth: hci2: command tx timeout [ 372.053463][T11604] bridge0: port 1(bridge_slave_0) entered blocking state [ 372.073620][T11604] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.108804][T11604] bridge_slave_0: entered allmulticast mode [ 372.126682][T11604] bridge_slave_0: entered promiscuous mode [ 372.158757][T11604] bridge0: port 2(bridge_slave_1) entered blocking state [ 372.174871][T11604] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.195035][T11604] bridge_slave_1: entered allmulticast mode [ 372.202974][T11604] bridge_slave_1: entered promiscuous mode [ 372.242943][ T35] hsr_slave_0: left promiscuous mode [ 372.252918][ T35] hsr_slave_1: left promiscuous mode [ 372.259778][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 372.271504][ T35] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 372.279882][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 372.287747][ T35] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 372.305051][ T35] veth1_macvtap: left promiscuous mode [ 372.310695][ T35] veth0_macvtap: left promiscuous mode [ 372.316737][ T35] veth1_vlan: left promiscuous mode [ 372.322146][ T35] veth0_vlan: left promiscuous mode [ 372.658708][ T35] team0 (unregistering): Port device team_slave_1 removed [ 372.689204][ T35] team0 (unregistering): Port device team_slave_0 removed [ 372.745217][ T995] usbhid 1-1:0.0: can't add hid device: -71 [ 372.752418][ T995] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 372.789681][ T995] usb 1-1: USB disconnect, device number 80 [ 373.013126][ T5292] 8021q: adding VLAN 0 to HW filter on device eth4 [ 373.105446][T11604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 373.142732][T11604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 373.196394][T11411] veth0_vlan: entered promiscuous mode [ 373.264861][ T50] Bluetooth: hci0: command tx timeout [ 373.308217][T11604] team0: Port device team_slave_0 added [ 373.322291][T11604] team0: Port device team_slave_1 added [ 373.484400][T11411] veth1_vlan: entered promiscuous mode [ 373.537028][T11540] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 373.560322][T11540] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 373.575188][T11604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 373.585984][T11604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 373.614842][T11604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 373.671491][T11540] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 373.714497][T11540] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 373.739792][T11604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 373.768778][T11604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 373.811549][T11604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 373.833703][T11540] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 373.847527][T11540] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 373.872688][T11540] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 373.885204][ T5731] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 373.894013][T11540] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 373.984821][ T50] Bluetooth: hci2: command tx timeout [ 374.000844][T11604] hsr_slave_0: entered promiscuous mode [ 374.008236][T11604] hsr_slave_1: entered promiscuous mode [ 374.014630][T11604] debugfs: 'hsr0' already exists in 'hsr' [ 374.021383][T11604] Cannot create hsr debugfs directory [ 374.067377][ T5731] usb 4-1: Using ep0 maxpacket: 32 [ 374.081413][ T5731] usb 4-1: config 0 has an invalid descriptor of length 187, skipping remainder of the config [ 374.086201][T11411] veth0_macvtap: entered promiscuous mode [ 374.097230][ T5731] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 374.109625][ T5731] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.126830][ T5731] usb 4-1: Product: syz [ 374.134737][ T5731] usb 4-1: Manufacturer: syz [ 374.145594][ T5731] usb 4-1: SerialNumber: syz [ 374.170146][ T5731] usb 4-1: config 0 descriptor?? [ 374.189715][ T5731] cdc_ether 4-1:0.0: missing cdc header descriptor [ 374.202169][ T5731] usb 4-1: unsupported MDLM descriptors [ 374.207552][T11411] veth1_macvtap: entered promiscuous mode [ 374.249101][ T5292] 8021q: adding VLAN 0 to HW filter on device eth5 [ 374.333570][T11411] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 374.402040][T11685] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.415841][T11685] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.442405][T11411] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 374.518417][ T6111] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.529376][ T6111] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.588041][ T6111] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.606271][ T6111] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 374.853073][T11540] 8021q: adding VLAN 0 to HW filter on device bond0 [ 375.069196][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 375.073769][T11540] 8021q: adding VLAN 0 to HW filter on device team0 [ 375.095344][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 375.113068][ T8391] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.120289][ T8391] bridge0: port 1(bridge_slave_0) entered forwarding state [ 375.134581][ T8391] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.141807][ T8391] bridge0: port 2(bridge_slave_1) entered forwarding state [ 375.284057][ T8391] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 375.292506][ T8391] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 375.350046][ T50] Bluetooth: hci0: command tx timeout [ 375.632561][ T9] usb 4-1: USB disconnect, device number 70 [ 375.842088][T11540] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 376.033312][T11747] xt_connbytes: Forcing CT accounting to be enabled [ 376.085085][T11747] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 376.144512][T11604] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 376.170213][T11604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 376.193074][T11604] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 376.242176][T11604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 376.286933][T11604] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 376.314615][T11604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 376.368048][T11604] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 376.408578][T11604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 376.508018][T11540] veth0_vlan: entered promiscuous mode [ 376.689286][T11540] veth1_vlan: entered promiscuous mode [ 376.876575][T11540] veth0_macvtap: entered promiscuous mode [ 376.917998][T11540] veth1_macvtap: entered promiscuous mode [ 377.002663][T11540] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 377.063193][T11604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 377.095798][T11540] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 377.131559][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.166891][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.188883][ T57] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.256198][ T6111] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.334159][T11604] 8021q: adding VLAN 0 to HW filter on device team0 [ 377.426600][ T50] Bluetooth: hci0: command tx timeout [ 377.469769][ T6111] bridge0: port 1(bridge_slave_0) entered blocking state [ 377.476973][ T6111] bridge0: port 1(bridge_slave_0) entered forwarding state [ 377.527540][ T6111] bridge0: port 2(bridge_slave_1) entered blocking state [ 377.534787][ T6111] bridge0: port 2(bridge_slave_1) entered forwarding state [ 377.659350][ T8391] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 377.675537][ T8391] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 377.737921][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 377.764418][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 377.844075][T11604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 377.997613][T11604] veth0_vlan: entered promiscuous mode [ 378.013054][T11795] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1337'. [ 378.206666][T11799] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1338'. [ 378.216039][ T995] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 378.249875][T11604] veth1_vlan: entered promiscuous mode [ 378.335459][T11799] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1338'. [ 378.396898][ T995] usb 3-1: device descriptor read/64, error -71 [ 378.435631][T11799] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1338'. [ 378.469539][T11799] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1338'. [ 378.554036][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.564249][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.611169][T11604] veth0_macvtap: entered promiscuous mode [ 378.644773][ T995] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 378.685824][T11604] veth1_macvtap: entered promiscuous mode [ 378.737981][T11604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 378.805356][ T995] usb 3-1: device descriptor read/64, error -71 [ 378.807059][T11604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 378.824453][ T8956] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 378.878344][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.901677][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.930303][ T995] usb usb3-port1: attempt power cycle [ 378.942010][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.969368][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.986054][ T8956] usb 6-1: Using ep0 maxpacket: 32 [ 378.999594][T11831] FAULT_INJECTION: forcing a failure. [ 378.999594][T11831] name failslab, interval 1, probability 0, space 0, times 0 [ 379.022966][ T8956] usb 6-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 379.046938][ T8956] usb 6-1: config 0 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 379.061758][T11831] CPU: 1 UID: 0 PID: 11831 Comm: syz.3.1345 Tainted: G L syzkaller #0 PREEMPT(full) [ 379.061783][T11831] Tainted: [L]=SOFTLOCKUP [ 379.061789][T11831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 379.061806][T11831] Call Trace: [ 379.061812][T11831] [ 379.061821][T11831] dump_stack_lvl+0xe8/0x150 [ 379.061844][T11831] should_fail_ex+0x412/0x560 [ 379.061866][T11831] should_failslab+0xa8/0x100 [ 379.061881][T11831] __kmalloc_noprof+0xe8/0x760 [ 379.061900][T11831] ? copy_splice_read+0x16f/0xaa0 [ 379.061921][T11831] copy_splice_read+0x16f/0xaa0 [ 379.061947][T11831] ? __pfx_copy_splice_read+0x10/0x10 [ 379.061967][T11831] ? look_up_lock_class+0x57/0x110 [ 379.061984][T11831] ? register_lock_class+0x31/0x2e0 [ 379.062002][T11831] ? file_end_write+0xd8/0x250 [ 379.062019][T11831] ? direct_splice_actor+0x10c/0x160 [ 379.062036][T11831] ? __pfx_shmem_file_splice_read+0x10/0x10 [ 379.062054][T11831] splice_direct_to_actor+0x4a0/0xc70 [ 379.062080][T11831] ? __pfx_direct_splice_actor+0x10/0x10 [ 379.062104][T11831] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 379.062138][T11831] do_splice_direct+0x195/0x290 [ 379.062158][T11831] ? __pfx_do_splice_direct+0x10/0x10 [ 379.062177][T11831] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 379.062193][T11831] ? bpf_lsm_file_permission+0x9/0x20 [ 379.062212][T11831] ? security_file_permission+0x75/0x260 [ 379.062234][T11831] ? rw_verify_area+0x255/0x4d0 [ 379.062255][T11831] do_sendfile+0x535/0x7d0 [ 379.062270][T11831] ? __pfx_vfs_write+0x10/0x10 [ 379.062292][T11831] ? __pfx_do_sendfile+0x10/0x10 [ 379.062307][T11831] ? __fget_files+0x3a0/0x420 [ 379.062329][T11831] __se_sys_sendfile64+0x144/0x1a0 [ 379.062345][T11831] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 379.062365][T11831] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.062381][T11831] do_syscall_64+0x174/0x580 [ 379.062395][T11831] ? trace_irq_disable+0x3b/0x140 [ 379.062415][T11831] ? clear_bhb_loop+0x40/0x90 [ 379.062433][T11831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.062448][T11831] RIP: 0033:0x7f12e459ce59 [ 379.062462][T11831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.062475][T11831] RSP: 002b:00007f12e54dd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 379.062490][T11831] RAX: ffffffffffffffda RBX: 00007f12e4815fa0 RCX: 00007f12e459ce59 [ 379.062500][T11831] RDX: 0000000000000000 RSI: 0000000000000010 RDI: 0000000000000011 [ 379.062509][T11831] RBP: 00007f12e54dd090 R08: 0000000000000000 R09: 0000000000000000 [ 379.062517][T11831] R10: 0000000100000002 R11: 0000000000000246 R12: 0000000000000002 [ 379.062525][T11831] R13: 00007f12e4816038 R14: 00007f12e4815fa0 R15: 00007f12e493fa48 [ 379.062549][T11831] [ 379.063817][ T8956] usb 6-1: config 0 interface 0 has no altsetting 0 [ 379.316419][ T995] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 379.319941][ T8956] usb 6-1: New USB device found, idVendor=0403, idProduct=97c1, bcdDevice= 0.00 [ 379.416205][ T995] usb 3-1: device descriptor read/8, error -71 [ 379.430325][ T8956] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 379.475956][ T8956] usb 6-1: config 0 descriptor?? [ 379.481750][ T8391] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.495779][ T8391] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.503428][ T8956] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 379.573598][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.582045][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.695341][ T995] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 379.727608][ T995] usb 3-1: device descriptor read/8, error -71 [ 379.794846][ T8956] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 379.855509][ T995] usb usb3-port1: unable to enumerate USB device [ 379.948432][ T8956] usb 4-1: unable to get BOS descriptor or descriptor too short [ 379.965477][ T8956] usb 4-1: not running at top speed; connect to a high speed hub [ 379.975360][ T8956] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 379.994773][ T8956] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 191, setting to 64 [ 380.014853][ T8956] usb 4-1: config 1 interface 0 has no altsetting 0 [ 380.027504][ T8956] usb 4-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.40 [ 380.036990][ T8956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.054780][ T8956] usb 4-1: Product: syz [ 380.060743][ T8956] usb 4-1: Manufacturer: syz [ 380.074188][ T8956] usb 4-1: SerialNumber: syz [ 380.090392][T11840] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 380.351599][ T8956] usbtouchscreen 4-1:1.0: probe with driver usbtouchscreen failed with error -71 [ 380.391843][ T8956] usb 4-1: USB disconnect, device number 71 [ 380.799631][T11867] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1353'. [ 380.952194][T11872] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1354'. [ 381.374759][ T46] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 381.414753][ T995] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 381.576749][ T995] usb 3-1: unable to get BOS descriptor or descriptor too short [ 381.590682][ T995] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 381.618348][ T995] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 381.632531][ T995] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 381.662828][ T995] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.708635][ T995] usb 3-1: Product: syz [ 381.712959][ T995] usb 3-1: Manufacturer: syz [ 381.719266][ T995] usb 3-1: SerialNumber: syz [ 381.782799][ T995] usb 3-1: selecting invalid altsetting 1 [ 381.797970][ T995] usb 3-1: unit 6 not found! [ 381.838968][ T5765] usb 6-1: USB disconnect, device number 44 [ 382.307664][T11885] bond0: (slave bond_slave_1): Releasing backup interface [ 382.624974][ T5765] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 382.796703][ T5765] usb 6-1: config 2 has an invalid interface number: 228 but max is 0 [ 382.806135][ T5765] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 382.819238][ T5765] usb 6-1: config 2 has no interface number 0 [ 382.822996][ T5731] usb 5-1: new full-speed USB device number 89 using dummy_hcd [ 382.832945][ T5765] usb 6-1: config 2 interface 228 altsetting 177 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 382.850119][ T5765] usb 6-1: config 2 interface 228 has no altsetting 0 [ 382.894216][ T5765] usb 6-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 382.906273][ T5765] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.916634][ T5765] usb 6-1: Product: syz [ 382.922075][ T5765] usb 6-1: Manufacturer: syz [ 382.928489][ T5765] usb 6-1: SerialNumber: syz [ 383.019288][ T5731] usb 5-1: device descriptor read/64, error -71 [ 383.279705][T11888] syzkaller0: entered promiscuous mode [ 383.292416][T11888] syzkaller0: entered allmulticast mode [ 383.340272][ T5731] usb 5-1: new full-speed USB device number 90 using dummy_hcd [ 383.564498][ T5765] ims_pcu 6-1:2.228: probe with driver ims_pcu failed with error -22 [ 383.578826][ T5731] usb 5-1: device descriptor read/64, error -71 [ 383.593298][ T5765] usb 6-1: USB disconnect, device number 45 [ 383.697269][ T5731] usb usb5-port1: attempt power cycle [ 384.072104][ T5731] usb 5-1: new full-speed USB device number 91 using dummy_hcd [ 384.144958][ T5731] usb 5-1: device descriptor read/8, error -71 [ 384.385192][ T5731] usb 5-1: new full-speed USB device number 92 using dummy_hcd [ 384.405735][ T5731] usb 5-1: device descriptor read/8, error -71 [ 384.515280][ T5731] usb usb5-port1: unable to enumerate USB device [ 384.604834][ T5765] usb 6-1: new full-speed USB device number 46 using dummy_hcd [ 384.771057][ T5765] usb 6-1: unable to get BOS descriptor or descriptor too short [ 384.788151][ T5765] usb 6-1: not running at top speed; connect to a high speed hub [ 384.804163][ T5765] usb 6-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 384.822982][ T5765] usb 6-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 191, setting to 64 [ 384.841729][ T5765] usb 6-1: config 1 interface 0 has no altsetting 0 [ 384.862339][ T5765] usb 6-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.40 [ 384.872782][ T5765] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.888052][ T5765] usb 6-1: Product: syz [ 384.892374][ T5765] usb 6-1: Manufacturer: syz [ 384.897608][ T5765] usb 6-1: SerialNumber: syz [ 384.922727][T11899] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 385.344112][ T5765] usbtouchscreen 6-1:1.0: probe with driver usbtouchscreen failed with error -71 [ 385.381173][ T5765] usb 6-1: USB disconnect, device number 46 [ 385.774807][ T46] usb 4-1: new full-speed USB device number 73 using dummy_hcd [ 385.946955][ T46] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 385.982995][ T46] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 386.012338][ T46] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 386.038501][ T46] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.081149][ T46] hub 4-1:4.0: USB hub found [ 386.122457][T11923] tipc: Started in network mode [ 386.132811][T11923] tipc: Node identity 7f000001, cluster identity 4711 [ 386.158706][T11923] tipc: Enabled bearer , priority 10 [ 386.171938][T11925] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1371'. [ 386.198972][T11923] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1372'. [ 386.215461][T11925] fuse: Unknown parameter '184467440737095516150x0000000000000003' [ 386.232798][T11923] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 386.284625][T11910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 386.291700][T11923] tipc: Enabled bearer , priority 10 [ 386.301752][ T46] hub 4-1:4.0: 2 ports detected [ 386.321990][ T46] usb 4-1: selecting invalid altsetting 1 [ 386.328604][T11910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 386.344966][ T46] hub 4-1:4.0: Using single TT (err -22) [ 386.345972][T11910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 386.373032][T11910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 386.400912][T11910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 386.424055][T11910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 386.443432][T11910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 386.464380][T11910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 386.489697][T11910] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 386.509169][T11910] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 386.519701][ T46] hub 4-1:4.0: hub_hub_status failed (err = -32) [ 386.543471][ T46] hub 4-1:4.0: config failed, can't get hub status (err -32) [ 386.567342][T11874] Set syz1 is full, maxelem 65536 reached [ 386.616179][ T995] usb 3-1: 2:0: failed to get current value for ch 0 (-71) [ 386.744113][ T995] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 386.771844][ T995] usb 3-1: USB disconnect, device number 79 [ 386.806798][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 386.981411][T11933] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1374'. [ 387.235689][ T46] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 387.307327][ T995] tipc: Node number set to 2130706433 [ 387.344445][T11939] binder: BINDER_SET_CONTEXT_MGR already set [ 387.367432][T11939] binder: 11938:11939 ioctl 4018620d 200000000100 returned -16 [ 387.406436][ T46] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 387.424911][ T46] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 387.445603][ T46] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 387.468341][ T46] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 387.483686][ T46] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 387.502893][ T46] usb 6-1: config 0 descriptor?? [ 387.730666][T11933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 387.745426][T11933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 387.791798][T11943] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 387.805230][T11943] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 387.849412][T11943] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 387.855523][T11943] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 387.893834][T11943] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 387.909103][T11943] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 388.088703][T11943] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 388.095401][T11943] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 388.158190][T11943] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 388.184938][T11943] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 388.546736][ T46] ath6kl: Failed to submit usb control message: -110 [ 388.582663][ T46] ath6kl: unable to send the bmi data to the device: -110 [ 388.613723][ T46] ath6kl: Unable to send get target info: -110 [ 388.651045][ T46] ath6kl: Failed to init ath6kl core: -110 [ 388.671698][ T46] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 388.682325][ T5724] usb 4-1: USB disconnect, device number 73 [ 389.034786][ T5724] usb 4-1: new full-speed USB device number 74 using dummy_hcd [ 389.143357][T11963] loop9: detected capacity change from 0 to 2640 [ 389.197140][ T5724] usb 4-1: unable to get BOS descriptor or descriptor too short [ 389.206367][ T5724] usb 4-1: not running at top speed; connect to a high speed hub [ 389.221099][ T5724] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 389.235671][ T5724] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 191, setting to 64 [ 389.249090][ T5724] usb 4-1: config 1 interface 0 has no altsetting 0 [ 389.259074][ T5724] usb 4-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.40 [ 389.269518][ T5724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.278048][ T5724] usb 4-1: Product: syz [ 389.282574][ T5724] usb 4-1: Manufacturer: syz [ 389.287717][ T5724] usb 4-1: SerialNumber: syz [ 389.297436][T11956] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 389.547881][T11969] syzkaller0: entered promiscuous mode [ 389.554412][T11969] syzkaller0: entered allmulticast mode [ 389.562412][ T5724] usbtouchscreen 4-1:1.0: probe with driver usbtouchscreen failed with error -71 [ 389.588444][ T5724] usb 4-1: USB disconnect, device number 74 [ 389.608476][T11969] tipc: Enabled bearer , priority 0 [ 389.645594][T11968] tipc: Resetting bearer [ 389.683642][T11968] tipc: Disabling bearer [ 389.987148][ T5731] usb 6-1: USB disconnect, device number 47 [ 390.034989][ T5724] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 390.096644][ T9] usb 3-1: new full-speed USB device number 80 using dummy_hcd [ 390.158068][T11988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.168070][T11988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.170154][ T5724] usb 5-1: device descriptor read/64, error -71 [ 390.276836][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 390.285633][ T9] usb 3-1: not running at top speed; connect to a high speed hub [ 390.295188][ T9] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 390.308534][ T9] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 191, setting to 64 [ 390.328619][ T9] usb 3-1: config 1 interface 0 has no altsetting 0 [ 390.338278][ T9] usb 3-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.40 [ 390.349905][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.360333][ T9] usb 3-1: Product: syz [ 390.364884][ T9] usb 3-1: Manufacturer: syz [ 390.370607][ T9] usb 3-1: SerialNumber: syz [ 390.379547][T11982] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 390.394894][ T5695] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 390.432874][ T5724] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 390.453437][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.558814][ T5695] usb 4-1: config 1 interface 0 has no altsetting 0 [ 390.577083][ T5724] usb 5-1: device descriptor read/64, error -71 [ 390.584506][ T5695] usb 4-1: string descriptor 0 read error: -22 [ 390.592539][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.599664][ T5695] usb 4-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.40 [ 390.616326][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.660095][ T9] usbtouchscreen 3-1:1.0: probe with driver usbtouchscreen failed with error -71 [ 390.710747][ T5724] usb usb5-port1: attempt power cycle [ 390.714646][ T9] usb 3-1: USB disconnect, device number 80 [ 390.765899][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.823443][ T5635] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 390.842238][ T5635] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 390.852031][ T5635] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 390.866077][ T5695] usbhid 4-1:1.0: can't add hid device: -71 [ 390.872171][ T5635] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 390.883613][ T5635] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 390.884659][ T5695] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 390.911411][ T5695] usb 4-1: USB disconnect, device number 75 [ 390.933901][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.947054][ T50] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 390.963348][ T50] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 390.973436][ T50] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 390.988647][ T50] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 390.996538][ T50] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 391.074929][ T5724] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 391.098271][ T5724] usb 5-1: device descriptor read/8, error -71 [ 391.348873][ T5724] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 391.386452][ T5724] usb 5-1: device descriptor read/8, error -71 [ 391.440247][ T12] bridge_slave_1: left allmulticast mode [ 391.454935][ T12] bridge_slave_1: left promiscuous mode [ 391.466572][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.483287][ T12] bridge_slave_0: left allmulticast mode [ 391.489064][ T12] bridge_slave_0: left promiscuous mode [ 391.496982][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 391.515131][ T5724] usb usb5-port1: unable to enumerate USB device [ 391.555266][ T5695] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 391.726653][ T5695] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 391.764891][ T5695] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 391.784050][ T5695] usb 3-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice= 0.40 [ 391.793574][ T5695] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.805877][ T5695] usb 3-1: Product: syz [ 391.810178][ T5695] usb 3-1: Manufacturer: syz [ 391.822673][ T5695] usb 3-1: SerialNumber: syz [ 391.830415][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 391.852408][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 391.867282][ T12] bond0 (unregistering): Released all slaves [ 392.201219][ T5292] 8021q: adding VLAN 0 to HW filter on device eth1 [ 392.337275][T11992] bridge0: port 1(bridge_slave_0) entered blocking state [ 392.348478][T11992] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.364959][T11992] bridge_slave_0: entered allmulticast mode [ 392.376024][T11992] bridge_slave_0: entered promiscuous mode [ 392.394573][T11992] bridge0: port 2(bridge_slave_1) entered blocking state [ 392.404857][T11992] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.412292][T11992] bridge_slave_1: entered allmulticast mode [ 392.420412][T11992] bridge_slave_1: entered promiscuous mode [ 392.495838][ T12] hsr_slave_0: left promiscuous mode [ 392.507781][ T12] hsr_slave_1: left promiscuous mode [ 392.524247][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 392.534712][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 392.544183][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 392.565460][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 392.596547][ T12] veth1_macvtap: left promiscuous mode [ 392.610052][ T12] veth0_macvtap: left promiscuous mode [ 392.621427][ T12] veth1_vlan: left promiscuous mode [ 392.636987][ T12] veth0_vlan: left promiscuous mode [ 392.864950][ T5695] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 392.878957][ T5695] usb 3-1: USB disconnect, device number 81 [ 393.034888][ T50] Bluetooth: hci1: command tx timeout [ 393.123763][ T12] team0 (unregistering): Port device team_slave_1 removed [ 393.143474][ T12] team0 (unregistering): Port device team_slave_0 removed [ 393.247418][T11992] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 393.274440][T11992] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 393.344021][ T5731] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 393.390335][T11992] team0: Port device team_slave_0 added [ 393.413014][T11992] team0: Port device team_slave_1 added [ 393.489668][T11992] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 393.506248][T11992] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 393.515603][ T5731] usb 5-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 393.566287][T11992] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 393.588843][ T5731] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.617932][ T5731] usb 5-1: Product: syz [ 393.622257][T11992] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 393.629519][ T5731] usb 5-1: Manufacturer: syz [ 393.629540][ T5731] usb 5-1: SerialNumber: syz [ 393.634455][ T5731] usb 5-1: config 0 descriptor?? [ 393.664047][T11992] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 393.678867][ T5731] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 393.736217][T11992] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 393.826733][ T5724] usb 4-1: new full-speed USB device number 76 using dummy_hcd [ 393.889401][ T5731] gspca_sunplus: reg_w_riv err -71 [ 393.899471][ T5731] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 393.913569][T11992] hsr_slave_0: entered promiscuous mode [ 393.939192][T11992] hsr_slave_1: entered promiscuous mode [ 393.966557][ T5731] usb 5-1: USB disconnect, device number 97 [ 394.011449][ T5724] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 394.042894][ T5724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.079998][ T5724] usb 4-1: Product: syz [ 394.094281][ T5724] usb 4-1: Manufacturer: syz [ 394.109412][ T5724] usb 4-1: SerialNumber: syz [ 394.143233][ T5724] usb 4-1: config 0 descriptor?? [ 394.178566][ T5724] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 394.687816][ T5292] 8021q: adding VLAN 0 to HW filter on device eth2 [ 394.999617][ T5724] gspca_stk1135: reg_w 0x5 err -71 [ 395.011071][ T5724] gspca_stk1135: serial bus timeout: status=0x00 [ 395.018206][ T5724] gspca_stk1135: Sensor write failed [ 395.023562][ T5724] gspca_stk1135: serial bus timeout: status=0x00 [ 395.032710][ T5724] gspca_stk1135: Sensor write failed [ 395.038629][ T5724] gspca_stk1135: serial bus timeout: status=0x00 [ 395.055637][ T5724] gspca_stk1135: Sensor read failed [ 395.065073][ T5724] gspca_stk1135: serial bus timeout: status=0x00 [ 395.076446][ T5724] gspca_stk1135: Sensor read failed [ 395.091931][ T5724] gspca_stk1135: Detected sensor type unknown (0x0) [ 395.099228][ T5724] gspca_stk1135: serial bus timeout: status=0x00 [ 395.107561][ T50] Bluetooth: hci1: command tx timeout [ 395.114787][ T5724] gspca_stk1135: Sensor read failed [ 395.123600][ T5724] gspca_stk1135: serial bus timeout: status=0x00 [ 395.152310][ T5724] gspca_stk1135: Sensor read failed [ 395.177370][ T5724] gspca_stk1135: serial bus timeout: status=0x00 [ 395.191237][ T5724] gspca_stk1135: Sensor write failed [ 395.207916][ T5724] gspca_stk1135: serial bus timeout: status=0x00 [ 395.226627][ T5724] gspca_stk1135: Sensor write failed [ 395.238205][ T5724] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 395.294198][ T5724] usb 4-1: USB disconnect, device number 76 [ 395.419029][ T808] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 395.486113][ T46] usb 3-1: new full-speed USB device number 82 using dummy_hcd [ 395.595788][ T808] usb 5-1: unable to get BOS descriptor or descriptor too short [ 395.617708][ T808] usb 5-1: config 211 has an invalid interface number: 123 but max is 0 [ 395.626433][ T46] usb 3-1: device descriptor read/64, error -71 [ 395.638719][ T808] usb 5-1: config 211 has no interface number 0 [ 395.655445][ T808] usb 5-1: config 211 interface 123 has no altsetting 0 [ 395.679277][ T808] usb 5-1: New USB device found, idVendor=07c4, idProduct=a4a5, bcdDevice=52.ed [ 395.695974][ T808] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.706744][ T808] usb 5-1: Product: syz [ 395.711129][ T808] usb 5-1: Manufacturer: syz [ 395.717987][ T808] usb 5-1: SerialNumber: syz [ 395.894936][ T46] usb 3-1: new full-speed USB device number 83 using dummy_hcd [ 396.011391][ T808] usb-storage 5-1:211.123: USB Mass Storage device detected [ 396.034914][ T46] usb 3-1: device descriptor read/64, error -71 [ 396.042472][ T808] usb-storage 5-1:211.123: Quirks match for vid 07c4 pid a4a5: 420 [ 396.116678][T11992] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 396.129374][ T808] usb 5-1: USB disconnect, device number 98 [ 396.139045][T11992] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 396.165058][ T46] usb usb3-port1: attempt power cycle [ 396.171031][T11992] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 396.191336][T11992] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 396.199641][T11992] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 396.216894][T11992] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 396.235621][T11992] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 396.244974][ T10] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 396.256523][T11992] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 396.360165][T11992] 8021q: adding VLAN 0 to HW filter on device bond0 [ 396.375857][ T10] usb 4-1: device descriptor read/64, error -71 [ 396.387090][T11992] 8021q: adding VLAN 0 to HW filter on device team0 [ 396.402826][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.410060][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 396.431598][ T9229] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.438786][ T9229] bridge0: port 2(bridge_slave_1) entered forwarding state [ 396.515107][ T46] usb 3-1: new full-speed USB device number 84 using dummy_hcd [ 396.537025][ T46] usb 3-1: device descriptor read/8, error -71 [ 396.552240][T11992] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 396.629506][ T10] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 396.638730][T11992] veth0_vlan: entered promiscuous mode [ 396.662548][T11992] veth1_vlan: entered promiscuous mode [ 396.709177][T11992] veth0_macvtap: entered promiscuous mode [ 396.727543][T11992] veth1_macvtap: entered promiscuous mode [ 396.774915][ T10] usb 4-1: device descriptor read/64, error -71 [ 396.786685][ T46] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 396.797141][T11992] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 396.817301][ T46] usb 3-1: device descriptor read/8, error -71 [ 396.841019][T11992] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 396.877845][ T9229] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.896903][ T10] usb usb4-port1: attempt power cycle [ 396.921013][ T9229] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.940283][ T9229] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.962598][ T46] usb usb3-port1: unable to enumerate USB device [ 396.972782][ T35] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 397.114450][ T9229] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 397.142265][ T9229] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 397.185162][ T50] Bluetooth: hci1: command tx timeout [ 397.203554][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 397.228151][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 397.254843][ T10] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 397.275550][ T10] usb 4-1: device descriptor read/8, error -71 [ 397.464825][ T46] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 397.524818][ T10] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 397.559104][ T10] usb 4-1: device descriptor read/8, error -71 [ 397.624803][ T46] usb 5-1: Using ep0 maxpacket: 32 [ 397.637899][ T46] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 397.656375][ T46] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 397.677998][ T10] usb usb4-port1: unable to enumerate USB device [ 397.684310][ T46] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 50, changing to 9 [ 397.708522][ T46] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 50297, setting to 1024 [ 397.729165][ T46] usb 5-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 397.741501][ T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.763938][ T46] usb 5-1: Product: syz [ 397.768220][ T46] usb 5-1: Manufacturer: syz [ 397.773184][ T46] usb 5-1: SerialNumber: syz [ 397.783045][ T46] usb 5-1: config 0 descriptor?? [ 397.792575][T12140] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 397.806944][ T46] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input65 [ 397.957799][ C1] xpad 5-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 397.990808][ C1] xpad 5-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 398.000240][ C1] xpad 5-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 399.227679][T12181] fuse: Bad value for 'fd' [ 399.265850][ T50] Bluetooth: hci1: command tx timeout [ 399.476908][ T10] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 399.636427][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 399.649226][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 399.674792][ T10] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 399.694985][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 399.706352][ T5732] usb 6-1: new full-speed USB device number 48 using dummy_hcd [ 399.714198][ T10] usb 4-1: config 1 interface 1 has no altsetting 0 [ 399.737442][ T10] usb 4-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 399.749376][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.757729][ T10] usb 4-1: Product: syz [ 399.761927][ T10] usb 4-1: Manufacturer: syz [ 399.766607][ T10] usb 4-1: SerialNumber: syz [ 399.887864][ T5732] usb 6-1: unable to get BOS descriptor or descriptor too short [ 399.907386][ T5732] usb 6-1: not running at top speed; connect to a high speed hub [ 399.928604][ T5732] usb 6-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 399.948448][T12190] kvm: kvm [12188]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010000) = 0x8 [ 399.957862][ T5732] usb 6-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 191, setting to 64 [ 399.969025][ T5732] usb 6-1: config 1 interface 0 has no altsetting 0 [ 399.979301][ T5732] usb 6-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.40 [ 399.992359][ T5732] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.994321][T12181] netlink: 'syz.3.1426': attribute type 1 has an invalid length. [ 400.000827][ T5732] usb 6-1: Product: syz [ 400.000845][ T5732] usb 6-1: Manufacturer: syz [ 400.000859][ T5732] usb 6-1: SerialNumber: syz [ 400.005438][T12185] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 400.068895][T12181] 8021q: adding VLAN 0 to HW filter on device bond1 [ 400.091886][T12192] bond1: (slave geneve2): making interface the new active one [ 400.128427][T12192] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 400.210889][ T46] usb 5-1: USB disconnect, device number 99 [ 400.216971][ C1] xpad 5-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 400.252602][T12181] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1426'. [ 400.375930][ T5732] usbtouchscreen 6-1:1.0: probe with driver usbtouchscreen failed with error -71 [ 400.435687][ T5732] usb 6-1: USB disconnect, device number 48 [ 400.585212][ T808] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 400.757280][ T808] usb 3-1: Using ep0 maxpacket: 16 [ 400.782085][ T808] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 48, changing to 9 [ 400.802202][ T808] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8244, setting to 1024 [ 400.813674][ T10] usb 4-1: selecting invalid altsetting 0 [ 400.817416][ T808] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 400.856621][ T808] usb 3-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 400.894175][ T808] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.925715][ T808] usb 3-1: config 0 descriptor?? [ 400.967599][ T10] usb 4-1: USB disconnect, device number 81 [ 400.980157][ T808] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input67 [ 401.053698][T12202] ======================================================= [ 401.053698][T12202] WARNING: The mand mount option has been deprecated and [ 401.053698][T12202] and is ignored by this kernel. Remove the mand [ 401.053698][T12202] option from the mount to silence this warning. [ 401.053698][T12202] ======================================================= [ 401.157000][ T5732] usb 3-1: USB disconnect, device number 86 [ 401.168096][ T4982] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -19 [ 401.187595][ T6954] udevd[6954]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 401.214433][ T4982] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -19 [ 401.368997][T12192] syz.3.1426 (12192) used greatest stack depth: 18304 bytes left [ 402.189482][T12229] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1440'. [ 402.293817][T12234] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1442'. [ 402.754874][ T10] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 402.935232][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 402.955835][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 402.974817][ T10] usb 4-1: can't read configurations, error -71 [ 403.574535][T12259] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1451'. [ 404.124826][ T5637] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 404.306405][ T5637] usb 3-1: Using ep0 maxpacket: 8 [ 404.316544][ T5637] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 404.346970][ T5637] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 404.348615][T12280] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1456'. [ 404.370911][ T5637] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.403143][ T5637] usb 3-1: config 0 descriptor?? [ 404.738302][ T5637] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 405.185550][ T808] usb 4-1: new full-speed USB device number 84 using dummy_hcd [ 405.276317][ T5637] usb 3-1: USB disconnect, device number 87 [ 405.367347][ T808] usb 4-1: unable to get BOS descriptor or descriptor too short [ 405.382190][ T808] usb 4-1: not running at top speed; connect to a high speed hub [ 405.396085][ T808] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 405.410441][ T808] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 512, setting to 64 [ 405.442160][ T808] usb 4-1: string descriptor 0 read error: -22 [ 405.459491][ T808] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 0.40 [ 405.486584][ T808] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.521182][T12296] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 405.554156][ T808] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 405.601330][ T808] usb 4-1: MIDIStreaming interface descriptor not found [ 405.917453][T12312] syzkaller0: entered promiscuous mode [ 405.933588][T12312] syzkaller0: entered allmulticast mode [ 407.427394][T12325] fuse: Unknown parameter 'ff' [ 407.652813][T12329] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1469'. [ 407.923267][ T46] usb 4-1: USB disconnect, device number 84 [ 407.935208][ T10] usb 6-1: new full-speed USB device number 49 using dummy_hcd [ 408.094921][ T10] usb 6-1: device descriptor read/64, error -71 [ 408.119737][T12336] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1472'. [ 408.354895][ T10] usb 6-1: new full-speed USB device number 50 using dummy_hcd [ 408.375081][ T5731] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 408.494808][ T10] usb 6-1: device descriptor read/64, error -71 [ 408.544817][ T5731] usb 4-1: Using ep0 maxpacket: 16 [ 408.553635][ T5731] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 408.564339][ T5731] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 408.577039][ T5731] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 408.586898][ T5731] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 408.604126][ T5731] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 408.618149][ T10] usb usb6-port1: attempt power cycle [ 408.626925][ T5731] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 408.638978][ T5731] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 408.652642][ T5731] usb 4-1: Manufacturer: syz [ 408.664973][ T5731] usb 4-1: config 0 descriptor?? [ 408.954827][ T5731] rc_core: IR keymap rc-hauppauge not found [ 408.964032][ T5731] Registered IR keymap rc-empty [ 408.971506][ T10] usb 6-1: new full-speed USB device number 51 using dummy_hcd [ 408.982328][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.005768][ T10] usb 6-1: device descriptor read/8, error -71 [ 409.026612][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.055997][ T5731] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 409.079540][ T5731] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input68 [ 409.122046][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.157152][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.195129][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.234810][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.277516][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.284889][ T10] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 409.314856][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.335862][ T10] usb 6-1: device descriptor read/8, error -71 [ 409.357697][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.384843][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.419676][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.445539][ T10] usb usb6-port1: unable to enumerate USB device [ 409.454853][ T5731] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 409.488927][ T5731] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 409.502246][ T5731] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 409.516538][ T5731] usb 4-1: USB disconnect, device number 85 [ 410.156782][T12378] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1483'. [ 410.166103][T12378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1483'. [ 410.309141][ T29] kauditd_printk_skb: 14 callbacks suppressed [ 410.309158][ T29] audit: type=1400 audit(1781022605.039:14220): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name="#(%#{//(@\)//&@},['%%&\#*" pid=12383 comm="syz.2.1485" [ 410.594880][ T46] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 410.675058][ T808] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 410.765032][ T46] usb 4-1: Using ep0 maxpacket: 16 [ 410.767587][T12402] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1491'. [ 410.772678][ T46] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 410.795236][ T46] usb 4-1: config 0 interface 0 has no altsetting 0 [ 410.802029][ T46] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 410.811550][ T46] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.825260][ T46] usb 4-1: config 0 descriptor?? [ 410.834744][ T808] usb 3-1: Using ep0 maxpacket: 16 [ 410.855457][ T808] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 410.877106][ T808] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 410.888351][ T808] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 410.903216][ T808] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 410.936260][ T808] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 410.954800][ T808] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 410.963679][ T808] usb 3-1: SerialNumber: syz [ 410.975159][T12393] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 410.985960][T12393] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 410.995645][ T808] hub 3-1:1.0: bad descriptor, ignoring hub [ 411.002094][ T808] hub 3-1:1.0: probe with driver hub failed with error -5 [ 411.074859][ T10] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 411.202336][ T808] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 411.255778][ T808] usb 3-1: USB disconnect, device number 88 [ 411.274779][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 411.282359][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 411.302425][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 411.321157][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 411.345167][ T10] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 411.354973][ T46] nzxt-smart2 0003:1E71:2009.0023: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 411.368077][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 411.406214][ T10] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 411.416449][ T10] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 411.436516][ T10] usb 6-1: Manufacturer: syz [ 411.459498][ T10] usb 6-1: config 0 descriptor?? [ 411.591994][ T5732] usb 4-1: USB disconnect, device number 86 [ 411.636600][T12412] fido_id[12412]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 411.799430][T12414] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 411.815310][ T10] rc_core: IR keymap rc-hauppauge not found [ 411.844571][ T10] Registered IR keymap rc-empty [ 411.862293][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 411.870968][ T46] usb 3-1: new full-speed USB device number 89 using dummy_hcd [ 411.908520][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 411.947118][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 411.984367][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input69 [ 412.026810][ T46] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 412.053338][ T46] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 96, setting to 64 [ 412.073353][ T46] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 412.090156][ T46] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 412.101153][ T46] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 412.101485][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.110583][ T46] usb 3-1: SerialNumber: syz [ 412.178099][T12393] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 412.187320][ T46] hub 3-1:1.0: bad descriptor, ignoring hub [ 412.194985][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.202300][ T46] hub 3-1:1.0: probe with driver hub failed with error -5 [ 412.245190][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.274900][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.314993][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.335396][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.364792][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.399902][ T46] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 412.452100][ T46] usb 3-1: USB disconnect, device number 89 [ 412.460177][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.502987][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.554963][ T10] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 412.606937][ T10] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 412.639540][ T10] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 412.694035][T12428] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1498'. [ 412.703884][ T10] usb 6-1: USB disconnect, device number 53 [ 413.034058][T12439] loop2: detected capacity change from 0 to 7 [ 413.058115][T12439] loop2: [ 413.067170][T12439] loop2: partition table partially beyond EOD, truncated [ 413.234946][ T10] usb 5-1: new low-speed USB device number 100 using dummy_hcd [ 413.424261][ T10] usb 5-1: config 1 interface 0 altsetting 10 endpoint 0x1 is Bulk; changing to Interrupt [ 413.445148][ T10] usb 5-1: config 1 interface 0 altsetting 10 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 413.474862][ T10] usb 5-1: config 1 interface 0 has no altsetting 0 [ 413.499898][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 413.515360][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.526669][T12457] netlink: 'syz.5.1508': attribute type 1 has an invalid length. [ 413.535424][ T10] usb 5-1: Product: Ќ [ 413.540702][ T10] usb 5-1: Manufacturer: 냥뎃⎳鋍㨚鉄p⡬⭂棌嫠鵾㏻𢡄鵡彌왠綁ᵪ郀᾵롘ᨯ솲㸝爮㋭抒猟奈뛑벌輦ꀌ䎈ᶃ㑚婰₄᳴꿐Ջ콫Ụ算팡悝덝繼⣧㺶 [ 413.581453][ T10] usb 5-1: SerialNumber: ᰉ [ 413.587558][T12457] 8021q: adding VLAN 0 to HW filter on device bond1 [ 413.595473][T12460] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1508'. [ 413.604934][T12460] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1508'. [ 413.612265][T12434] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 413.641682][T12434] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 413.740051][T12457] fuse: Bad value for 'fd' [ 413.903057][T12467] input: syz1 as /devices/virtual/input/input70 [ 414.168169][ T10] usb 5-1: USB disconnect, device number 100 [ 414.218665][T12481] xt_hashlimit: size too large, truncated to 1048576 [ 414.565230][ T5732] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 414.629836][T12503] A link change request failed with some changes committed already. Interface sit1 may have been left with an inconsistent configuration, please check. [ 414.734902][ T5732] usb 4-1: Using ep0 maxpacket: 16 [ 414.752757][ T5732] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 414.795405][ T5732] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 414.813067][ T5732] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 414.823987][ T5732] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 414.851221][ T5732] usb 4-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 414.866831][ T29] audit: type=1326 audit(1781022609.599:14221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 414.874235][ T5732] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.921717][ T5732] usb 4-1: config 0 descriptor?? [ 414.923315][ T29] audit: type=1326 audit(1781022609.609:14222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 414.973572][ T29] audit: type=1326 audit(1781022609.639:14223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 415.000950][ T29] audit: type=1326 audit(1781022609.639:14224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 415.026468][ T29] audit: type=1326 audit(1781022609.649:14225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 415.053538][ T29] audit: type=1326 audit(1781022609.649:14226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 415.084835][ T46] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 415.101195][ T29] audit: type=1326 audit(1781022609.649:14227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 415.127012][ T29] audit: type=1326 audit(1781022609.649:14228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 415.152003][ T29] audit: type=1326 audit(1781022609.649:14229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12514 comm="syz.2.1527" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7fd47dd9ce59 code=0x7ffc0000 [ 415.160036][T12484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.203387][T12484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.258286][ T46] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 415.267806][ T46] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 415.276784][ T46] usb 5-1: Product: syz [ 415.281427][ T46] usb 5-1: SerialNumber: syz [ 415.290356][ T46] usb 5-1: config 0 descriptor?? [ 415.402362][ T5732] input: HID 0458:5013 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5013.0024/input/input71 [ 415.414581][T12491] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1516'. [ 415.445286][ T808] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 415.489616][ T5732] input: HID 0458:5013 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5013.0024/input/input72 [ 415.516851][ T5637] IPVS: starting estimator thread 0... [ 415.580654][T12525] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.605077][ T808] usb 6-1: Using ep0 maxpacket: 32 [ 415.605579][ T5732] kye 0003:0458:5013.0024: input,hiddev0,hidraw0: USB HID vff.fa Device [HID 0458:5013] on usb-dummy_hcd.3-1/input0 [ 415.619460][ T808] usb 6-1: unable to get BOS descriptor or descriptor too short [ 415.632417][ T808] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 415.652218][T12524] IPVS: using max 32 ests per chain, 76800 per kthread [ 415.653578][ T808] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 415.695684][T12525] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.732312][ T808] usb 6-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 415.764353][ T808] usb 6-1: New USB device found, idVendor=0763, idProduct=1033, bcdDevice= 0.40 [ 415.775307][ T808] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.787460][ T808] usb 6-1: Product: syz [ 415.792890][ T808] usb 6-1: Manufacturer: syz [ 415.798352][ T808] usb 6-1: SerialNumber: syz [ 415.811602][ T5732] usb 4-1: USB disconnect, device number 87 [ 415.926319][T12526] fido_id[12526]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 415.942097][T12528] xt_hashlimit: size too large, truncated to 1048576 [ 416.139771][T12534] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1530'. [ 416.279575][ T46] usb 5-1: USB disconnect, device number 101 [ 416.424813][ T5732] usb 3-1: new low-speed USB device number 90 using dummy_hcd [ 416.459620][T12539] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1533'. [ 416.594887][ T5732] usb 3-1: Invalid ep0 maxpacket: 64 [ 416.734948][ T5732] usb 3-1: new low-speed USB device number 91 using dummy_hcd [ 416.802371][ T808] usb 6-1: 0:2 : does not exist [ 416.815394][ T808] usb 6-1: unit 3 not found! [ 416.820181][ T808] usb 6-1: unit 8 not found! [ 416.901765][ T808] usb 6-1: USB disconnect, device number 54 [ 416.935706][ T5732] usb 3-1: Invalid ep0 maxpacket: 64 [ 416.970826][ T5732] usb usb3-port1: attempt power cycle [ 416.983269][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 417.038352][T12546] netlink: 'syz.4.1534': attribute type 4 has an invalid length. [ 417.099880][T12546] netlink: 'syz.4.1534': attribute type 4 has an invalid length. [ 417.384843][ T5732] usb 3-1: new low-speed USB device number 92 using dummy_hcd [ 417.435648][ T5732] usb 3-1: Invalid ep0 maxpacket: 64 [ 417.597475][ T5732] usb 3-1: new low-speed USB device number 93 using dummy_hcd [ 417.624394][ T29] kauditd_printk_skb: 33 callbacks suppressed [ 417.624413][ T29] audit: type=1804 audit(1781022612.349:14263): pid=12554 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1537" name="/newroot/48/file1" dev="tmpfs" ino=274 res=1 errno=0 [ 417.658697][ T5732] usb 3-1: Invalid ep0 maxpacket: 64 [ 417.699590][ T5732] usb usb3-port1: unable to enumerate USB device [ 417.745876][ T29] audit: type=1326 audit(1781022612.489:14264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12553 comm="syz.3.1537" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f12e459ce59 code=0x7ffc0000 [ 417.830283][ T29] audit: type=1326 audit(1781022612.519:14265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12553 comm="syz.3.1537" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f12e459ce59 code=0x7ffc0000 [ 417.904051][ T29] audit: type=1326 audit(1781022612.519:14266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12553 comm="syz.3.1537" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f12e459ce59 code=0x7ffc0000 [ 417.956097][ T29] audit: type=1326 audit(1781022612.559:14267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12553 comm="syz.3.1537" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f12e459ce59 code=0x7ffc0000 [ 418.155749][ T29] audit: type=1326 audit(1781022612.889:14268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12562 comm="syz.3.1538" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f12e459ce59 code=0x0 [ 418.228997][T12568] fuse: Unknown parameter '017777777777777777777770x0000000000000004' [ 418.448710][T12571] netlink: 'syz.4.1540': attribute type 11 has an invalid length. [ 418.609024][T12579] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1543'. [ 418.618374][T12579] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1543'. [ 418.630704][T12579] netlink: 'syz.5.1543': attribute type 18 has an invalid length. [ 418.894807][ T808] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 419.054860][ T808] usb 6-1: Using ep0 maxpacket: 8 [ 419.069402][ T808] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 419.089789][ T808] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 419.101905][ T808] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 419.114158][T12584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.123893][ T808] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 419.134216][ T808] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 419.147904][T12584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.168494][ T808] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 419.184742][ T808] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.226093][ T5637] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 419.278287][T12589] netlink: zone id is out of range [ 419.283467][T12589] netlink: zone id is out of range [ 419.288938][T12589] netlink: zone id is out of range [ 419.294089][T12589] netlink: zone id is out of range [ 419.299870][T12589] netlink: zone id is out of range [ 419.305459][T12589] netlink: zone id is out of range [ 419.310634][T12589] netlink: get zone limit has 4 unknown bytes [ 419.334940][ T10] usb 5-1: new full-speed USB device number 102 using dummy_hcd [ 419.378429][ T5637] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 419.387698][ T5637] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.395794][ T5637] usb 4-1: Product: syz [ 419.401028][ T5637] usb 4-1: Manufacturer: syz [ 419.405719][ T5637] usb 4-1: SerialNumber: syz [ 419.498078][ T10] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 419.508372][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.517045][ T10] usb 5-1: Product: syz [ 419.521269][ T10] usb 5-1: Manufacturer: syz [ 419.526379][ T10] usb 5-1: SerialNumber: syz [ 419.533606][ T10] usb 5-1: config 0 descriptor?? [ 419.544214][ T10] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 419.620028][ T808] usb 6-1: USB disconnect, device number 55 [ 419.759716][ T10] gspca_stk1135: reg_w 0x3 err -71 [ 419.771230][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 419.780989][ T10] gspca_stk1135: Sensor write failed [ 419.786738][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 419.798296][ T10] gspca_stk1135: Sensor write failed [ 419.807579][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 419.814210][ T10] gspca_stk1135: Sensor read failed [ 419.820756][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 419.827826][ T10] gspca_stk1135: Sensor read failed [ 419.844362][ T10] gspca_stk1135: Detected sensor type unknown (0x0) [ 419.851698][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 419.858173][ T10] gspca_stk1135: Sensor read failed [ 419.863598][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 419.873431][ T10] gspca_stk1135: Sensor read failed [ 419.894447][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 419.908368][ T10] gspca_stk1135: Sensor write failed [ 419.913740][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 419.921199][ T10] gspca_stk1135: Sensor write failed [ 419.927238][ T10] stk1135 5-1:0.0: probe with driver stk1135 failed with error -71 [ 419.939038][ T10] usb 5-1: USB disconnect, device number 102 [ 420.208682][ T5637] usb 4-1: can't set config #1, error -71 [ 420.250520][ T5637] usb 4-1: USB disconnect, device number 88 [ 420.589133][T12623] syz_tun: entered promiscuous mode [ 420.599719][T12623] syz_tun: refused to change device tx_queue_len [ 420.680240][T12625] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 420.795939][ T5637] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 420.991891][ T5637] usb 6-1: Using ep0 maxpacket: 8 [ 421.010409][ T5637] usb 6-1: too many configurations: 249, using maximum allowed: 8 [ 421.062323][ T5637] usb 6-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=b3.ff [ 421.100229][ T5637] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=2 [ 421.119071][ T5637] usb 6-1: Product: syz [ 421.130060][ T5637] usb 6-1: Manufacturer: syz [ 421.147796][ T5637] usb 6-1: SerialNumber: syz [ 421.178471][ T5637] usb 6-1: config 0 descriptor?? [ 421.203187][ T9229] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.439300][ T5637] mdc800 6-1:0.0: probe fails -> wrong Number of Configuration [ 421.470045][ T5635] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 421.493315][ T5635] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 421.503777][ T5635] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 421.515386][ T5635] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 421.528432][ T5635] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 421.538754][ T9229] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.541744][ T5637] usb 6-1: USB disconnect, device number 56 [ 421.672738][ T9229] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.876490][ T9229] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.104836][ T808] usb 5-1: new full-speed USB device number 103 using dummy_hcd [ 422.135342][ T5732] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 422.211374][T12648] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1569'. [ 422.266837][ T808] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 422.277973][ T808] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 422.290713][ T808] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 422.300015][ T808] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.308209][ T808] usb 5-1: Product: syz [ 422.312415][ T808] usb 5-1: Manufacturer: syz [ 422.317137][ T808] usb 5-1: SerialNumber: syz [ 422.329817][ T5732] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 422.334222][ T808] usb 5-1: 0:2 : does not exist [ 422.364198][ T5732] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 422.390479][ T5732] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 422.413616][ T5732] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 422.485922][ T5732] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 422.497360][ T5732] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.511645][ T5732] usb 3-1: config 0 descriptor?? [ 422.518548][T12645] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 422.526603][ T9229] bridge_slave_1: left allmulticast mode [ 422.539603][ T9229] bridge_slave_1: left promiscuous mode [ 422.552533][ T9229] bridge0: port 2(bridge_slave_1) entered disabled state [ 422.581850][ T9229] bridge_slave_0: left allmulticast mode [ 422.604586][ T9229] bridge_slave_0: left promiscuous mode [ 422.623870][ T9229] bridge0: port 1(bridge_slave_0) entered disabled state [ 422.638083][ T808] usb 5-1: USB disconnect, device number 103 [ 422.712225][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 422.982079][ T5732] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 422.996001][ T5732] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 423.016257][ T5732] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 423.030316][ T5732] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 423.038152][ T5732] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 423.047773][ T5732] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 423.056064][ T5732] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 423.095293][ T5732] plantronics 0003:047F:FFFF.0025: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 423.187373][ T9229] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 423.201799][ T5635] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 423.220870][ T5635] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 423.233280][ T5635] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 423.246465][ T5635] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 423.260699][ T5635] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 423.284422][T12645] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3430948866 (6861897732 ns) > initial count (200000 ns). Using initial count to start timer. [ 423.343175][ T9229] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 423.375587][ T9229] bond0 (unregistering): Released all slaves [ 423.586014][ T5635] Bluetooth: hci4: command tx timeout [ 423.605055][ T5731] usb 4-1: new full-speed USB device number 89 using dummy_hcd [ 423.686128][T12637] bridge0: port 1(bridge_slave_0) entered blocking state [ 423.711440][T12637] bridge0: port 1(bridge_slave_0) entered disabled state [ 423.727179][T12637] bridge_slave_0: entered allmulticast mode [ 423.736063][T12637] bridge_slave_0: entered promiscuous mode [ 423.754852][ T10] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 423.772349][T12637] bridge0: port 2(bridge_slave_1) entered blocking state [ 423.783499][T12637] bridge0: port 2(bridge_slave_1) entered disabled state [ 423.788277][ T5731] usb 4-1: config 0 interface 0 has no altsetting 0 [ 423.799139][T12637] bridge_slave_1: entered allmulticast mode [ 423.805974][ T5731] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 423.808111][T12637] bridge_slave_1: entered promiscuous mode [ 423.817505][ T5731] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.833933][ T5731] usb 4-1: config 0 descriptor?? [ 423.919287][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 423.938412][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 423.948691][ T9229] hsr_slave_0: left promiscuous mode [ 423.950668][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 423.967498][ T9229] hsr_slave_1: left promiscuous mode [ 423.967877][ T10] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 423.980723][ T9229] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 423.990541][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.994024][ T10] usb 5-1: config 0 descriptor?? [ 424.019903][ T9229] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 424.038931][ T9229] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 424.065148][ T9229] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 424.084826][ T9229] veth1_macvtap: left promiscuous mode [ 424.090491][ T9229] veth0_macvtap: left promiscuous mode [ 424.096846][ T9229] veth1_vlan: left promiscuous mode [ 424.104061][ T9229] veth0_vlan: left promiscuous mode [ 424.262454][ T5731] pyra 0003:1E7D:2CF6.0026: unknown main item tag 0x4 [ 424.271858][ T5731] pyra 0003:1E7D:2CF6.0026: nested delimiters [ 424.278925][ T5731] pyra 0003:1E7D:2CF6.0026: item 0 4 2 10 parsing failed [ 424.290079][ T5731] pyra 0003:1E7D:2CF6.0026: parse failed [ 424.296258][ T5731] pyra 0003:1E7D:2CF6.0026: probe with driver pyra failed with error -22 [ 424.479350][ T5731] usb 4-1: USB disconnect, device number 89 [ 424.492766][ T9229] team0 (unregistering): Port device team_slave_1 removed [ 424.543214][ T9229] team0 (unregistering): Port device team_slave_0 removed [ 424.568150][ T10] plantronics 0003:047F:FFFF.0027: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 424.650123][ T46] usb 3-1: reset high-speed USB device number 94 using dummy_hcd [ 424.753698][T12637] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 424.769515][ T5292] 8021q: adding VLAN 0 to HW filter on device eth1 [ 424.779491][T12637] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 424.863770][T12637] team0: Port device team_slave_0 added [ 424.877958][T12637] team0: Port device team_slave_1 added [ 424.919284][T12637] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 424.929301][T12637] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 424.955661][T12637] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 424.968548][T12637] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 424.976232][T12637] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 425.002808][T12637] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 425.189542][T12700] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 425.240331][T12700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 425.337144][T12637] hsr_slave_0: entered promiscuous mode [ 425.346817][ T5635] Bluetooth: hci1: command tx timeout [ 425.373775][T12637] hsr_slave_1: entered promiscuous mode [ 425.394553][T12637] debugfs: 'hsr0' already exists in 'hsr' [ 425.409428][T12637] Cannot create hsr debugfs directory [ 425.419867][T12705] tipc: Started in network mode [ 425.428354][T12705] tipc: Node identity 7f000001, cluster identity 4711 [ 425.444972][T12705] tipc: Enabled bearer , priority 10 [ 425.469892][ T5637] usb 3-1: USB disconnect, device number 94 [ 425.520738][T12705] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1579'. [ 425.666031][ T5635] Bluetooth: hci4: command tx timeout [ 425.688917][ T5731] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 425.740264][ T9229] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.812991][T12666] bridge0: port 1(bridge_slave_0) entered blocking state [ 425.821507][T12666] bridge0: port 1(bridge_slave_0) entered disabled state [ 425.835104][T12666] bridge_slave_0: entered allmulticast mode [ 425.843127][T12666] bridge_slave_0: entered promiscuous mode [ 425.869529][T12666] bridge0: port 2(bridge_slave_1) entered blocking state [ 425.876881][T12666] bridge0: port 2(bridge_slave_1) entered disabled state [ 425.884142][T12666] bridge_slave_1: entered allmulticast mode [ 425.887072][ T5731] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 425.892771][T12666] bridge_slave_1: entered promiscuous mode [ 425.901143][ T5731] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 425.924642][ T5731] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 425.935394][ T5292] 8021q: adding VLAN 0 to HW filter on device eth2 [ 425.938315][ T5731] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.961920][T12709] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 425.979520][ T5731] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 426.037853][ T9229] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.139427][T12666] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 426.175182][T12666] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.218236][T12709] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1580'. [ 426.250426][T12709] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1580'. [ 426.330681][ T9229] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.450066][T12666] team0: Port device team_slave_0 added [ 426.482698][T12666] team0: Port device team_slave_1 added [ 426.585671][ T808] usb 4-1: USB disconnect, device number 90 [ 426.609873][ T46] usb 5-1: USB disconnect, device number 104 [ 426.619840][ T9229] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.812385][ T10] tipc: Node number set to 2130706433 [ 427.032856][T12666] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 427.047879][T12666] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 427.120229][T12744] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1584'. [ 427.149851][T12666] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 427.246358][T12739] geneve1: entered promiscuous mode [ 427.265674][T12739] macsec1: entered promiscuous mode [ 427.268672][ T50] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 427.273624][T12739] macsec1: entered allmulticast mode [ 427.285824][T12739] geneve1: entered allmulticast mode [ 427.288394][ T50] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 427.301077][T12739] geneve1: left allmulticast mode [ 427.304338][ T50] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 427.318396][T12739] geneve1: left promiscuous mode [ 427.325581][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 427.336601][ T50] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 427.344640][T12666] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 427.353350][T12666] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 427.380827][T12666] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 427.404752][ T5731] usb 5-1: new full-speed USB device number 105 using dummy_hcd [ 427.425027][ T50] Bluetooth: hci1: command tx timeout [ 427.519024][T12666] hsr_slave_0: entered promiscuous mode [ 427.525995][T12666] hsr_slave_1: entered promiscuous mode [ 427.532512][T12666] debugfs: 'hsr0' already exists in 'hsr' [ 427.538544][T12666] Cannot create hsr debugfs directory [ 427.567346][ T5731] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 427.594257][ T5731] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 427.606065][ T5731] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 427.618054][ T5731] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.640609][ T5731] usb 5-1: config 0 descriptor?? [ 427.745542][ T5635] Bluetooth: hci4: command tx timeout [ 427.947011][ T5731] ath6kl: Failed to submit usb control message: -71 [ 427.960875][ T5731] ath6kl: unable to send the bmi data to the device: -71 [ 427.976879][ T5731] ath6kl: Unable to send get target info: -71 [ 428.022882][ T5731] ath6kl: Failed to init ath6kl core: -71 [ 428.059101][ T5731] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 428.103507][ T5731] usb 5-1: USB disconnect, device number 105 [ 428.181993][ T9229] bridge_slave_1: left allmulticast mode [ 428.188961][ T9229] bridge_slave_1: left promiscuous mode [ 428.212461][ T9229] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.252902][ T9229] bridge_slave_0: left allmulticast mode [ 428.264846][ T9229] bridge_slave_0: left promiscuous mode [ 428.276857][ T9229] bridge0: port 1(bridge_slave_0) entered disabled state [ 428.707769][ T9229] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 428.729274][ T9229] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 428.752515][ T9229] bond0 (unregistering): Released all slaves [ 428.768419][ T9229] bond1 (unregistering): Released all slaves [ 429.522159][ T50] Bluetooth: hci1: command tx timeout [ 429.524424][ T5635] Bluetooth: hci2: command tx timeout [ 429.816261][ T9229] hsr_slave_0: left promiscuous mode [ 429.826309][ T5635] Bluetooth: hci4: command tx timeout [ 429.833100][ T9229] hsr_slave_1: left promiscuous mode [ 429.843853][ T9229] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 429.851687][ T9229] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 429.861065][ T9229] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 429.868799][ T9229] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 429.889924][ T9229] veth1_macvtap: left promiscuous mode [ 429.895626][ T9229] veth0_macvtap: left promiscuous mode [ 429.901422][ T9229] veth1_vlan: left promiscuous mode [ 429.907430][ T9229] veth0_vlan: left promiscuous mode [ 430.254271][ T9229] team0 (unregistering): Port device team_slave_1 removed [ 430.277506][ T9229] team0 (unregistering): Port device team_slave_0 removed [ 430.534332][ T5292] 8021q: adding VLAN 0 to HW filter on device eth3 [ 430.547925][T12637] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 430.588363][T12637] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 430.845903][T12637] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 430.862458][T12637] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 430.881941][T12637] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 430.897806][T12637] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 430.909221][T12751] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.922231][T12751] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.936540][T12751] bridge_slave_0: entered allmulticast mode [ 430.955889][T12751] bridge_slave_0: entered promiscuous mode [ 430.974909][T12637] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 430.988951][T12637] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 431.013410][T12751] bridge0: port 2(bridge_slave_1) entered blocking state [ 431.053536][T12751] bridge0: port 2(bridge_slave_1) entered disabled state [ 431.085250][T12751] bridge_slave_1: entered allmulticast mode [ 431.104932][T12751] bridge_slave_1: entered promiscuous mode [ 431.350638][T12751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 431.442746][T12751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 431.585172][ T5635] Bluetooth: hci2: command tx timeout [ 431.586444][ T50] Bluetooth: hci1: command tx timeout [ 431.628186][T12751] team0: Port device team_slave_0 added [ 431.657359][T12751] team0: Port device team_slave_1 added [ 431.817153][ T5732] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 431.928076][T12751] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 431.943073][T12751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 432.005951][ T5732] usb 5-1: Using ep0 maxpacket: 8 [ 432.012739][T12751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 432.014550][ T5732] usb 5-1: config 0 has an invalid interface number: 187 but max is 0 [ 432.063517][ T5732] usb 5-1: config 0 has no interface number 0 [ 432.071708][T12751] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 432.084262][ T5732] usb 5-1: config 0 interface 187 has no altsetting 0 [ 432.091112][T12751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 432.091141][T12751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 432.142801][ T5732] usb 5-1: New USB device found, idVendor=c942, idProduct=2c0f, bcdDevice=47.09 [ 432.152843][ T5732] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.178692][ T5732] usb 5-1: config 0 descriptor?? [ 432.262821][T12751] hsr_slave_0: entered promiscuous mode [ 432.270093][T12751] hsr_slave_1: entered promiscuous mode [ 432.337690][ T9229] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 432.438789][ T5732] usb 5-1: string descriptor 0 read error: -71 [ 432.461278][ T5732] usb-storage 5-1:0.187: USB Mass Storage device detected [ 432.578138][ T5732] usb 5-1: USB disconnect, device number 106 [ 432.741250][ T9229] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 432.834994][ T5695] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 432.872126][ T9229] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 432.893791][T12666] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 432.904632][T12666] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 432.944098][T12666] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 432.968419][T12666] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 432.975600][ T5695] usb 4-1: device descriptor read/64, error -71 [ 432.983100][T12666] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 432.993957][T12666] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 433.043581][ T9229] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.158783][T12666] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 433.184399][T12666] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 433.214761][ T5695] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 433.364815][ T5695] usb 4-1: device descriptor read/64, error -71 [ 433.451087][T12637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 433.497324][ T5695] usb usb4-port1: attempt power cycle [ 433.629457][T12637] 8021q: adding VLAN 0 to HW filter on device team0 [ 433.664954][ T50] Bluetooth: hci2: command tx timeout [ 433.685627][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 433.692809][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 433.708461][ T9229] bridge_slave_1: left allmulticast mode [ 433.714176][ T9229] bridge_slave_1: left promiscuous mode [ 433.720953][ T9229] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.731366][ T9229] bridge_slave_0: left allmulticast mode [ 433.738356][ T9229] bridge_slave_0: left promiscuous mode [ 433.744211][ T9229] bridge0: port 1(bridge_slave_0) entered disabled state [ 433.845003][ T5695] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 433.881842][ T5695] usb 4-1: device descriptor read/8, error -71 [ 433.958495][ T5635] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 433.966840][ T5635] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 433.984040][ T5635] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 434.002307][ T9229] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 434.004629][ T5635] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 434.019886][ T5635] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 434.028139][ T9229] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 434.043816][ T9229] bond0 (unregistering): Released all slaves [ 434.108505][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.115691][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 434.135362][ T5695] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 434.149170][ T9229] tipc: Disabling bearer [ 434.157202][ T9229] tipc: Left network mode [ 434.160312][ T5695] usb 4-1: device descriptor read/8, error -71 [ 434.285300][ T5695] usb usb4-port1: unable to enumerate USB device [ 434.487712][T12666] 8021q: adding VLAN 0 to HW filter on device bond0 [ 434.592845][ T9229] hsr_slave_0: left promiscuous mode [ 434.603999][ T9229] hsr_slave_1: left promiscuous mode [ 434.610622][ T9229] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 434.619039][ T9229] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 434.628238][ T9229] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 434.638802][ T9229] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 434.652693][ T9229] veth1_macvtap: left promiscuous mode [ 434.658646][ T9229] veth0_macvtap: left promiscuous mode [ 434.664360][ T9229] veth1_vlan: left promiscuous mode [ 434.670150][ T9229] veth0_vlan: left promiscuous mode [ 434.908353][ T9229] team0 (unregistering): Port device team_slave_1 removed [ 434.930585][ T9229] team0 (unregistering): Port device team_slave_0 removed [ 435.095549][T12666] 8021q: adding VLAN 0 to HW filter on device team0 [ 435.167339][ T8393] bridge0: port 1(bridge_slave_0) entered blocking state [ 435.174520][ T8393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 435.198946][ T8393] bridge0: port 2(bridge_slave_1) entered blocking state [ 435.206146][ T8393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 435.220964][T12637] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 435.531422][T12751] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 435.567660][T12751] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 435.583780][T12751] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 435.610216][T12751] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 435.628670][T12751] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 435.657717][T12751] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 435.695879][T12751] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 435.720196][T12751] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 435.745546][ T5635] Bluetooth: hci2: command tx timeout [ 435.968618][T12637] veth0_vlan: entered promiscuous mode [ 435.975439][ T5765] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 436.076549][ T5635] Bluetooth: hci0: command tx timeout [ 436.091041][T12869] bridge0: port 1(bridge_slave_0) entered blocking state [ 436.110775][T12869] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.125188][T12869] bridge_slave_0: entered allmulticast mode [ 436.141993][T12869] bridge_slave_0: entered promiscuous mode [ 436.153476][ T5765] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 436.173967][T12869] bridge0: port 2(bridge_slave_1) entered blocking state [ 436.175302][ T5765] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 436.193274][T12869] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.206960][T12869] bridge_slave_1: entered allmulticast mode [ 436.210676][ T5765] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 436.218929][T12869] bridge_slave_1: entered promiscuous mode [ 436.248995][ T5765] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.249976][T12637] veth1_vlan: entered promiscuous mode [ 436.278815][T12899] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 436.294445][ T5765] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 436.334158][T12869] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 436.367163][T12869] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 436.506604][T12899] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1595'. [ 436.517331][T12899] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1595'. [ 436.652855][ T9229] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.690807][T12869] team0: Port device team_slave_0 added [ 436.703013][T12869] team0: Port device team_slave_1 added [ 436.768477][T12666] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 436.783979][T12869] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 436.791790][T12869] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.820676][T12869] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 436.855034][ T9229] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.879692][T12869] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 436.892023][T12869] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.918626][T12869] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 437.012672][ T9229] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.031110][T12637] veth0_macvtap: entered promiscuous mode [ 437.050949][T12869] hsr_slave_0: entered promiscuous mode [ 437.057633][T12869] hsr_slave_1: entered promiscuous mode [ 437.063840][T12869] debugfs: 'hsr0' already exists in 'hsr' [ 437.069653][T12869] Cannot create hsr debugfs directory [ 437.081000][T12637] veth1_macvtap: entered promiscuous mode [ 437.129138][ T9229] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.147279][ T808] usb 4-1: USB disconnect, device number 95 [ 437.264107][T12751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 437.304164][T12637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 437.340582][T12637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 437.429321][ T35] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.440386][ T35] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.450185][ T35] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.471309][T12751] 8021q: adding VLAN 0 to HW filter on device team0 [ 437.480044][T12666] veth0_vlan: entered promiscuous mode [ 437.486353][ T35] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.529311][T12666] veth1_vlan: entered promiscuous mode [ 437.557881][ T8391] bridge0: port 1(bridge_slave_0) entered blocking state [ 437.565076][ T8391] bridge0: port 1(bridge_slave_0) entered forwarding state [ 437.597577][ T9229] bridge_slave_1: left allmulticast mode [ 437.603616][ T9229] bridge_slave_1: left promiscuous mode [ 437.609681][ T9229] bridge0: port 2(bridge_slave_1) entered disabled state [ 437.619820][ T9229] bridge_slave_0: left allmulticast mode [ 437.625908][ T9229] bridge_slave_0: left promiscuous mode [ 437.631621][ T9229] bridge0: port 1(bridge_slave_0) entered disabled state [ 437.990656][ T9229] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 438.000688][ T9229] bond0 (unregistering): Released all slaves [ 438.029294][ T8391] bridge0: port 2(bridge_slave_1) entered blocking state [ 438.036513][ T8391] bridge0: port 2(bridge_slave_1) entered forwarding state [ 438.145375][ T5635] Bluetooth: hci0: command tx timeout [ 438.167574][ T9229] tipc: Disabling bearer [ 438.174299][ T9229] tipc: Disabling bearer [ 438.182526][ T9229] tipc: Left network mode [ 438.194848][ T5695] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 438.267506][ T6111] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.276051][ T6111] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 438.398587][ T5695] usb 4-1: Using ep0 maxpacket: 16 [ 438.408797][ T8391] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.422264][ T5695] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 438.436619][ T8391] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 438.449179][ T5695] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 438.467961][T12666] veth0_macvtap: entered promiscuous mode [ 438.472920][ T5695] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 438.494128][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.514821][ T5695] usb 4-1: Product: syz [ 438.525631][ T5695] usb 4-1: Manufacturer: syz [ 438.532573][ T5695] usb 4-1: SerialNumber: syz [ 438.574061][ T5695] usb 4-1: 0:2 : does not exist [ 438.666978][T12666] veth1_macvtap: entered promiscuous mode [ 438.701674][ T9229] hsr_slave_0: left promiscuous mode [ 438.718564][ T9229] hsr_slave_1: left promiscuous mode [ 438.725807][ T9229] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 438.733295][ T9229] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 438.758983][ T9229] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 438.769944][ T9229] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 438.782101][ T5695] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 438.812603][ T9229] veth1_macvtap: left promiscuous mode [ 438.825608][ T9229] veth0_macvtap: left promiscuous mode [ 438.839262][ T9229] veth1_vlan: left promiscuous mode [ 438.855121][ T9229] veth0_vlan: left promiscuous mode [ 438.871395][ T5695] usb 4-1: USB disconnect, device number 96 [ 438.955119][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 439.427488][ T9229] team0 (unregistering): Port device team_slave_1 removed [ 439.456637][ T9229] team0 (unregistering): Port device team_slave_0 removed [ 439.623520][ T5292] 8021q: adding VLAN 0 to HW filter on device eth1 [ 439.647478][T12957] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.765168][ T8956] usb 4-1: new full-speed USB device number 97 using dummy_hcd [ 439.820132][T12751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 439.863174][T12970] ================================================================== [ 439.867814][T12666] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 439.871299][T12970] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 439.883070][T12666] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 439.887079][T12970] Write of size 640 at addr ffffc900050e1df2 by task vivid-000-vid-c/12970 [ 439.887095][T12970] [ 439.905226][T12970] CPU: 1 UID: 0 PID: 12970 Comm: vivid-000-vid-c Tainted: G L syzkaller #0 PREEMPT(full) [ 439.905333][T12970] Tainted: [L]=SOFTLOCKUP [ 439.905339][T12970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 439.905350][T12970] Call Trace: [ 439.905357][T12970] [ 439.905365][T12970] dump_stack_lvl+0xe8/0x150 [ 439.905392][T12970] print_address_description+0x55/0x1e0 [ 439.905421][T12970] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 439.905443][T12970] print_report+0x58/0x70 [ 439.905457][T12970] kasan_report+0x117/0x150 [ 439.905473][T12970] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 439.905496][T12970] kasan_check_range+0x264/0x2c0 [ 439.905512][T12970] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 439.905532][T12970] __asan_memcpy+0x40/0x70 [ 439.905552][T12970] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 439.905599][T12970] vivid_thread_vid_cap_tick+0x1021/0x5fd0 [ 439.905696][T12970] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 439.905718][T12970] ? lockdep_hardirqs_on+0x7a/0x110 [ 439.905736][T12970] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 439.905753][T12970] ? vivid_thread_vid_cap+0x491/0x1190 [ 439.905776][T12970] vivid_thread_vid_cap+0x909/0x1190 [ 439.905792][T12970] ? __lock_acquire+0x6b5/0x2cf0 [ 439.905818][T12970] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 439.905837][T12970] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 439.905859][T12970] ? __kthread_parkme+0x7a/0x1f0 [ 439.905893][T12970] kthread+0x389/0x470 [ 439.905911][T12970] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 439.905926][T12970] ? __pfx_kthread+0x10/0x10 [ 439.905944][T12970] ret_from_fork+0x514/0xb70 [ 439.905972][T12970] ? __pfx_ret_from_fork+0x10/0x10 [ 439.905986][T12970] ? __switch_to+0xc79/0x1410 [ 439.906005][T12970] ? __pfx_kthread+0x10/0x10 [ 439.906022][T12970] ret_from_fork_asm+0x1a/0x30 [ 439.906045][T12970] [ 439.906052][T12970] [ 440.086264][T12970] The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900050e1000 allocated at vb2_vmalloc_alloc+0xef/0x360 [ 440.099593][T12970] The buggy address belongs to the physical page: [ 440.106010][T12970] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a494 [ 440.114760][T12970] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 440.121868][T12970] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 440.130434][T12970] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 440.139010][T12970] page dumped because: kasan: bad access detected [ 440.145430][T12970] page_owner tracks the page as allocated [ 440.151126][T12970] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 12969, tgid 12968 (syz.0.1602), ts 439851965910, free_ts 439851933186 [ 440.170477][T12970] post_alloc_hook+0x22d/0x280 [ 440.175244][T12970] get_page_from_freelist+0x2593/0x2610 [ 440.180776][T12970] __alloc_frozen_pages_noprof+0x18d/0x380 [ 440.186568][T12970] __alloc_pages_noprof+0x10/0x100 [ 440.191665][T12970] alloc_pages_bulk_noprof+0x5ff/0x7c0 [ 440.197108][T12970] alloc_pages_bulk_mempolicy_noprof+0x34e/0x1680 [ 440.203522][T12970] __vmalloc_node_range_noprof+0xad1/0x1750 [ 440.209419][T12970] vmalloc_user_noprof+0xad/0xe0 [ 440.214383][T12970] vb2_vmalloc_alloc+0xef/0x360 [ 440.219233][T12970] __vb2_queue_alloc+0x9c5/0x15a0 [ 440.224248][T12970] vb2_core_reqbufs+0xc1f/0x1410 [ 440.229179][T12970] vb2_ioctl_reqbufs+0x4c0/0x830 [ 440.234120][T12970] __video_do_ioctl+0xadb/0xca0 [ 440.239042][T12970] video_usercopy+0x876/0x1450 [ 440.243792][T12970] v4l2_ioctl+0x18d/0x1e0 [ 440.248174][T12970] __se_sys_ioctl+0xfc/0x170 [ 440.252755][T12970] page last free pid 12969 tgid 12968 stack trace: [ 440.259236][T12970] __free_frozen_pages+0xc1c/0xd30 [ 440.264338][T12970] __kasan_populate_vmalloc+0x1b2/0x1d0 [ 440.269883][T12970] alloc_vmap_area+0xd47/0x1480 [ 440.274729][T12970] __get_vm_area_node+0x1f8/0x300 [ 440.279738][T12970] __vmalloc_node_range_noprof+0x36a/0x1750 [ 440.285617][T12970] vmalloc_user_noprof+0xad/0xe0 [ 440.290539][T12970] vb2_vmalloc_alloc+0xef/0x360 [ 440.295379][T12970] __vb2_queue_alloc+0x9c5/0x15a0 [ 440.300388][T12970] vb2_core_reqbufs+0xc1f/0x1410 [ 440.305314][T12970] vb2_ioctl_reqbufs+0x4c0/0x830 [ 440.310239][T12970] __video_do_ioctl+0xadb/0xca0 [ 440.315075][T12970] video_usercopy+0x876/0x1450 [ 440.319843][T12970] v4l2_ioctl+0x18d/0x1e0 [ 440.324174][T12970] __se_sys_ioctl+0xfc/0x170 [ 440.328755][T12970] do_syscall_64+0x174/0x580 [ 440.333327][T12970] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.339207][T12970] [ 440.341513][T12970] Memory state around the buggy address: [ 440.347204][T12970] ffffc900050e1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 440.355248][T12970] ffffc900050e1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 440.363295][T12970] >ffffc900050e2000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 440.371336][T12970] ^ [ 440.375388][T12970] ffffc900050e2080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 440.383428][T12970] ffffc900050e2100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 440.391465][T12970] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 440.410428][T12970] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 440.417688][T12970] CPU: 1 UID: 0 PID: 12970 Comm: vivid-000-vid-c Tainted: G L syzkaller #0 PREEMPT(full) [ 440.429069][T12970] Tainted: [L]=SOFTLOCKUP [ 440.433398][T12970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 440.443444][T12970] Call Trace: [ 440.446715][T12970] [ 440.449634][T12970] vpanic+0x56c/0xa60 [ 440.453610][T12970] ? __pfx_vpanic+0x10/0x10 [ 440.458097][T12970] ? __pfx___schedule+0x10/0x10 [ 440.462941][T12970] panic+0xc5/0xd0 [ 440.466656][T12970] ? __pfx_panic+0x10/0x10 [ 440.471069][T12970] ? preempt_schedule_common+0x82/0xd0 [ 440.476518][T12970] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 440.482146][T12970] check_panic_on_warn+0x89/0xb0 [ 440.487075][T12970] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 440.492691][T12970] end_report+0x73/0x170 [ 440.496922][T12970] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 440.502540][T12970] kasan_report+0x128/0x150 [ 440.507029][T12970] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 440.512650][T12970] kasan_check_range+0x264/0x2c0 [ 440.517584][T12970] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 440.523225][T12970] __asan_memcpy+0x40/0x70 [ 440.527642][T12970] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 440.533134][T12970] vivid_thread_vid_cap_tick+0x1021/0x5fd0 [ 440.538983][T12970] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 440.544782][T12970] ? lockdep_hardirqs_on+0x7a/0x110 [ 440.549965][T12970] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 440.556107][T12970] ? vivid_thread_vid_cap+0x491/0x1190 [ 440.561566][T12970] vivid_thread_vid_cap+0x909/0x1190 [ 440.566838][T12970] ? __lock_acquire+0x6b5/0x2cf0 [ 440.571774][T12970] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 440.577483][T12970] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 440.583282][T12970] ? __kthread_parkme+0x7a/0x1f0 [ 440.588207][T12970] kthread+0x389/0x470 [ 440.592264][T12970] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 440.597966][T12970] ? __pfx_kthread+0x10/0x10 [ 440.602547][T12970] ret_from_fork+0x514/0xb70 [ 440.607127][T12970] ? __pfx_ret_from_fork+0x10/0x10 [ 440.612226][T12970] ? __switch_to+0xc79/0x1410 [ 440.616894][T12970] ? __pfx_kthread+0x10/0x10 [ 440.621473][T12970] ret_from_fork_asm+0x1a/0x30 [ 440.626232][T12970] [ 440.629532][T12970] Kernel Offset: disabled [ 440.633875][T12970] Rebooting in 86400 seconds..